Compliance with an AI that doesn't exist

With the EU AI Act in force, companies did what the regulation required: they documented risks, mapped controls, approved use cases. Compliance was established on the deployment date.

Since then, a few things have changed.

The provider updated the model. It didn't launch a new product with separate documentation; it updated the same endpoint with different parameters, expanded capabilities, and adjusted behaviors. The compliance document didn't keep up.

Teams found new uses. What was an internal chatbot became a customer service tool. The operational document classifier started supporting credit decisions. The risk surface grew; the report didn't.

The audit trail says everything is compliant. And it's right about what was documented. The problem is that what was documented is no longer the system that's running.

This is the cost of treating AI governance as a deliverable with a completion date. AI systems evolve continuously: models are updated, data shifts, use cases expand. Static governance in this context isn't managing active risk; it's archiving the memory of a risk that once existed.

The practical result is compliance with an AI that no longer exists. The audit passes; the risk remains. And the gap between the two only shows up when something goes wrong.

How is your company handling the lag between model changes and governance updates? Tell me in the comments.