Governance for models that keep learning

A board that authorises an AI system authorises a thing that will not exist for long. The system demonstrated in March — weights, thresholds, training data — is not the system running in June. Retraining, vendor updates and feedback loops rewrite the authorised object weekly, sometimes silently. The question is not whether we approve this system, but what our signature attaches to once it starts moving.

Our position: point-in-time approval of a learning system is void the moment it changes. What a board can honestly authorise is an envelope — the bounds within which the system may change, the monitoring that proves it is still inside them, and the tripwires that revoke authorisation automatically when it is not. A board that cannot produce that document has not authorised a system; it has authorised a memory of one.

European law made the envelope statutory. The AI Act defines "substantial modification" as a change not foreseen in the initial conformity assessment that affects compliance or purpose, and requires a fresh assessment for a substantially modified high-risk system. For systems that continue to learn, changes pre-determined at the initial assessment and recorded in the technical documentation are not substantial modifications at all.

Read as governance design: the legislator concedes that re-approving a learning system at every change is impossible, and demands instead that the permitted change-space be declared in advance. That is an envelope, in statute. What it leaves open is who watches the boundary.

ISO/IEC 42001:2023, the certifiable AI management-system standard, requires the machinery a moving artifact needs: planned monitoring, performance evaluation, internal audit, management review and continual improvement, for as long as the system operates. ISO/IEC 23894:2023 supplies the risk process inside it. Neither sets a numeric threshold.

The oldest evidence is bank model risk management. SR 11-7 made ongoing monitoring, outcomes analysis and periodic revalidation mandatory for bank models in 2011 — validation as a lifecycle, not an event. On 17 April 2026 it was superseded by the interagency guidance SR 26-2 / OCC Bulletin 2026-13, which carries the discipline to in-scope AI and pointedly excludes generative and agentic AI as too novel to standardise: the supervisors of the world's largest balance sheets refuse point-in-time comfort, and refuse to pretend they have solved the newest models.

The three regimes triangulate the same object: declared change-bounds, running monitoring machinery, supervised revalidation. What none writes — because it is a firm position about board mechanics, not a legal fact — is the third element: revocation tripwires. Bounds without automatic consequences are decoration. The envelope is complete only when pre-agreed conditions — a drift metric out of range, an undeclared retrain, a population shift — suspend the system's authority without waiting for the next board meeting.

Evidence cards

The board sits in Paris or Geneva; the learning system runs in Abidjan, scoring credit or screening fraud. It will never inspect the system and governs only what crosses on paper. If that is a quarterly slide saying "the AI is performing well," it has authorised an artifact it cannot see. What must cross is the envelope report: every retrain, threshold move and vendor update marked inside or outside the declared bounds; drift metrics against their limits, each with an owner and a cadence; boundary events and what they triggered; and who in Abidjan can suspend the system tonight without a call to Paris. The regulatory floor is asymmetric: the AI Act binds the European holding, and no equivalent statute operates in the WAEMU jurisdictions where the system runs, so the envelope exists only if the group imposes it by governance and contract, including on vendors who retrain upstream models without asking. Drift is also faster in the corridor: informal-market data, currency events and thin credit histories move the input distribution more violently than vendor defaults assume, so a cadence copied from a European plan understates corridor drift by design.

Sources and limitations

Sources and limitations. The institutional facts rest on Regulation (EU) 2024/1689 Articles 3(23) and 43(4), with the application timeline amended by Regulation (EU) 2026/1744, on ISO/IEC 42001:2023 and ISO/IEC 23894:2023, and on the supervisory lineage from SR 11-7 to SR 26-2 / OCC Bulletin 2026-13 — each carried with its caveat above. The envelope doctrine — bounds, monitoring, tripwires as the object of board authorisation — is the firm's position, graded as interpretation: the three regimes motivate it, none mandates it in those terms, and we cite no client outcomes because none has passed our evidence-release gate. The transferability boundary is explicit: strongest where a learning system runs at operating distance from the board that authorised it; weakest for frozen models under disciplined release control. This note is not valid as legal advice on conformity assessment, nor as a claim that any certification or supervisory regime, by itself, makes a learning system safe to authorise.

1. The company secretary: check whether the last AI authorisation names an artifact or an envelope. If it names only a version demonstrated at a past meeting, it expired at the first retrain.

2. The chief risk officer: write the tripwires and name the officer in the operating company who can pull them without convening the board. Conditions, maximum delay, local authority: a revocation that waits for a board calendar is not a control.

3. The model owner: produce the boundary log since the last meeting. Each retrain, threshold move, population shift and vendor update, marked declared or discovered. Zero boundary events deserves the suspicion an audit with zero findings deserves.

4. The procurement lead: check whether the vendor contract obliges disclosure of model changes against our envelope, in days rather than quarters. If not, the envelope has a hole the size of the vendor.