Change management is the controlled process for proposing, assessing, approving, making and recording changes to systems that a business depends on, so that nothing changes without someone accountable deciding it should. For AI agents, the hard part is recognising what counts as a change, because many of them never touch code.
Why does change management matter for agents?
A traditional system changes when someone releases new code. An agent's behaviour can change when someone rewords its brief, adds a document to its sources, connects a new tool, adjusts a customer limit, or when the model provider updates the model. Each can alter what the agent does on live work. If only code changes go through approval, most agent changes slip past it.
Change also interacts with authority. An agent's certificate covers the agent as it was certified. A material change means the evidence no longer describes the agent that is running, so the change process must decide whether recertification is needed before the new version acts.
What counts as a change to an AI agent?
| Change | Usually needs |
|---|---|
| Brief or instructions reworded | Assessment; recertification if behaviour could change |
| Source added, removed or replaced | Recertification of affected capabilities |
| New tool or system connection | Access review and recertification |
| Model or model version changed | Recertification across capabilities |
| Depth requested above current level | New certification evidence |
| Customer limits tightened | Approval by the limit owner; no recertification |
| Customer limits loosened | Approval by the limit owner and risk sign-off |
How does it work in practice?
- Propose: the change, the reason and the capabilities affected.
- Assess: what could go wrong and whether recertification is needed.
- Approve: by the agent's business owner, with risk sign-off for material changes.
- Test and certify: on the customer's own cases where required.
- Release: with a rollback route ready. Rolling back an AI agent after a bad change covers what that route needs.
- Record: what changed, who approved it, the evidence, and the date it took effect.
What does an example look like?
A health insurer's claims agent drafts benefit explanations. The policy team adds a new plan document to its sources. Under the insurer's change process, that is a source change: the claims operations lead logs it, the risk team agrees it needs recertification of the "explain benefits" capability, the agent is replayed against past claims that include the new plan, and the change goes live only once the capability clears. The change record links to the certification result.
How is it different from regulatory change management?
Change management here governs changes you make to your own systems and agents. Regulatory change management is about tracking changes in laws and rules and working out what they mean for the business. The two meet when a new rule requires you to change an agent: the regulatory process identifies the need, and the change process controls how it is made.
It also differs from organisational change management, which helps people adopt new ways of working. That matters for agent programmes too, but it is a separate discipline.
Which terms sit close to it?
Rollback, release, canary release, certification and drift. Drift is change you did not make, such as a model update by a provider; it needs detecting rather than approving. For change in the context of going live, see our guide to deploying AI agents.
Where Pryme fits
Pryme never updates model weights for a customer. Every change is to the agent's brief, sources, bounds or certification, which makes each one something you can see, approve, record and re-test with Attest on your own cases before the changed agent acts at depth.
Questions people ask
Do small prompt edits really need approval?
They need assessment. Many will be minor, but a one-word change to an instruction can shift behaviour across thousands of cases. A light, fast route for minor edits beats no route.
Who should approve agent changes?
The business owner of the process the agent works in, with risk or compliance involved for anything that changes depth, sources or customer limits.