A water utility has ITIL change for servers but excludes model registry promotions. What should the auditor emphasize?

Including AI artifacts such as model registry promotions in the water utility’s enterprise change management process works because promoting a model can alter anomaly detection, alerting, and operator response as materially as a server configuration change. ITIL (or equivalent) change that covers only servers and networks leaves the highest-leverage decision logic outside the official record, approval, and CAB visibility. Integrating registry promotions into enterprise change creates tickets, risk classification, scheduling, communication, and post-implementation review for AI the same way infrastructure enjoys them. The correct emphasis closes the AI-shaped hole in change management.

Retaining the current ITIL scope for infrastructure while governing models under data science procedures fails because it keeps production model promotions outside enterprise change, denying them CAB visibility, enterprise risk classification, and conflict detection with infrastructure changes. Documenting model registry promotions through data science peer review with versioned experiment records fails conceptually: peer review and versioning are not a substitute for enterprise change tickets, CAB approval, and post-implementation review for a model that drives plant alerting. Managing model promotions within the analytics release pipeline using automated validation gates fails because automated gates are technical controls, not enterprise change management; they do not provide CAB visibility, scheduled communication, or organization-wide risk classification.

Exam caveat: not every experimental training run needs a full CAB—scope enterprise change to promotions and production-affecting parameter releases, with a lighter path for sandboxed research that cannot reach plant systems. Operational check: map model registry promotion events to change tickets automatically or by mandatory procedure, classify risk for water-operations impact, and sample recent production models to verify each has a corresponding enterprise change record.