Minimum Viable AI Governance: a four-part series
- Part 1: What AI Governance Actually Means When You Have Five Employees September 4, 2026
- Part 2: Your Automation Is Wrong and You Won't Notice for Months ← you are here
- Part 3: The Automation Stopped and Nothing Told Us September 10, 2026
- Part 4: The AI Questions on Vendor Forms, and How to Answer Them September 14, 2026
Checking whether output looks normal will not catch a drifting automation. Looking normal is the problem.
By drift I mean something broader than the statistical kind data scientists usually mean: any change, in the data feeding a workflow, in the tool running it, or in the world around it, that leaves the automation working against assumptions that no longer hold.
Some failures announce themselves: an error fires, a report someone was waiting for does not arrive, a customer complains. Those are unpleasant, but they are diagnosable, because something pointed at the problem.
The harder one is where everything still runs on schedule. The output still looks like it always did: same formatting, same tone, about the same volume. One field is now pulling from the wrong place, or a summary is quietly dropping a category of item it used to include. Anyone skimming sees what they expect, because they are checking whether it is output, not whether it is correct.
Reading output still matters: it is the only way to catch a wrong number, a confident invention, or a recommendation that should never have gone out. But it has to be reading against a standard, on a schedule, not a glance on the way past. Both halves of this article are about making that possible.
Ways things drift
The causes are different and the fixes are different, so it helps to keep them apart.
Something upstream changed. This is the common one. A form field gets renamed. A vendor updates their invoice layout. Someone adds a line to the email signature. A client starts naming files differently. Your CRM gains a required field and the old export shifts by one column.
None of these look like AI problems. They are ordinary business changes. The automation keeps running because nothing errored, it just now has a different thing in its hands.
The tool moved without telling you. The vendor updates the model behind the product you are using, and nobody announces it in a way that reaches you. Outputs get longer, or more cautious, or start formatting differently. Your prompt did not change, but what it produces did.
Sometimes nothing technical changes, and the automation just falls behind. This is the invisible one. Your email classifier learned what your inbound mail looked like in March. You launch a new service, or a competitor's product starts generating a new kind of question, and now a category exists that the workflow was never taught. It handles it anyway, badly, with complete confidence and no error.
None of this shows up as a break in your pipeline or a change in the tool. The job itself just quietly became a different job.
You cannot fully prevent any of the three. What you can control is how well your workflow detects and handles them. Some products let you pin a version or choose when upgrades land, which helps with the second. The third is the one nobody thinks to look for, and it is the reason periodic sampling exists.
Watch the things that move first
Some of the most useful signals sit in the shape of the work around the output, not in the output itself.
Input shape. New file types, new categories, longer messages, a different language, or a rising share of items landing in "other" show trouble before the output does. This is usually the earliest warning available, since it shows up before the automation has had a chance to get anything wrong.
Volume. An automation that processed 40 items a week for three months and now processes 12 is telling you something, even if all 12 are perfect. Something upstream stopped reaching it. A jump matters too, and usually means it started catching things it should be ignoring.
How often a human steps in. If your team used to fix one output in twenty and now fixes one in five, drift started before anyone thought to mention it. People absorb small corrections without reporting them. They will not tell you the tool got worse, they will quietly do more cleanup. Track the correction rate and you find out before they say anything.
A falling correction rate is not automatically good news either. People sometimes stop correcting a workflow they have quietly stopped trusting, and start working around it instead, which makes the correction rate look better exactly when the underlying problem is worse.
Run time. A job that took ninety seconds and now takes six minutes changed, even if the result is fine. It may be retrying something, though payload growth, vendor latency, throttling, or an API change can cause the same slowdown.
Absence. A workflow that produces nothing generates no error and no output to inspect. If the Tuesday report simply stops arriving, the gap can run for weeks before anyone asks where it went. Watching for expected output that did not appear catches a whole class of silent failure, and part three is largely about this.
Output shape. Not content, shape. Average length, number of line items, how many fields come back populated. If a summary that ran to four paragraphs now runs to one, look at it.
None of this matters unless a signal moving translates into a decision. Decide in advance what earns what response: a small shift in output length might be worth a note, a correction rate climbing from 5 percent to 15 percent might mean pulling a larger sample, and a serious error touching money, a customer, or a person's record should stop the workflow until someone understands what happened.
These catch pipeline problems cheaply and automatically. They will not catch a plausible wrong answer. That is what sampling is for.
Write down what correct looks like
Sampling only works if you have something to compare against. If nobody recorded the standard when the workflow was built, you are comparing today's output to your memory of last spring, and memory drifts faster than the automation does.
So capture it at build time, and capture pairs, not outputs alone. For each example: the input that went in, the output that came back, and a short note on what makes that output correct. An output with no input attached tells you very little six months later.
Record the version details alongside it. The prompt as it was written, the tool and model if the vendor exposes it, and which data sources it was reading. When something changes later, this is what lets you tell whether the workflow changed or the world did.
Include the ugly cases deliberately. Random examples give you the normal path, and the normal path is not where things break. Add the malformed input, the duplicate, the request in the wrong language, the edge case you argued about while building it. Those are the ones worth checking.
When the underlying business rule changes and yesterday's correct answer is no longer today's, do not overwrite the reference set silently. Keep the old version and create a new one. That gives you an audit trail, and it means "correct" always means correct as of a known date.
If you have automations running now with no such record, build one from current output while somebody still remembers what the process was supposed to do. Less clean than capturing it at build time, much better than nothing.
The monthly sample
Ten items on a scheduled day, chosen at random rather than picked. Random matters because picking invites you toward the familiar and the convenient, and neither is representative.
Ten is a habit-building default for low-consequence workflows, not a fixed rule. Sample size and frequency should rise with volume, how often the workflow changes, and what a mistake would actually cost. If a workflow touches money, customer records, or people, sample more, and deliberately include the rare cases instead of waiting for them to show up in a random draw.
Check against your reference pairs. You are looking for the small stuff: a field right in nine and empty in one, a date format that shifted, a category that used to appear and does not.
A single minor oddity may be noise, and the same oddity showing up twice is a pattern worth tracking. A severe error is neither of those: log it as an incident the first time it happens, without waiting for a repeat to confirm it.
Write down what you found even when you found nothing. A note saying "sampled 10, no issues, September" is what lets you narrow the window later when something does turn up.
Change logs, and sometimes more
Most workflows do not need an approval step so much as someone willing to write the date down when something changes.
When a form changes, a template gets updated, a vendor changes their file format, or you edit a prompt, note it in one place with the date. That takes ten seconds and it can turn hours of investigation into minutes, because you can line up when the output went odd against what changed that week.
Most small businesses skip this and pay for it later, in hours, at the worst possible time.
The exception is the workflow that moves money, changes records, affects people, or sends things to customers. There, test the change before it goes live and have someone other than the person making it agree it should. That is a small extra control on the changes where being wrong is expensive.
Where to start
Pick the automation that touches customers or money. That is where drift costs you something real rather than costing you cleanup time.
For that one workflow, start this week: save ten known-good input and output pairs as your reference, write down what its normal weekly volume looks like, and put a note on the calendar for the same day each month to pull a sample.
Part three is about making those signals report themselves, so you are not the one checking.
Sources
- The drift categories, detection signals and reference-pair practice described here come from our own client work rather than from published research.
- NIST's AI Risk Management Framework covers monitoring deployed systems for drift and comparing production metrics against pre-deployment benchmarks: NIST AI RMF Playbook, Measure 2.4.
- NIST's March 2026 report on monitoring deployed AI systems covers why post-deployment monitoring differs from pre-deployment testing: New Report: Challenges to the Monitoring of Deployed AI Systems.
- Part one of this series covers the ownership and logging decisions that make this practical: What AI Governance Actually Means When You Have Five Employees.
A note on images across this site. Illustrations and workflow diagrams are made with AI, from prompts we write and refine, and we edit most of them afterwards. Screenshots taken in n8n are not, since they show workflows we built in the tool.