{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"ai_governance","domain":["AI Governance","Logging, Monitoring & Detection"],"inherent_rating":"high","taxonomy":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-model-drift-monitoring","description":"Distribution shift between training and deployment data silently degrades accuracy, and without ongoing monitoring, model decay and emerging failure modes go undetected with no trigger to retrain or decommission. Uncontrolled updates alter behaviour and invalidate prior assessments.","details":{"category":"ai_governance","impact":"medium","inherent_rating":"high","likelihood":"high","risk_id":"ai-model-drift-monitoring","taxonomies":["nist-ai-rmf-risk","iso-23894-ai-risk","eu-ai-act-risk"],"treatment":"mitigate"},"id":"risk:ai-model-drift-monitoring","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aai-model-drift-monitoring","sourceIds":["aiuc-1","eu-ai-act","iso-42001","nist-ai-agent-identity","nist-ai-tevv-athlon"],"sourceUrl":null,"title":"Model/data drift and inadequate post-deployment monitoring","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4c7023427aa78e1dd93518e3c17913be0aee17311142a471730fa452498746f1","properties":{"rationale":"Continuous monitoring against performance/behavior metrics with drift and anomaly alerting is the post-deployment detection the risk says is missing.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-08-fada68b7.json","sourceId":"uc:UC-AI-08","targetDetailPath":"/data/v1/records/risk-ai-model-drift-monitoring-15329f38.json","targetId":"risk:ai-model-drift-monitoring","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:4e40583b586e1bacd07058e5fd44e1e2d9267aed80d5f8be9fc976f65692227b","properties":{"rationale":"A recurring quarterly evaluation cadence catches degradation between releases that internal monitoring misses.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-21-8afd47db.json","sourceId":"uc:UC-AI-21","targetDetailPath":"/data/v1/records/risk-ai-model-drift-monitoring-15329f38.json","targetId":"risk:ai-model-drift-monitoring","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:91f42bc9024286e881ceea36b6739fd5ea2dae157cd5b2d8d20d4630575eb967","properties":{"rationale":"Routing updates/retraining through reassessment and sign-off prevents the uncontrolled updates the risk names, but does not detect the distribution drift at the risk's core; continuous monitoring (UC-08) is the operative defense.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-07-9c5c9573.json","sourceId":"uc:UC-AI-07","targetDetailPath":"/data/v1/records/risk-ai-model-drift-monitoring-15329f38.json","targetId":"risk:ai-model-drift-monitoring","type":"mitigates"}],"schemaVersion":1}