Elections risk officers learn the vendor changed the underlying foundation model mid-election cycle. What should they do next for AI risk management?

Elections AI risk management must treat supply-side foundation-model changes as material events. When a vendor swaps the underlying model mid-election cycle, behavior—accuracy, refusal patterns, bias, latency, and disclosure—can shift even if the application branding looks identical. Triggering a risk reassessment works because residual risk is a function of the deployed model and its integrations, not the UI skin; reassessment updates scenarios, controls, testing, and acceptance decisions before ballots, voter information, or operational decisions depend on altered outputs. Updating the AI bill of materials and model card because supply-chain transparency aids audit traceability fails because documentation alone is not a reassessment; traceability records what changed but does not evaluate whether the new foundation model altered accuracy, bias, or refusal behavior or whether residual election risk remains acceptable. Requesting refreshed benchmark scores because standard tests can confirm capability continuity after upgrades fails because generic benchmarks do not measure election-specific residual risk; standard capability scores miss shifts in voter-information accuracy, bias, and failure modes that only a targeted reassessment validates. Running focused adversarial probes because targeted red-teaming can surface novel exploits in updated models fails because probes are only one testing input, not a full reassessment; without updated scenarios, controls, thresholds, and a documented acceptance decision, red-teaming alone does not establish that residual risk remains acceptable for continued mid-cycle use. Exam caveat: not every model patch requires a full rebuild of the program, but mid-cycle foundation swaps warrant at least delta reassessment, regression tests, and documented residual-risk review. Operational check: require vendor change notifications in the contract, run a predefined reassessment checklist (safety, bias, extraction, election-content accuracy), freeze or roll back if critical tests fail, and record the decision in the elections AI risk register before continued use.