Dr. Jonah Tebaa's latest commentary opens with a scenario familiar to anyone who has sat through a lengthy AI approval process: a system spends months clearing review after review, only for the underlying model to change — silently, at the vendor's discretion — before the approval paperwork is even finalized. The system that gets signed off, he argues, is rarely the system that ends up running in production for long.
His core claim is that most AI governance frameworks inherited an assumption from traditional software: that a system only changes when someone changes it. Static software sits still between releases. AI, in his framing, does not. Vendors push model updates outside anyone's control. The data a system retrieves from drifts as a business evolves. The population of users interacting with it shifts in ways nobody scheduled. None of that requires a deploy event, which is exactly why it goes unnoticed by approval processes built to catch deliberate changes.
Where many governance conversations respond to this by proposing stricter, longer approval gates, Dr. Tebaa takes the opposite position. A harder front door, he argues, does nothing to catch drift that happens after a system has already launched. The gap isn't at the gate — it's in the months and years after it. His proposed fix is a small number of ongoing practices rather than a heavier one-time review.
Five Practices for Governing a System That Keeps Changing
He organizes his argument around five concrete habits:
- Version pinning where possible — locking model or API versions rather than accepting automatic "latest" updates, and explicitly flagging unpinnable SaaS systems as higher risk.
- An update trigger — a standing rule that any vendor model change automatically forces re-evaluation before it reaches production traffic, removing reliance on someone noticing the change.
- A living evaluation set — a small, maintained set of real cases re-run on a schedule and after every material change, replacing the one-time launch benchmark most organizations rely on.
- A drift alarm — lightweight monitoring for shifts in output patterns, rising override rates, or new complaint trends that can surface undeclared changes.
- A re-approval cadence — giving every governance sign-off a calendar renewal date scaled to how consequential the system is, rather than treating approval as indefinite.
What stands out in Dr. Tebaa's framing is his refusal to treat any of this as novel or exotic. He points out that mature engineering organizations already apply nearly identical discipline to infrastructure and software dependencies — pinning versions, monitoring for drift, re-testing on a schedule. In his view, AI governance has lagged not because the underlying problem is unusually difficult, but because organizations borrowed the wrong mental model: a one-time approval gate suited to systems that hold still, applied to systems that fundamentally do not.
The clearest support for his position may be that the reference frameworks themselves come with renewal dates. NIST states on its AI Risk Management Framework page that "The AI RMF 1.0 is being revised as part of the White House AI Action Plan" — the standard many organizations cite as their fixed ground is itself scheduled to change. A sign-off with no expiration is not only assuming the system holds still; it is assuming the yardstick it was measured against does too.
The piece closes on a reframing of what "approved" should mean for AI: not a permanent designation, but a status with a built-in expiration — one that responsible organizations actively renew rather than passively assume still holds.
