AI Governance

Model Updates Over the Holidays: Who Approves the Change?

AI vendors ship model updates on their own calendar, holidays included. Decide now who may approve a change while your team is away, and on what evidence.

A laptop beside colorful notebooks and a mug on a bright desk.

Your AI vendor does not observe your change freeze. Models get updated on the vendor's calendar, sometimes announced, sometimes not, and a workflow that behaved one way in November can behave differently in January without anyone in your company changing anything.

For the workflows that matter, someone in your organization should hold a simple authority: whether and when a model change gets adopted, and what evidence must exist before it does.

Key takeaways

  • Vendors update models on their calendar, not yours, holidays included.

  • A model change is a change to your process and deserves the same approval discipline.

  • Name who may accept a model update for each important workflow, and what evidence they need.

  • Vendor release notes and a short revalidation are the minimum evidence.

  • The answer cannot be 'nobody was watching' for a workflow customers depend on.

Step 1: List the workflows where a model change would matter

Not every use of AI needs this attention. The list is the workflows where a behavior change would hurt: the drafting that reaches customers, the summaries that feed decisions, the classification that routes work.

Three to five workflows is typical. For each, the question is simple: if the model changed tonight, who would notice, and when?

Step 2: Name the approver for each workflow

Every workflow on the list gets an owner with the authority to accept or pause a model change. That person needs two things: to know when a change happened, which means watching the vendor's release notes or announcements, and a standard for what evidence comes before adoption.

The pre-launch review that protects customers is the fuller framework for exactly this decision.

Step 3: Set the minimum evidence

For important workflows, adoption follows evidence, not the vendor's announcement. A short revalidation usually suffices: run the workflow's known cases against the new model and compare. This fictional example shows the record. It is an illustration, not a prescription.

Workflow Approver Evidence before adoption Holiday cover
Customer reply drafts Support lead 10 known cases reviewed Manager on call
Document summaries Operations lead Spot-check against source Delegate named
Ticket classification Support lead One week of routing audit None; vendor pins version

The holiday-cover column is where this meets December: the approver is on vacation, so who holds the pen?

Step 4: Pin, pause or accept, in writing

The workable options are few. Pin the version if the vendor allows it, pause the workflow's AI step for the thin weeks, or accept the change after revalidation with the decision recorded. What does not work is drift: the model changing while everyone assumes someone else is watching.

Putting model failures in the response plan covers the other end of this: what happens when a change gets through and the workflow misbehaves.

Frequently asked questions

Do vendors really change models without notice?

Practices vary by vendor and product tier. Some pin versions and announce changes; others update continuously. The only safe move is to check each vendor's actual policy for the workflows that matter to you.

Is pausing AI steps over the holidays an overreaction?

For low-stakes uses, yes. For workflows whose output reaches customers or feeds decisions, a pause during weeks with no coverage is a reasonable, reversible choice, and often the honest one.

Who should be the approver?

The business owner of the workflow, with technical help for the revalidation. The mistake is leaving it with nobody, or with the vendor.

How does this fit with a change freeze?

It is the same discipline applied to changes made for you rather than by you. Your freeze covers your releases; model approval covers the vendor's.

A Defensible Next Step

Before the holidays, list the workflows where a quiet model change would matter, and write a name in the approver column for each. Book a Decision-Clarity Call if you want help building the revalidation habit.

Next step

Get Board-Ready on AI and Cyber Risk

A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.

Stop Guessing. Start Scoring
Tyson Martin

Written by Tyson Martin, NACD.DC

Chief Trust, Security & AI Officer. CISO of record at MIO Partners; former CISO & CTO at Lumber Liquidators and Orvis; advisor to 200+ Fortune 500 boards and C-suites at AWS.

See the track record
Keep reading

More on AI Governance

All CISO Insights
AI Governance

Who Signs Off on a New AI Use Case?

AI use-case approval needs a business owner, qualified reviewers and an authority boundary. Build an intake route that distinguishes tool purchase from permission to deploy.