When the Decision Expires

Before the detail — Artifact: section 6 of the record and the currency check. Status of what follows: M-25-21 monitoring binding where it applies; reusable guidance elsewhere.

Prompt first: draft the trigger table for the system you cannot see into

Here is the inventory entry for MU-AI-001 [paste] and the contract's
change-notice terms [paste, or NONE FOUND].

Draft section 6 of the release-decision record - the trigger table -
for this vendor-hosted system whose model family is not disclosed.
For each trigger:
  1. EVENT: one imported row for the changed-dependency feed
     (Grounded Answers 6.2 - treat it as opaque), then the four
     provider-side events: retirement notice / alias moved /
     forced upgrade / change notice
  2. HOW WE OBSERVE IT: contract notice, vendor status page, our
     canary, a user report - or UNOBSERVABLE
  3. KIND: evidence-invalidating (the evidence no longer describes
     the running system) or review (a decision by a date)
  4. CLOCK: immediate suspension, or a window - NEEDS-OWNER

Invent no contract terms, notice periods, or vendor behaviors I did
not paste. Every ungrounded field is NEEDS-OWNER.

An agent writes a tidy table with a notice period in every row; MU-AI-001’s contract may say nothing, and a table that reads better than the contract is a fiction with a signature under it. The structure is the agent’s; every clock is R. Okafor’s — and the honest table has rows reading UNOBSERVABLE, which is itself the finding.

The feed you have, and the half it cannot see

Grounded Answers 6.2 (a separate training in this series) is the changed-dependency feed: six triggers that re-run the evals. That feed sees a provider change only after it lands, as canary drift; it cannot see the four events that arrive before it, on the provider’s schedule. A retirement notice — the provider’s published retirement policy sets the warning; the retirement date the record names is the deadline. An alias move — the name you call resolves to a different version; 2.2’s rule: a name proves no version. A forced upgrade — a deployment that upgrades itself crosses section 2’s boundary with no commit on your side. A change notice — filters or guardrails change under the same name.

GSA (the government’s central buying agency) proposed a clause in June 2026, comments closed August 2026: 30 days’ notice of material changes, 7 days when a change increases bias or degrades guardrails, 30 days before a model is discontinued. Proposed, not final — write it into section 6 as the shape a contract could require.

Every provider-side row you cannot observe is a boundary that can cross with no entry in your register: the audit finding “evidence describes a system no longer running.”

Two kinds of trigger, and a date that is neither

Evidence-invalidating triggers mean sections 2 and 3 now describe a system that does not exist: the boundary crossed — a different digest serving, an alias moved, a forced upgrade applied — a gate’s set changed, or a condition in section 4 failed. State: SUSPENDED until the re-run (or, for a failed condition, until the condition is restored and reviewed).

Review triggers mean someone must decide by a date: a notice received, an incident, a change in context, an owner or risk-acceptor seat vacated. M-25-21 (the White House budget office’s April 2025 memo governing agency AI use) names monitoring “to detect unforeseen circumstances, changes to an AI system after deployment, or changes to the context of use or associated data,” and reassessment “following significant modifications.” The disposition is renew as-is, migrate — which crosses the boundary and suspends — or withdraw; the clock is the record’s own. MU-AI-004’s example names 30 calendar days: Meridian’s choice, not a rule.

The valid-through date is neither: fixed at signing, independent of every trigger, STALE after. The reassessment schedule behind it is set per system in section 1, and the only hard clocks are sourced. New York City’s automated-hiring law requires a bias audit less than one year old to keep using the tool. The EU general-purpose-model code asks for a model report re-issued at least every six months — EU rules are scoped out for a US utility and cited only as a cadence example. M-25-22 (the same office’s memo governing AI purchases) offers “quarterly or biannual” testing as examples set by program need, not a universal cadence.

A trigger sorted into the wrong kind costs days of a service down that nobody needed, or an answer served on invalid evidence and the customer harm that follows.

The invariant the register can check

Three checks per system, kept separate because they answer different questions: the last evidence-invalidating event is older than the last re-run (else the record is suspended and must say so); every open review clock has a disposition before its deadline (a notice inside its window is not a lapse — the state holds); and today is before valid-through. Use timestamps, not day-only dates, so an event and a re-run on the same day sort correctly.

DECISION-CURRENCY CHECK - one row per system
  system     last invalidating   last re-run   open review clocks    valid-through   verdict
             event (ts)          (ts)          (deadline, disposed?)
  MU-AI-NNN  ....-..-..T..:..    ....-..-..T   ....-..-.. / yes|no  YYYY-MM-DD      CURRENT |
                                                                                    SUSPEND-DUE |
                                                                                    CLOCK-OVERDUE |
                                                                                    STALE
  legend: SUSPEND-DUE = invalidating event newer than re-run; CLOCK-OVERDUE =
  a review deadline passed without a disposition; STALE = past valid-through

Seam: change management to reassessment

The commercial starting practice is change management — for a provider you do not control, the notice channel, the canary, the pinned version, a rehearsed rollback. The federal delta is M-25-21’s monitoring and reassessment after significant modification, plus M-25-22’s version performance standards and rollback rights in the contract — for Meridian’s federal-task-order use case, a contract right, not a favor. The handoff artifact is the section 6 table. Not equivalent: no US federal statutory clock for reporting an AI incident was found; the EU has one, scoped out here. An incident is a review trigger here; its clocks and its command are the next chapter’s.

Stop and escalate when an evidence-invalidating event is UNOBSERVABLE for a production system — the provider will not name the version and no canary can run. Only the risk acceptor can choose between 3.4’s declared lower-assurance route and suspension.

Practice status — among organizations running AI systems under a signed release decision, commercial and federal

Scale: required | common baseline | strong optional | reference-shop (seen only at organizations that publish their own practice) | emerging

Key takeaway

The changed-dependency feed catches what Meridian changes; section 6 catches what the provider changes. Evidence-invalidating triggers suspend until the re-run, review triggers open the clock the record names, and the fixed valid-through date makes the decision stale on its own; the schedule is set per system, and the only hard clocks are sourced. Three checks keep it honest, and they are three because a notice inside its clock is not a lapse: invalidating event versus re-run, review deadline versus disposition, today versus valid-through.

LEADERSHIP DECISION   fund the register check and the change-notice
                      clause; a vendor who will not name the version
                      leaves you on a declared lower-assurance route
PRACTITIONER ACTION   complete section 6 with the provider-side rows,
                      sort each as evidence-invalidating or review,
                      name the clock, run the currency query at the
                      cadence section 1 sets for the system
SUCCESS MEASURE       zero systems serving with an invalidating event
                      newer than their last re-run, a review clock past
                      its deadline, or a valid-through date behind them
                      - answered from the register in minutes at each
                      check, not by an investigation