A public-health prompt update to a GenAI bot bypasses the CAB because it is just wording. What should the auditor emphasize?

Treating prompt and configuration changes to the public-health GenAI bot as AI changes subject to appropriate change control works because prompts steer behavior as decisively as code. Wording edits can alter eligibility explanations, urgency language, escalation advice, and refusal boundaries during outbreaks. Routing such edits through CAB or an equivalent risk-proportionate change process ensures clinical, privacy, and communications review—not just after-the-fact logging—before residents see new guidance. The correct emphasis rejects the false dichotomy that “prompts are not code, therefore unmanaged.”

Classifying prompt edits as editorial content subject to content versioning outside change control fails because versioning without change control misses the risk assessment and rollback planning that AI behavior changes demand. Delegating prompt approval to clinical reviewers for medical accuracy validation before deployment fails because it still skips the coordinated change process and rollback safety that a risk-proportionate CAB provides, even if clinical input is valuable. Logging prompt changes in the service desk ticket after implementation for operational awareness fails because retroactive logging doesn’t provide the pre-deployment clinical, privacy, and equity review that health guidance requires.

Exam caveat: emergency fast-path changes may be necessary during outbreaks, but delegating approval to clinical reviewers alone doesn’t replace documented emergency-change procedure, time-bounded approval, and retrospective CAB—it still needs that structured oversight.

Operational check: classify prompts/configs as change-controlled AI artifacts, require tickets with before/after text and test chats, and verify production prompt hashes match the last approved change record.