You ran the model risk review. Legal signed the DPIA. The vendor assessment came back clean. Somewhere there's a document—a spreadsheet row, a GRC ticket, a PDF with a compliance officer's name on it—that says this model is approved for this use case.
That document describes a model version. Not the model running in production right now.
Approval is a snapshot, not a subscription
GDPR expects a DPIA review, where necessary, at least when the risk of processing changes. Bank model-risk guidance required ongoing monitoring too, from 2011 until this April: OCC Bulletin 2026-13 rescinded that 2011 guidance and explicitly excludes generative and agentic AI models from its scope while the agencies work out AI-specific rules. So today, GDPR's re-review trigger is one of the few obligations actually on the books for a general-purpose model like this—and in practice it only fires on a change someone tells you about. A vendor-side retrain is exactly the kind of change nobody tells you about.
Some model vendors do offer pinned snapshots that hold still by design—so if your integration calls one of those, the model behind your approval doesn't move on its own. But unless you're on a pinned snapshot—and some embedded AI features in SaaS tools don't give you that option—retrains, fine-tunes, and reconfigurations land on the vendor's roadmap, not your governance calendar, according to one AI-governance vendor's read of the market. Even a pinned snapshot eventually gets deprecated and forces a migration. Either way, you approved a model. You didn't sign up to re-approve every version after it, but on a floating alias or an embedded feature, you're running whatever version the vendor ships next.
The gap that matters most isn't the release number—it's behavioral. Refusal behavior, factual reliability, and sensitive-content handling rarely make the vendor's changelog. Behavioral drift is more likely than a structural change to slip past an audit trail. This isn't just a governance vendor's read of the market: one 2023 study found GPT-4's accuracy on the same set of math questions fell from 84% to 51% between its March and June 2023 versions—when and how a vendor updates the model behind a fixed API endpoint is opaque to the customer calling it. For a cleared medical device, a change that could significantly affect safety or effectiveness needs a new 510(k). An undisclosed model change can be exactly that kind of change—and it can quietly invalidate a fair-lending review too, according to that same governance vendor.
What caught it was a spot check
A regulated manufacturer's deviation-management assistant shows the same failure from a different angle—no vendor retrain involved. The system kept learning in production: every time a human reviewer finalized a record, the team fed that outcome back into the model. When the inputs arriving from one site differed in nature, the model's classifications drifted with them. Over 14 days, 64 deviation records got miscategorized, and not one was challenged. What caught it wasn't a dashboard—it was a random-sample secondary review.
That's not a silent vendor update. It kept learning from records its reviewers had waved through, until it no longer behaved like the last known-good version—and nothing in the process was built to notice. The mechanism is different from a vendor retrain, but the failure is the same: a review that assumed the model would hold still, checking a model that didn't.
Neither regulator names an LLM vendor's silent retrain directly, and neither fully covers it either. The FDA's Computer Software Assurance guidance (issued September 2025, revised February 2026) asks manufacturers to scale validation rigor to risk rather than documenting everything equally—a general software-assurance principle, not an AI-specific one. The EU's draft GMP Annex 22 goes further on the AI question, but narrower in scope: it covers only models with fixed parameters, and the draft text itself explicitly excludes LLMs and generative AI from critical GMP use; for the frozen models it does cover, it expects monitoring for input-distribution shift and a documented decision on whether any change needs a retest. The question inspectors keep asking, one practitioner writes: how would you know if it stopped working, and what would you do next?
One practitioner's answer worth naming: a five-rung escalation ladder—alert, investigate, restrict scope, suspend, retrain—built to avoid two failure modes at once, ignoring a real drift signal and shutting a system down over noise. The last rung assumes you can retrain the model yourself; on a vendor-hosted model, that rung is really "escalate to the vendor."
What standing AI lifecycle governance looks like
Standing AI lifecycle governance treats a vendor-side model change as a disclosure event, not a one-time sign-off: a maintained model register, a named owner for tracking version changes, and ongoing evaluation of live performance in place of a point-in-time approval. The fix isn't a faster review cycle. In LangChain's late-2025 survey of 1,340 responses, 94% of teams with agents in production had observability in place, but only 44.8% ran online evaluations of live agent performance. Most teams can see what their agents did after the fact. Far fewer are still checking, on an ongoing basis, whether it's performing the way it should. Point-in-time approval, however well done, can't answer a question that's continuous by nature.
The question to ask this quarter
Pull up your last model risk approval. Check the date. Then ask whoever owns the vendor relationship whether anything has changed on their end since—not whether they'd tell you, whether they're contractually obligated to. If you're not on a pinned snapshot and they're not obligated to tell you, your approval is vouching for a model nobody re-checked. That's worth fixing before an auditor asks the same question.
If that model drives an agent with shell access, a vendor update can change which commands it proposes, not just what it writes. Alpacon scores the command itself, not the model that proposed it.
Next: the runtime questions your AI vendor risk assessment is missing.
