Version control for high-risk AI systems extends well beyond conventional source code management. The composite versioning scheme assigns each release an identifier combining code SHA, dataset hash, model version, configuration hash, and prompt version. Code version control enforces branch protection and mandatory review with CODEOWNERS for fairness-critical paths.

Data version control applies DVC, Delta Lake, or LakeFS to ensure every dataset version is immutable and retrievable for ten years. The model registry tracks each model from experimental through staging to production with full metadata, lineage, and access controls. Configuration and prompt versioning treats decision thresholds, business rules, and LLM system instructions as first-class versioned artefacts.

Substantial modification detection implements a cumulative baseline tracking framework that triggers re-assessment under the Act when changes cross defined thresholds. Service dependency management maps microservice interactions and enforces contract tests. Traceability links technical artefacts to business outcomes. The section concludes with the artefacts produced.

Note:

This section corresponds to the Version Control section and feeds primarily into AISDP Module 2 (Development Process) and Module 10 (Record-Keeping).