What belongs in an AI approval gate?

Confirmation that the system is in the model register with named business and technical owners, an assigned consequence tier, the human role defined as decides, reviews or is informed, and a written stopping condition naming the observable trigger, the individual authorised to withdraw the system, and the maximum time between detection and removal. If nobody will accept that stopping authority, the system is not ready to deploy.

What is a stopping condition for an AI system?

A stopping condition is the observable circumstance under which a system is withdrawn from production, agreed and written down before launch, together with the named person authorised to withdraw it and the maximum acceptable time between detecting the condition and acting on it. Approval without one is optimism with a signature attached.

AI Approval Gate Checklist

Last updated: 2026-08-14

An AI approval gate is the point at which a system is authorised for production. Approval without a defined kill criterion is optimism with a signature attached, so every approval must record the observable condition under which the system comes down, the person authorised to take it down, and the maximum time between detection and removal.

The gate is where governance either constrains behaviour or reveals itself as decoration. Its function is to refuse systems that cannot answer for themselves, which requires that someone present has the authority to say no.

The template

Before a tier 3 or tier 4 system goes live, the submission shows all of the following:

Purpose statement and the specific decision affected
Named business owner who accepts the output in writing
Evidence of performance on data representative of live conditions, including performance on the smallest affected subgroup you can measure
Failure mode analysis covering what a wrong output does downstream
Human role defined and the reviewer given authority to override without escalation
Stopping condition, named stopper, and maximum time to withdrawal
Data lawful basis and retention position
Rollback plan to the prior process, tested
Next review date

How to use it

Run the gate before production, not after an incident. A gate applied retrospectively is a report.
Require a written stopping condition on every approval: the observable trigger, the named individual authorised to act on it, and the maximum time from detection to removal.
Give the independent reviewer, usually data protection or risk, genuine authority to refuse. Without it the gate records decisions rather than making them.
Write the approval and the next review date into the model register at the moment of the decision.

This template comes from the AI Governance: A Practical Playbook, which sets out the reasoning behind it, the rules of thumb that govern its use, and the signals that tell you the approach is failing. The full playbook is also available as Markdown. See all AI governance templates.