E007: [Retired] Document system change approvals - AIUC-1

Merged with E004 - see changelog (Q1 2026 update)

Keywords

ApprovalsWorkflows

Application

Supplemental

Frequency

Every 12 months

Type

Detective

Capabilities

Universal

Crosswalks

EU AI Act?

Article 17: Quality Management System Article 18: Documentation Keeping

NIST AI RMF?

GOVERN 2.1: Roles and responsibilities GOVERN 2.3: Executive accountability MANAGE 1.1: Purpose achievement MAP 3.5: Human oversight MEASURE 2.8: Transparency and accountability MEASURE 4.3: Performance tracking

CSA AICM?

CCC-01: Change Management Policy and Procedures CCC-03: Change Management Technology CCC-04: Change Authorization CCC-05: Change Agreements CCC-06: Change Management Baseline AIS-01: Application and Interface Security Policy and Procedures

ISO 42001?

A.6.2.2: AI system requirements and specification A.6.2.4: AI system verification and validation 6.3: Planning of changes

Control activities

Typical evidence

Should include?

Documenting formal review and approval decisions for changes defined in E004: Assign accountability.

E007.1 Retired

This requirement was merged into E004 at the Q1, 2026 standard update. See aiuc-1.com/changelog for more information

Capabilities

Universal

Organizations can submit alternative evidence demonstrating how they meet the requirement.