Before award, define who may request, analyze, approve, and fund a change; which baseline it alters; what evidence the provider must supply; and when work may begin. Discovery is expected in AI delivery, but adaptability must not mean open-ended scope, price, or schedule. The buyer should own the outcome and backlog; the provider should expose impacts and alternatives.
Use one hard rule: no material request enters delivery until it is classified, compared with the baseline, and authorized by the people who control budget and risk. Give emergencies a narrow lane with limits, immediate notice, rollback, and later ratification. This keeps conversations, demos, and stakeholder messages from becoming accidental authorization while preserving learning.
The AI Change Control Gate-8: 32 points before signature
Score each dimension from zero to four: zero is absent; one is a promise; two is a partial process; three is a documented rule with an owner and evidence; four is tested and monitorable. For a material implementation, use 24 of 32 as a planning threshold, no zero, and at least three in authority, impact analysis, and rebaselining. Tailor the gate to the engagement; the cutoff is not a universal benchmark.
- Outcome and decision — North Star, users, baseline, and measures that cannot change for convenience.
- Scope and backlog — included and excluded work, dependencies, priorities, and backlog ownership.
- Assumptions and evidence — hypotheses about data, models, integrations, volume, access, and behavior.
- Technical configuration — versions of data, prompts, models, tools, APIs, environments, and controls.
- Integrated impact — value, cost, schedule, capacity, quality, security, compliance, and operations.
- Authority and response — who requests, recommends, approves, rejects, escalates, and responds at each level.
- Change economics — reserve, unit rates, ceilings, credits for reductions, and treatment under the pricing model.
- Release and rebaseline — testing, acceptance, rollback, documentation, communication, and one updated baseline.
Create a small but sufficient baseline
At signature, freeze a version of the outcome, prioritized backlog, architecture, data sources, integrations, acceptance criteria, team, schedule, price, and known risks. It is not an immutable specification; it is the comparison point. Give each element an identifier and date. Without a baseline, the parties cannot distinguish defect correction, clarification, reprioritization, or a genuine scope increase.
Classify every request into four lanes
- Clarification — makes an existing requirement explicit without changing outcome, effort, risk, or acceptance; record it without repricing.
- Swap — replaces an item with comparable size and risk inside fixed capacity and time; update the backlog.
- Variation — adds, removes, or changes an outcome, data source, integration, quality level, volume, operation, or responsibility; require impact analysis and formal authority.
- Emergency — contains an incident, security issue, or urgent obligation; permit limited action with contemporaneous evidence, a ceiling, rollback, and post-event review.
Name who determines the class and the challenge path. Rework needed to meet existing acceptance criteria is not automatically billable change. A new jurisdiction, data source, integration, volume tier, or human-review requirement can materially change the system even when it appears as one short backlog sentence.
Require one comparable change-impact card
- Request, originator, reason, urgency, and affected baseline.
- Options: decline, defer, swap, reduce, deliver now, or open another phase.
- Expected value and the evidence supporting it.
- Impact on deliverables, data, architecture, models, evaluation, security, and operations.
- Labor, third parties, consumption, recurring cost, schedule, capacity, and displaced work.
- New risks, controls, acceptance criteria, rollback, and client dependencies.
- Price, credit, ceiling, funding source, approvers, expiry, and decision date.
Require the provider to separate fact, assumption, and uncertainty. When evidence is weak, use a range and fund a small spike before approving a large variation. GAO cost guidance supports a technical baseline, assumptions, data, risk analysis, documentation, and updates using actual costs. Numeric precision is not the same as estimate reliability.
Match control to the commercial model
For fixed price, define the unit of exchange and price material variations before execution whenever practical. For time and materials, limit work in progress, set periodic ceilings, and make backlog items compete for capacity; available hours do not remove priority decisions. For outcome-based fees, define when a change alters the outcome, attribution, or a risk outside the provider's control. Hybrid structures often separate discovery, iterative capacity, and accepted releases.
Prevent implied authority and hidden queues
Name a client product owner and a commercial authority. Sprint events can reprioritize work within the approved envelope, but cannot commit money or alter contractual obligations without authority. Capture requests in one system, bring commercial and risk roles into relevant ceremonies, and set a decision SLA. Silence should pause the change, not approve it.
Test the provider before award
Give finalists the same scenario: data quality drops, an integration slips, and a regulatory requirement appears after half the budget is consumed. In 60 minutes, ask for classification, options, impact, provisional decision, backlog adjustment, communication, and rebaseline. Observe whether the team protects the outcome, exposes displaced work, calculates total economics, preserves controls, and is willing to recommend no change.
Monitor whether the mechanism is healthy
- Elapsed time from request to analysis, decision, and final agreement.
- Cost and capacity consumed by variations, separated from defects and original work.
- Emergency, reopened, or pre-authorized changes.
- Removed work, credits, and displaced backlog items.
- Forecast versus actual impact on cost, schedule, quality, and risk.
- Failures traced to unvalidated assumptions or a stale baseline.
Do not reward a low change count; it may hide informal decisions. The aim is early detection, fast decision, and traceability. UK agile contracting guidance emphasizes buyer backlog ownership, quality thresholds, and commercial governance. FAR Part 43 adds a rigorous reference for written authority, notification, and pricing, although it does not govern every private-company engagement.
U.S. context and connected decisions
Align the mechanism with the contracting entity, delegated authority, internal policy, privacy and sector rules, tax treatment, and applicable state law. Use https://makinai.co/insights/en/what-to-include-ai-services-contract-sow for the contractual baseline, https://makinai.co/insights/en/fixed-price-time-materials-outcome-based-ai-project for pricing, https://makinai.co/insights/en/ai-project-acceptance-criteria-payment-milestones for acceptance, and https://makinai.co/insights/en/how-to-evaluate-realistic-ai-project-timeline for the plan.
When to involve MAKINAI
MAKINAI can help turn uncertainty into a baseline, backlog, impact card, decision authority, and replanning gates before award. Explore https://makinai.co/services/en/ai-strategy-transformation-consulting. Good change control does not freeze the solution; it makes every adaptation visible, funded, testable, and reversible.