Technology & Platforms ยท TEC-07
Technology change and refresh
The organisation plans for changes to models, suppliers and platforms, including suppliers withdrawing models, so that AI services continue without disruption.
Why it matters
AI models and platforms are replaced and withdrawn far faster than most enterprise technology, often on the supplier's timetable. Planning for that change avoids services stopping or being kept on unsupported versions, and keeps the organisation able to move to better options.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | Change is handled when it is forced; supplier withdrawals arrive as surprises. |
| 2 Developing | Some services track supplier roadmaps or end-of-life dates, but there is no consistent planning or capacity for change. |
| 3 Defined | Every AI service has a maintained, regularly reviewed bill of materials with end dates, a funded refresh plan, and recorded concentration risk. |
| 4 Managed | Dependency end dates and supplier notices are tracked across the estate, changes are scheduled ahead of deadlines, and services caught by unplanned change are reviewed. |
| 5 Optimising | Services are designed so models and platforms can be swapped with little rework, and refresh planning is improved from experience of past changes. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- TEC-07.1 Every AI service has a maintained bill of materials covering its models, data sets, libraries, services, suppliers and platforms, with their known end dates.
- TEC-07.2 Each AI service has a refresh plan with an owner and a budget for planned change.
- TEC-07.3 Concentration on a single foundation model or supplier is recorded as a dependency risk.
- TEC-07.4 Each bill of materials is reviewed on a set cycle and on significant change.
Assessment questions
- Which models, suppliers and platforms does each AI service depend on, and when might they change or be withdrawn?
- How would you learn that a supplier was retiring a model you rely on?
- What would it take to move a service to a different model or platform?
- Bill of materials for each AI service with its last review date
- A dependency record showing models, platforms, versions and known end dates
- Refresh plans and budget lines for planned change
- Dependency records showing concentration on single models or suppliers
How to reach Level 3
- Build a bill of materials for every AI service, listing models, data sets, libraries, services, suppliers and platforms with known end dates.
- Give each service a refresh plan, owner and budget for planned change.
- Record reliance on a single foundation model or supplier as a dependency risk.
- Review each bill of materials on a fixed cycle and whenever there is significant change.
Common pitfalls
- Learning of a model's withdrawal from the supplier's notice instead of a tracked end date.
- Planning refreshes with no budget set aside.
Starter artefacts
- Bill of materials per AI service
- Refresh plan
Cross-references
| AI Cyber Security Code of Practice | 5.1 partial; 11.1 partial; 11.3 partial |
|---|---|
| Algorithmic Transparency Recording Standard | Tier 2 Owner and responsibility partial; Tier 2 Tool specification partial; Tier 2 Model specification partial |
| JSP 936 Part 1 | para 165 partial; para 176 partial; para 204 partial |
| MITRE AI Maturity Model | P4.3 partial |
| NIST AI 600-1 | R6 partial; R12 partial |
| NIST AI RMF 1.0 | MANAGE 2.2 partial; MANAGE 3.2 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.