Use beyond validated scope

What it is

Approval of a model is approval for a stated use. Models are attractive to reuse: the work is done, the output is available, and a neighbouring team has a similar need. Each reuse quietly extends the model beyond what was tested. General-purpose models make this easier still, since the same system will attempt whatever it is asked. The risk is governance failure more than model failure: nobody decided that the new use was acceptable.

How it happens

• A score built for marketing is adopted for credit or pricing decisions.
• A model validated for one country or product is rolled out to others.
• An assistant approved for internal drafting is exposed to customers.
• The approved purpose was recorded so loosely that anything fits.

Why it matters

The evidence of fitness does not transfer. Risk tiering, impact assessment and legal classification were all done for the original use and may be wrong for the new one, including classification under the EU AI Act, where a change of intended purpose can bring a system into the high-risk category.

Warning signs

• The inventory records a model's owner and not its approved uses.
• Other systems consume a model's output without the owner's knowledge.
• Usage has grown in areas the original case did not mention.
• No trigger exists for reassessment when use changes.

Who owns it

The model owner is accountable for where the model is used. Each business owner who adopts it is accountable for obtaining approval for their use. Governance maintains the record.

In practice

A propensity score that predicts which customers will respond to a savings offer is picked up by the collections team as an indicator of financial resilience and used to set repayment plans. The same pattern generalises to any model whose output is available to people beyond those it was approved for.