Your AI vendor changed. Did your risk assessment?

The governing rule

Do not ask whether the vendor has changed. Ask whether the approved risk case has changed. A new logo, product label or minor interface release may have no material effect. A silent model substitution or revised data-use term may matter even if the service looks identical to the user.

A change is material when it alters at least one answer that mattered to the original decision: what data leaves the organisation, who receives it, what the system can do, how reliably it performs, which controls are inherited, where processing occurs, how an incident is handled, or whether the organisation can continue, challenge or exit.

Materiality is use-case specific. The same model update may be low consequence in a drafting aid and high consequence in a system that classifies claims or initiates payments.

The AI-vendor material-change trigger list

Use this list in a vendor review, contract discussion or system-owner meeting. It is editorial synthesis, not a universal legal test. Every trigger needs a named owner, a source of notice and a pre-agreed response.

On a narrow screen, each row is shown as a separate card.

Three responses, not one ritual

The trigger list should not become an automatic veto. It should produce a proportionate response.

1. Record. The change is relevant to the inventory but does not alter the approved use, data, authority, control evidence or recovery plan. Update the record and retain the reason.
2. Reassess. The change affects part of the risk case, but use can continue within an existing boundary while the owner completes a targeted test or review. Set a deadline, evidence requirement and accountable decision-maker.
3. Suspend or restrict. The change crosses an explicit limit, removes a relied-upon control, expands action authority, creates an unreviewed data flow or leaves the organisation without a safe fallback. Pause the affected function—not necessarily the whole supplier relationship—until the decision is remade.

This ladder keeps the burden of proof balanced. The person raising a concern should identify which approval assumption changed. The service owner should show why the existing decision still holds, or what bounded response restores it. Neither novelty nor convenience settles the question.

A model upgrade is a useful worked example

Microsoft’s current Foundry policy illustrates the operating problem without proving that every upgrade is harmful. Global Standard, Data Zone Standard and Standard deployments can be automatically upgraded when a model version retires; Provisioned deployments require manual migration. Microsoft recommends evaluating a replacement against the customer’s own application, prompts and representative data, including quality, latency, cost, compatibility and regional availability. ³

Suppose a customer-service summarisation tool was approved for internal use with a fixed output schema and a human checking every summary. A model replacement does not automatically justify a full procurement exercise. It does justify a targeted comparison using representative calls, including accents, complaints, personal data and unusual cases. If the schema, error pattern and review burden stay within the approved tolerance, the owner records the result and proceeds.

Now change the use case. The same service routes vulnerable customers, initiates refunds and sends external messages without prior review. A model substitution changes more than text quality. It may affect prioritisation, authority and consequence. The organisation needs a stronger pre-release test, explicit rollback and a named decision on continued autonomy. The vendor event is the same; the management response is different because the risk case is different.

Capability signal and management signal

The capability signal is that an AI service can change materially through model, dependency and feature updates without a fresh buying event. Product lifecycle documentation makes that visible. It does not show that any particular change will worsen performance or create harm. Some changes will improve the service.

The management signal is that ownership must persist after onboarding. Procurement can establish terms. Security, privacy and legal teams can define boundaries. Only a named service or system owner can connect notices to the actual use, decide what must be tested and ensure that an unresolved change does not disappear between functions. Continuous monitoring without decision ownership is only a faster stream of alerts.

Put notice into the contract and detection into the operation

The Vanta article that prompted this proposition argues for defined material-change criteria and notification obligations. Vanta sells governance, risk and compliance software, so its diagnosis and recommended tooling cannot be treated as neutral market evidence. The trigger remains useful because authoritative sources independently support lifecycle monitoring, supplier oversight and version-aware evaluation. ⁵

A contract can require notice of specified changes, but notice alone is insufficient. Not every relevant change will arrive in a helpful email, and the recipient may not be the person who owns the use. The operational design needs an inventory linking each service to its owner, approved use, data classes, dependencies, notice channels, review tier and fallback.

Release notes, subprocessor lists, policy changes, certification dates, incident notices and model lifecycle feeds must land somewhere that can produce a decision.

The minimum viable review is small but explicit: what changed; which approval assumption it touches; which users, data or decisions are exposed; what evidence is required; who decides; what happens while that decision is pending; and when the next review is due.

The evidence supports a lifecycle control, not a crisis claim

NIST calls for ongoing monitoring and dynamic assessment of third-party generative AI risk. Joint government security guidance says changes to data, models or prompts can change system behaviour and that major updates should be treated like new versions. Microsoft documents model retirement and upgrade mechanics. ^{1 2 3}

The EU AI Act establishes a continuous, iterative risk-management process and consequences for substantial modification within its high-risk-system regime. Following Regulation (EU) 2026/1744, however, the relevant Chapter III requirements are scheduled to apply from 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems. They are not a current universal vendor-review rule. ⁴

There is no public representative dataset here showing how often AI vendors change materially between reviews, how frequently customers miss those changes or what losses follow. Vanta’s examples are commercially interested observations. Microsoft’s documentation describes one platform’s lifecycle policy, not the whole market. The AI Act’s substantial-modification rules sit within a defined high-risk-system scope and phased application timetable.

The defensible conclusion is narrower: point-in-time approval can become stale, credible frameworks expect ongoing oversight, and real model services have version and retirement mechanics that require customer action. That is enough to justify a trigger-and-response control. It is not enough to claim a measured crisis.

The sentence for the next vendor review

Do not ask only whether the supplier still passes the questionnaire. Ask which changes would invalidate the reasons we approved this use, how we would learn about them and who has authority to respond.

If those answers are missing, the organisation does not have a current risk decision. It has a dated assessment and a hope that the service still resembles it.

Approval is not a durable property of the supplier. It belongs to a risk case that must still be true.

Evidence note

The article separates a documented capability signal from the management response. Vendor material is used to show an actual product lifecycle and a commercially interested risk-management proposition. It is not used as independent evidence of incident rates, customer outcomes or market-wide practice. The material-change list and response ladder are Andrew’s Intel editorial synthesis.