Transit depends on a vendor foundation model for safety-related assistant claims. What contractual control best manages model-change risk?

Transit depending on a vendor foundation model for safety-related assistant claims should contractually require the vendor to notify the city of foundation-model version changes that affect those safety claims. That control best manages model-change risk because silent swaps can alter refusal behavior, hallucination rates, tool-calling patterns, and previously validated safety assumptions without the city knowing to retest. Notification enables reassessment of controls, regression tests, and residual risk before riders are exposed to unverified behavior.

Requiring the vendor to notify the city of foundation-model version changes that affect usage billing fails to manage model-change risk because billing impact says nothing about safety impact, leaving the city unaware of silent swaps that alter refusal behavior, hallucination rates, or tool-calling patterns without triggering a billing notice. Requiring the vendor to notify the city of foundation-model version changes with quarterly summary reports still fails because batched retrospective reporting does not provide timely notice; the city may be unable to revalidate safety claims before riders are exposed to the new model version unless it receives advance notice and a retest window. Requiring the vendor to notify the city of general platform updates that reference safety documentation fails because general updates are not tied to the city’s specific safety-related claims and do not guarantee timely, accurate notice of the specific model lineage shifts that affect those claims.

Exam caveat: notification alone is insufficient if the city lacks capacity or contractual right to pause rollout pending revalidation of safety-related claims. Operational check: define which claim classes trigger notice, require version IDs in release notes, mandate a municipal retest window for safety-affecting changes, and log accept/reject decisions before production traffic resumes.