When a prompt becomes a controlled document

Most prompts are disposable and should stay that way. A small number stop being disposable the moment they are reused, and the transition is almost never noticed at the time.

The test is simple. If the same prompt is applied repeatedly to different people's cases, it is no longer a question someone asked. It is a rule the organisation applies. Rules that the organisation applies need to be written down, owned, changed deliberately, and reconstructible after the fact.

Why this is a governance question and not a tidiness one

A reused prompt determines outputs. Change a sentence in it and the outputs change for everyone assessed afterwards, with no announcement, no version number and no way to tell later which cases were handled under which text. If an outcome is challenged six months on, the organisation cannot say what rule was applied, which defeats every downstream control: no explanation, no audit trail, no basis for reconstructing the decision.

Compare this to how the Act treats change in high-risk systems. Article 13(3) requires the instructions for use to state pre-determined changes, so that change is anticipated rather than discovered. Article 12 requires automatic event logging over the system's lifetime, and Articles 19 and 26(6) require six months' retention as a minimum. Article 72 requires a documented post-market monitoring system, proportionate, actively and systematically collecting and analysing performance data across the lifetime of the system, based on a plan. A prompt that silently redefines behaviour cuts across all of that.

The modification question

There is a line here worth being careful about. Under Article 25, a deployer becomes a provider by putting its name or trade mark on a system, by making a substantial modification, or by changing the intended purpose so that the system becomes high-risk. Whether a particular prompt amounts to a substantial modification is a judgement about the specific facts, and this course is not going to tell you that any given prompt crosses that line.

What is clear is the third route, which does not depend on the modification question at all. If you prompt a general-purpose system into doing something that is high-risk, such as screening candidates or assessing creditworthiness, you have changed the intended purpose, and that is a named route to provider status. The prompt is the mechanism by which people repurpose tools, which is why prompts are where repurposing gets discovered.

What versioning actually requires

Less than teams fear. For each prompt that decides anything about a person:

• A version identifier stored with every output produced under it.
• A named owner. One person, not a team, who approves changes.
• A change record saying what changed, why, who approved it and when it took effect.
• A before and after check on a fixed set of cases, so the effect of the change is observed rather than assumed.
• Retention of superseded versions for as long as decisions made under them can be challenged.

That last point is the one people get wrong by deleting. A prompt you no longer use is the only document that explains outputs you still have to defend.

Testing changes the way the Act tests systems

Article 9 requires, for high-risk systems, a risk management process that is established, implemented, documented and maintained, running continuously and iteratively across the lifecycle. Articles 9(6) and 9(7) are the part worth importing into prompt work whatever your classification: testing is done against metrics and probabilistic thresholds defined in advance.

Defined in advance is doing the work in that sentence. If you change a prompt, run it on twenty known cases and then decide the results look better, you have measured nothing; you have formed an impression after seeing the answer. Write down what would count as better before you look. This is cheap, it takes ten minutes, and it is the difference between a change you can defend and a change you prefer.

Where to draw the line

Do not version everything. Ask whether an output produced under this prompt could be challenged by the person it concerns. If yes, it is a controlled document. If no, it is a question you asked, and it can stay in your chat history where it belongs.

As of 24 September 2026.