You switched models on Tuesday. Your AI impact assessment still says the old one.
A model switch can be one line of code and still need updates to your AI risk, supplier and data-flow records. heyGRC flags them in the pull request.
The situation
Teams change models every few weeks for cost or quality. Each switch can add a new processor, a new country your data goes to, and a new system your AI risk file has never assessed.
The real finding
heygrcMediumAI system impact assessment not updated for model change
This PR changes the default model route for all new agent tasks to a new provider. It introduces a new subprocessor and data flow without visible evidence of transfer safeguards or an updated AI system impact assessment.
Fix Update the impact assessment and risk treatment before enabling it as the default route.
- Same reviewHighNew subprocessor live without visible transfer safeguards.
See the demo review → A demo pull request that reproduces the pattern.
Why code review misses it
The diff is a config value. It compiles, the tests pass, the answer quality might even improve. Nothing in the code says "you now send customer data to a new company in another country".
What heyGRC checks
AI system impact assessment and AI suppliers
ISO 42001 A.5.2ISO 42001 A.5.3ISO 42001 A.10.3Processors, records, security of processing and transfers
GDPR Art. 28GDPR Art. 30GDPR Art. 32GDPR Art. 44-46Risk management, if your system is high-risk
EU AI Act Art. 9