A new AI change management framework argues that a locally installed tool can spread across a company from a single executive's sign-off. In a regulated company, that path still needs a named owner for every regulated process the tool touches.
Iternal, which sells an AI product called AirgapAI, has published an enterprise AI change management framework built around executive sponsorship and a champion network. Its central claim is that executive sponsorship is a binary factor in adoption. Citing research in The AI Strategy Blueprint, the framework says projects without a C-level champion become orphaned regardless of technology quality, because they lack budget approval authority, organizational priority and the cross-departmental mandate needed to change processes. It divides ownership among three roles. The executive sponsor holds the budget and the mandate. The program owner runs the maturity assessment, the wave sequence, the training calendar and the champion network. IT owns deployment, access and the run. The failure mode it names is assuming one of those roles covers everything alone.
The same page makes a second argument aimed at mid-level leaders who struggle to get senior buy-in. Because AirgapAI runs entirely on a local AI PC, Iternal says it needs only individual installation with light IT authorization. That means a business case shown to a single executive can become the entry point for enterprise-wide adoption without committee approval, vendor selection or infrastructure work. For a mid-market company in a regulated industry, I think that second argument deserves a closer look than the first. The approvals it promises to avoid are often the ones that keep regulated work defensible.
A tool that keeps data on the laptop answers one of the first questions a compliance team asks, which is where sensitive information goes. That is a genuine benefit, and so is avoiding a long infrastructure project for something people want to try. The questions that come next are about use. What will people do with the output, and does that output end up in a regulated record or a regulated decision? Where the tool is installed has no bearing on those answers.
Consider a medical device quality engineer who starts using a local assistant to draft complaint investigation summaries or CAPA write-ups. That software is now part of a quality management system process. ISO 13485 requires organizations to validate computer software used in the quality management system, with an approach proportionate to the risk of its use. FDA's guidance on computer software assurance for production and quality system software lays out a risk-based way to do that. The effort may be modest for a drafting aid with documented human review, but someone has to make that determination and write it down.
The same question comes up in other industries. A bank analyst who uses the same kind of tool to produce figures that feed a credit or pricing decision may have created something that falls under the Federal Reserve's model risk management guidance (SR 11-7), depending on how the institution defines a model. In manufacturing and logistics, AI-drafted work instructions or supplier communications can fall under document control and customer quality agreements. Making that call takes one informed person and a short written record, and it should happen before people build habits around the tool.
Iternal's split between sponsor, program owner and IT is a sensible way to keep a rollout from being orphaned. In a regulated company I would add a fourth named role, which is the owner of each regulated process the tool touches. That is usually the quality director for complaint handling and CAPA, the controller for financial close, or the compliance officer for customer communications. This person decides whether a given use is in scope for validation, what record of AI involvement has to be kept, and what human review looks like before an output is signed.
The program owner can't fill that seat, however capable they are. Someone in HR or an AI center of excellence can schedule training and sequence rollout waves, but they don't own the procedure that governs a CAPA, and an auditor will direct questions about how the tool was qualified to the procedure owner. Many mid-market companies don't have a separate transformation office or center of excellence anyway, so one person may hold two of these roles. That arrangement works as long as the names are written down and the process owner is consulted before a use spreads.
The champion network makes this more pressing. Champions are how a tool spreads from one enthusiastic user to a whole department, which is exactly what the framework intends. The same mechanism can put an unreviewed use into a dozen people's daily routine before quality or compliance hears about it. If the process owner has already drawn the boundary, champions spread approved uses instead.
The appeal of a light-authorization entry point is speed, and regulated companies can keep most of it with a short intake step. Sort intended uses into tiers before installation. Personal productivity work, such as drafting internal email or summarizing public documents, can proceed under a usage policy. Drafting text that will go into a controlled record needs a documented review step and a validation decision proportionate to risk. Anything that produces an input to a regulated decision needs the full treatment your quality system or model risk policy already prescribes.
Change control is the other gap. A locally installed AI tool still receives updates, and a new model version can produce different output for the same prompt. The framework assigns the run to IT, and that responsibility should include deciding how updates are delivered. If the tool supports a validated use, an update to it should go through the same change control as any other change to validated software.
A few steps will keep the speed of a local rollout while giving quality and compliance a defensible record:
Dealing with a similar challenge?
We work with mid-market companies in regulated industries to build AI workflows that actually hold up.
Let's TalkSean Cummings
Founder of Laminar Consulting Services. Specializes in AI workflow automation for regulated industries — medical device, financial services, and complex logistics operations.