Maman Ibrahim is a cyber and digital risk executive, helping boards, CRO, CIO, and CISO turn risk work into decisions, delivery, and proof.
Decisions used to go stale slowly. You could watch them age, like milk at the back of a fridge. AI has changed the speed and the plot. Decisions now expire faster. Some can reopen themselves while nobody’s watching.
Reopening means asking whether the conditions that justified a decision still hold. The answer may be to reaffirm, amend or reverse. What AI changes is everything around it.
I see four effects, each at a different point in a decision’s life. AI shortens the shelf life. It can watch for the moment to reopen. It can re-decide without permission. And it can join the review itself. Each needs a different governance response.
1. The Clock: AI shortens the shelf life.
Traditional decisions often rested on slow-moving facts. A supplier contract changed at renewal. A process changed when someone rewrote it. AI decisions rest on moving parts.
Model providers retire and replace versions on different timelines. For generally available models, notice periods can range from around 60 days to six months, while preview or experimental models may be retired with considerably less notice. The practical point is that an assumption behind a decision can change outside your organization, sometimes before your own approval cycle comes around again.
Models are only one trigger. Agents gain tools and permissions. Pilots spread. Data drifts. Suppliers change dependencies. Performance moves. Regulation catches up.
Each change can reopen the decision. Most affect one of three things: the system, the exposure or the authority.
That is why annual reviews misfire. By the time the committee returns to the item, the decision operating in practice may no longer be the one it approved.
AI decisions need event-based reopening triggers first, with a calendar as a backstop. Ask one question at approval: What change automatically sends this decision back for review?
2. The Watch: AI can spot the trigger.
The technology that speeds decay can also help detect it.
Monitoring tools can track drift and error rates against the tolerance set at approval. Language models can read regulator publications, supplier release notes and contract amendments, then flag the ones that touch an approved assumption. Complaint patterns that took a quarter to surface can show up in a week.
AI can watch all day without getting bored. NIST’s AI Risk Management Framework already expects post-deployment monitoring plans that cover drift, override, change management and decommissioning.
But a watcher that flags everything trains people to ignore it, so tie alerts to the thresholds written at approval. And an AI watching another AI may share its blind spots, especially when both come from the same provider.
The watcher raises a hand. The named owner still decides whether to reopen.
3. The Gate: AI can re-decide without asking.
This is the effect that worries me most.
A classic decision stays put until someone changes it. An AI-enabled decision can shift through a retrain, a prompt update, a new tool connection or a supplier’s quiet upgrade. Each arrives as a configuration change. None looks like a board paper.
The result is silent reopening. The substance of the decision moves, yet the approving authority never sees it. Nobody asked the question because, on paper, nobody changed the decision.
Three features make it hard to catch. Each change is small. The people who own the system review it, while the decision’s owner never sees the ticket. And it usually improves something, so nobody feels the urge to object.
Consider an agent approved to draft refund recommendations. A later release lets it issue refunds under $100 to save staff time. The change ticket clears engineering review in an afternoon. The organization has made a new decision about authority. Governance recorded a software update.
The fix sits in change management. Any change that moves purpose, exposure or authority returns to the approving authority, whatever form it arrives in. Add one question to the ticket: Does this change what the system may decide?
Europe’s AI Act already draws this line for high-risk systems. Under Article 43(4), a substantial modification triggers a new conformity assessment. Changes the provider set out and documented at the original assessment don’t. Write the expected range of change into the approval, and treat anything outside it as a reopening.
4. The Review: AI can assemble the case, but people decide.
AI can speed up reconsideration.
It can pull the original decision trail, compare the recorded assumptions with today’s facts, and set out what reaffirming, amending or reversing would each involve.
The risk is independence. An AI system summarizing evidence about its own performance, or its provider’s, has an obvious conflict. Its framing can steer the outcome without anyone noticing.
Banking learned this years ago. The PRA’s SS1/23 requires model validation to operate independently of developers and owners, and routes material model changes through validation and approval. The same logic applies when the reviewer is itself a model.
So separate the roles. AI may gather and compare. A person with the authority of the original approver decides. The record shows which parts of the analysis the machine produced.
What Boards Should Ask
Four questions cover the four effects.
How quickly do our material AI decisions go stale, and do our reopening conditions keep pace? What watches for triggers, and who acts on its alerts? Which configuration changes in the past year altered what an AI system may decide, and did any return to the approver? When we reopen an AI decision, who decides, and how much of the case did AI write?
The third question tends to produce the longest silence, but it’s one of the most important questions to ask.
Asking Again
Stale decisions are old news. AI makes them expire faster and lets them change without a meeting. That raises the stakes on an old question: When should we reopen the decision?
For AI, add a second. How would we know if it has already reopened itself?
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?