Your AI Governance Can Change Without You

"The risk can change even when nobody in your business changes a thing."

I received an email from Anthropic this week.

It was a product update about memory.

Claude's memory was changing across chat and Cowork. Users would have clearer visibility over what had been saved. Organisations would get new controls around sensitive topics. Existing memories would carry across into the new system.

Nothing about that is inherently alarming.

In fact, most of the changes are designed to give organisations more control.

But the email exposed a governance problem that I think most businesses are not yet set up for.

The risk can change even when nobody in your business changes a thing.

No employee downloaded a new tool.

Nobody connected an unauthorised system. Nobody broke the policy. Nobody expanded a permission.

The vendor changed the product.

And that may be enough to make yesterday's governance decision worth looking at again.

This is a different kind of governance drift

Most AI governance still assumes change comes from inside the organisation.

Someone wants to use a new tool. A team proposes a new use case. A power user connects another system. An employee starts handling different information.

Those are visible events. At least in theory, someone can notice them and trigger a review.

Vendor-driven change is different.

The product keeps evolving after you approve it.

A memory system changes. A new connector appears. A default gets altered. A new model replaces the old one. Data starts flowing differently between parts of the platform. A feature that did not exist when the original assessment was completed suddenly becomes part of the product.

Nobody inside your business necessarily asked for it.

But your governance environment changed anyway.

That creates a simple problem.

Who is watching?

Most businesses are still at the first stage of AI governance.

Maybe there is an AI use policy. Maybe leadership has agreed that Copilot or ChatGPT is okay for certain work. Maybe a couple of tools have been informally approved.

That already feels like progress.

But the product does not stop changing once you have made that decision.

AI platforms are shipping meaningful capability changes constantly.

Sometimes those changes affect productivity. Sometimes usability. Sometimes access. Sometimes the way information is stored, remembered or shared across the product.

The point is, not every update creates a new risk.

Most will not.

The point is that you need some way of knowing which ones do.

A policy or approval decision can tell you what you were comfortable with at the time.

It cannot tell you whether the assumptions behind that decision are still true.

That is the gap.

Nobody owns the change between reviews

Imagine you assessed an AI platform three months ago.

The privacy position looked acceptable. The available features matched the intended use. The controls were understood. You documented the decision.

Then the vendor ships ten updates over the next quarter.

Who reads them?

IT?

The person who originally requested the tool?

The AI lead?

Risk?

Legal?

Nobody?

And even if someone sees the update, who connects it back to the original decision?

That is the part most organisations have not built.

The information exists.

The governance documents exist.

The missing piece is the intelligence between them.

This gets harder as your AI stack grows

With one AI platform, maybe someone can keep an eye on it manually.

Now add Microsoft Copilot. ChatGPT. Claude. Gemini. AI features inside your CRM. AI note-taking tools. Recruitment systems. Customer service platforms. Project management tools. Industry-specific software quietly adding AI capability into existing products.

The problem scales quickly.

You do not just have more tools.

You have more vendors changing more things more often.

And every one of those changes has to be interpreted against your own environment.

Does it matter to us? Does it affect the use we approved? Does it change what information is involved? Does it alter a control we were relying on? Do we need to do anything?

At that scale, no person can track it manually. It needs intelligence, not a spreadsheet.

Governance needs a monitoring layer

The next generation of AI governance will need to do more than record decisions.

It will need to watch for change.

Vendor updates. New capabilities. Changed settings. New integrations.

Changes in how the organisation is actually using the tool.

Then it needs to connect those signals back to the decisions already made.

Not to create noise.

The opposite.

The whole point is to avoid dragging every product update into a governance meeting.

Most updates should disappear into the background.

The system should surface the small number that could actually matter.

That is the difference between information and intelligence.

Information says: Anthropic changed memory.

Intelligence says: This change may affect the assumptions behind our current approval for these users and these use cases. Someone should review it.

That is much closer to what good governance needs to become.

The governance challenge is now continuous

This is an important shift.

AI governance cannot be treated as something you complete.

You can complete an assessment. You can approve a tool. You can write a policy.

You can update your guidance. But the environment does not stop moving when the meeting ends.

The vendors keep building. Your people keep learning. The use cases keep changing. The risks keep evolving. So governance has to become a living system too.

Not because organisations need more bureaucracy. Because point-in-time governance is starting to create false confidence.

A decision can be completely reasonable when it is made and quietly become outdated three months later. No breach. No reckless employee. No obvious incident.

Just change.

Ask a different question

At your next AI governance meeting, don’t just ask what new tools or use cases need approval.

Ask instead:

Who is responsible for knowing when one of our AI vendors changes something that could make one of our previous governance decisions obsolete?

If the answer is nobody, that is the gap.

Because increasingly, the biggest change in your AI environment may not come from your people.

It may arrive in an email from the vendor on a Wednesday morning.

AI governance cannot just record decisions. It has to know when those decisions need to be revisited.

Find out if your AI governance can keep up with your AI vendors

Most businesses can tell you what they approved. Few can tell you whether that approval still holds now that the tools have changed.

The 5 Minute AI Readiness Snapshot helps you see where your governance decisions might already be out of step with what your AI tools can actually do today.

Take the 5-Minute AI Readiness Snapshot

--

About the Author 

Mark Lucas is Co-founder and Managing Partner at Generation AI, where we help New Zealand business leaders build real AI capability.

Information provided is general in nature and does not constitute legal advice