AI Approval Gate Checklist
An AI approval gate is the point at which a system is authorised for production. Approval without a defined kill criterion is optimism with a signature attached, so every approval must record the observable condition under which the system comes down, the person authorised to take it down, and the maximum time between detection and removal.
The gate is where governance either constrains behaviour or reveals itself as decoration. Its function is to refuse systems that cannot answer for themselves, which requires that someone present has the authority to say no.
The template
Before a tier 3 or tier 4 system goes live, the submission shows all of the following:
- Purpose statement and the specific decision affected
- Named business owner who accepts the output in writing
- Evidence of performance on data representative of live conditions, including performance on the smallest affected subgroup you can measure
- Failure mode analysis covering what a wrong output does downstream
- Human role defined and the reviewer given authority to override without escalation
- Stopping condition, named stopper, and maximum time to withdrawal
- Data lawful basis and retention position
- Rollback plan to the prior process, tested
- Next review date
How to use it
- Run the gate before production, not after an incident. A gate applied retrospectively is a report.
- Require a written stopping condition on every approval: the observable trigger, the named individual authorised to act on it, and the maximum time from detection to removal.
- Give the independent reviewer, usually data protection or risk, genuine authority to refuse. Without it the gate records decisions rather than making them.
- Write the approval and the next review date into the model register at the moment of the decision.
Common questions
What belongs in an AI approval gate?
Confirmation that the system is in the model register with named business and technical owners, an assigned consequence tier, the human role defined as decides, reviews or is informed, and a written stopping condition naming the observable trigger, the individual authorised to withdraw the system, and the maximum time between detection and removal. If nobody will accept that stopping authority, the system is not ready to deploy.
What is a stopping condition for an AI system?
A stopping condition is the observable circumstance under which a system is withdrawn from production, agreed and written down before launch, together with the named person authorised to withdraw it and the maximum acceptable time between detecting the condition and acting on it. Approval without one is optimism with a signature attached.