Version 1.0 · 28 July 2026 · Applies to: ChangePlan production platform
This document describes the artificial intelligence capabilities in production in ChangePlan today: what they do, which model serves them, where data is processed and stored, what leaves the platform, and which controls govern their use. It is written for enterprise security, risk, privacy, and procurement reviewers.
Every technical claim below reflects the implementation in ChangePlan's production codebase as of the date above. Capabilities under evaluation for future releases are out of scope; customers are informed before any new AI capability is enabled.
1. Summary at a glance
Item | Position |
AI features in production | Two, both suggestion-only: Change Effort Assessment analysis and Initiative Brief analysis |
Model | Anthropic Claude Haiku 4.5 ( claude-haiku-4-5-20251001-v1:0) |
Model provider | Amazon Bedrock, running inside ChangePlan's own AWS account |
Third-party AI subprocessors | None. No Anthropic API, no OpenAI, no external AI vendor. Data does not leave AWS |
Training on customer data | Never. AWS Bedrock does not store inputs or outputs, and does not share them with model providers or use them to train models |
Default state | Disabled. Off at both the organisation and feature level; enabled only on explicit customer request |
User control | Individual users can opt out of document-based AI analysis |
Human oversight | Mandatory. Every AI output is a suggestion a user reviews, edits, accepts, or discards. AI never writes to a customer record autonomously |
Data residency | Data at rest remains in the customer's contracted region (US, Canada, Australia, EU). See §4 for regional inference routing |
Encryption | AES-256 at rest, TLS 1.2+ in transit |
Audit trail | Every AI generation is recorded with model, prompt version, requesting user, source documents, token counts, cost, latency, and confidence |
Retention | AI records follow the organisation's existing contractual retention and deletion policy. No separate lifetime, no separate deletion path |
2. What the AI does today
ChangePlan's production AI serves a single workflow: accelerating initiative setup by reading documents the user has already uploaded. Rather than a change manager manually transcribing a business case or project charter into ChangePlan's structured fields, the assistant reads the attached documents and proposes answers.
Two features use it:
2.1 Change Effort Assessment suggestions. The user selects previously uploaded initiative documents. The assistant reads them and proposes an answer to each assessment question, with supporting reasoning and a confidence score. The user reviews each proposal and accepts or overrides it.
2.2 Initiative Brief suggestions. The same pattern applied to the Initiative Brief question set, including free-text answers and selection from the organisation's own predefined option taxonomy.
What the AI does not do. It does not act autonomously, write to any record without user acceptance, send notifications, communicate with employees, make decisions about people, score or rank individuals, or access data beyond the documents the user explicitly selects for a given analysis. There is no AI chat assistant, no agentic behaviour, and no background analysis of customer data.
Every suggestion is presented as a proposal in the user interface. Nothing is committed to the initiative record until a human accepts it.
3. Model and provider architecture
AI inference runs on Amazon Bedrock, AWS's managed foundation-model service, invoked from ChangePlan's application services inside ChangePlan's own AWS account. The model is Anthropic Claude Haiku 4.5.
The architecturally significant point for security review is that Bedrock is an AWS service, not a third-party AI vendor integration. ChangePlan does not hold an account with Anthropic, OpenAI, or any AI provider, and no ChangePlan data is transmitted to one. Requests travel from ChangePlan's application services to the Bedrock endpoint within AWS. The model weights are hosted by AWS; Anthropic receives nothing.
This means AWS's existing position in ChangePlan's supply chain — already covered by the AWS agreement, and already assessed under ChangePlan's ISO 27001-certified ISMS — is the same position that covers AI inference. Enabling AI added no new subprocessor.
AWS Bedrock data handling. Under AWS's published service terms, Bedrock does not store prompts or completions after a request is served, does not use them to train or improve any model, and does not share them with the model provider. Inference calls are stateless: each request carries its own context and the service retains nothing between calls.
Technical parameters. Requests use the Claude Messages API format at temperature 0.1 (near-deterministic, tuned for consistent structured extraction rather than creative variance), with a 4,096-token output ceiling and a 120-second request timeout. Large question sets are split into parallel batches of three questions to keep response times predictable.
4. Data hosting and residency
ChangePlan runs a multi-region AWS architecture. Each supported region — United States, Canada, Australia, and the European Union — operates independently with its own application services, its own database, and its own storage. Data residency is configured per customer at onboarding, and there is no cross-region transfer of customer data between regional deployments.
AI inference follows the same regional model. The application selects a Bedrock geographic inference profile from the region it is running in:
Deployment region | Bedrock inference geography |
Australia ( ap-southeast-2) | Australia |
European Union ( eu-*) | European Union |
United States ( us-*) | United States |
Canada ( ca-central-1) | United States — see below |
Canada — cross-border inference disclosure
AWS does not currently publish a Canadian inference profile for Claude Haiku 4.5. For Canadian-hosted customers, all customer data at rest remains in Canada (
ca-central-1) — the database, document storage, backups, and every stored AI record stay in-region and never leave it. The inference call itself is served from US regions through Bedrock's US geographic profile.The practical exposure is bounded and worth stating precisely. What crosses the border is a single stateless request containing the extracted text of the documents the user selected, plus the question set. AWS retains none of it: the request is served and discarded, nothing is stored outside Canada, and nothing is used for training. No identity data, org chart, or employee record is part of that payload.
Canadian customers who require inference to remain in-region can leave the AI features disabled — they are off by default, and every other ChangePlan capability functions normally without them.
5. What data is sent to the model
AI analysis is invoked explicitly by a user, against a set of documents that user selects. Nothing is sent automatically or in the background.
Sent to Bedrock:
- The extracted plain text of the documents the user selected for that analysis
- The question set being answered, and — for the Initiative Brief — the organisation's own predefined answer options for those questions
- The prompt template, a versioned instruction set maintained by ChangePlan
Not sent, under any circumstance:
- Org charts, reporting hierarchies, group structures, or employee records
- Individual names, job titles, or work email addresses from the people directory
- Credentials, tokens, or authentication material
- Any document the user did not explicitly select for that analysis
- Any data from another organisation — requests are scoped to a single initiative within a single tenant
Document processing. Text extraction runs entirely inside ChangePlan's own application services using in-process libraries. No OCR service, document AI service, or third-party parser is involved, and document bytes are never sent to an external service for processing. Supported formats: plain text, CSV, PDF, Word (
.doc and .docx), PowerPoint (.ppt and .pptx), and Excel (.xls and .xlsx). Files in unsupported formats are skipped rather than transmitted.Volume limit. Extracted text is capped at approximately 82,000 characters (~20,000 tokens) per analysis. Content beyond the cap is truncated before the request is built and is never sent.
Because the user chooses which documents to attach and which to analyse, the organisation retains direct control over what any AI request can contain. If a document should not be processed by AI, it should not be selected — or the feature should be left disabled.
6. Data storage and retention
Uploaded documents. Stored in Amazon S3 with AES-256 server-side encryption, in the customer's contracted region. The bucket is private; the application never exposes it publicly. Downloads are served through short-lived presigned URLs that expire after ten minutes.
Extracted text. Once a document's text has been extracted, the result is cached against that document's record in the customer's regional database so repeated analyses do not re-parse the same file. It is stored in the same region, under the same encryption and the same access controls as the document itself, and is removed when the document is deleted.
AI generation records. Each analysis writes one audit record to the customer's regional database, containing the structured suggestions, the model's raw response, the identifiers of the source documents, the requesting user, and the operational metrics in §9.
Prompts are not retained in production. The full prompt text sent to the model is persisted only in ChangePlan's development environment. In production it is replaced with a placeholder before the record is written, so document content is not duplicated into the audit trail.
Application logging. Operational logs record volumes, timings, and error conditions — character counts, token counts, durations, failure reasons. They do not record document content or prompt text.
Retention and deletion. AI records carry no separate retention period. They live in the customer's own regional database alongside the rest of that organisation's data and are governed by the same contractual retention terms, the same backup schedule (daily, 7-day retention; weekly, 1-month; monthly, 13-month), and the same deletion process. When an organisation is deleted, its AI records are hard-deleted from production with it, under ISO 27001 secure deletion protocols, recoverable only within the backup window.
7. Usage policies and access controls
7.1 Disabled by default — two independent switches. AI is off unless an organisation asks for it. Two flags must both be true for any AI feature to run: an organisation-wide master switch, and a per-feature flag. Both default to
false, and an absent or unset value is treated as off. A customer who never requests AI never has it, and there is no configuration state in which AI is silently active.7.2 Organisation-level administration. Both switches are administrative settings, not user preferences. End users cannot enable AI for their organisation.
7.3 Individual opt-out. Users who prefer not to use document-based analysis can set a personal preference to skip it, independent of the organisation's setting.
7.4 Authentication and authorisation. Every AI endpoint sits behind the platform's standard authentication chain: verified identity token, resolved user record, and enforced organisation scope. Requests are bound to the caller's organisation and cannot reach another tenant's initiatives or documents. Existing role-based access control and tenant isolation apply unchanged — AI introduced no new access path to customer data and no privileged service account that bypasses tenant boundaries.
7.5 Controlled prompts. Prompt templates are stored as versioned records with an explicit active version. Users do not author the instructions sent to the model; they select documents. The version used for each generation is recorded, so any output can be traced to the exact instruction set that produced it.
7.6 Structured, validated output. The model is required to return structured data, which is then reconciled against ChangePlan's authoritative question list before anything is displayed: answers are re-aligned to their questions, values outside the valid range are discarded, and options outside the organisation's own taxonomy are dropped. A response that cannot be parsed is retried and then failed — never partially applied.
7.7 Human-in-the-loop. Every output is a proposal. Users review each suggestion, with the model's reasoning and confidence score visible, and accept or override it. No AI output reaches a customer record without a person's decision.
7.8 Content filtering. ChangePlan does not currently apply an additional Bedrock Guardrails content-filtering layer. The risk it would address is low in this context: the workflow is structured extraction from the customer's own business documents into a fixed question set, with the model's output constrained to a predefined schema, no free-text prompting exposed to end users, no generated content sent to any third party, and human review before anything is applied. Additional filtering is under evaluation as the AI surface expands.
8. Security posture
AI runs inside ChangePlan's existing security envelope rather than alongside it, and inherits every control already assessed under ChangePlan's ISO 27001-certified ISMS:
- Encryption. AES-256 at rest for all customer data including documents and AI records; TLS 1.2+ with HSTS in transit. No unencrypted traffic is permitted to or from the platform.
- Network. All traffic passes through a Web Application Firewall for Layer 7 protection before reaching regional services.
- Tenant isolation. Logical isolation at the application and database layer, enforced on every AI request through the same organisation-scoping guards used across the platform.
- Access management. RBAC on least-privilege principles; SSO via SAML 2.0 including Azure AD/Entra ID; MFA through the identity provider.
- Vulnerability management. Monthly internal scans, annual external scans, and independent penetration testing annually or after major releases, with remediation targets of 7 days (Critical), 14 (High), 30 (Medium), 90 (Low).
- Incident response. Formal Incident Response Policy under the ISMS; customers notified within 12–24 hours of a confirmed breach.
- Resilience. RTO 24 hours, RPO 1 hour, with automated encrypted AWS backups.
Controls specific to the AI path:
- No new subprocessor. Inference is an AWS service call within ChangePlan's own AWS account; no data is transmitted to an AI vendor.
- No model training, fine-tuning, or customisation on customer data. ChangePlan uses the base model exactly as AWS provides it; no customer data is used to adapt, tune, or improve any model, for ChangePlan or anyone else.
- No cross-tenant learning. Nothing from one organisation's data can influence another's results — each request is stateless and self-contained.
- Asynchronous analysis runs on isolated compute within the same regional deployment, with automatic retries disabled so a failed job fails visibly rather than silently reprocessing customer documents.
- Failures are recorded and surfaced. An analysis that errors is written to the audit trail with its error state rather than being discarded.
9. Auditability
Every AI generation writes a complete, queryable audit record in the customer's own regional database:
Recorded | Purpose |
Requesting user, organisation, initiative | Who ran it, and against what |
Source document identifiers and count | Exactly which documents were analysed |
Model identifier | Which model produced the output |
Prompt template id and version | Which instruction set was in effect |
Structured suggestions and raw model response | What the model actually returned |
Input, output, and total token counts | Volume of data processed |
Estimated cost | Consumption tracking |
Generation, document-processing, and total duration | Performance and SLA monitoring |
Confidence score | Average model confidence across the suggestions |
Error state and message, where applicable | Failure diagnosis |
This supports the questions enterprise governance functions actually ask: which documents were processed by AI and when, who initiated it, which model version produced a given output, and whether a suggestion was accepted. Records are retained and deleted on the same terms as the rest of the organisation's data.
10. Governance
Enablement. AI features are enabled per organisation, on request, by ChangePlan administrators. There is no self-service path that turns AI on for an organisation that has not asked for it, and no release that switches it on by default.
Change control. Prompt templates are versioned records with an explicit active version. Changes follow ChangePlan's standard engineering change process — review, approval, release — and every generation records the version it used, so behaviour at any point in time is reconstructable.
Model changes. The model in production is pinned to a specific version identifier. Moving to a different model or version is a deliberate engineering change, not an automatic upgrade.
New AI capabilities. Any new AI capability follows the same principles set out here: disabled by default, enabled per organisation on request, human-in-the-loop, audit-logged, and processed within AWS with no customer data used for training. Customers are informed before a new AI capability becomes available to them.
11. Questions
For AI-specific security, privacy, or procurement questions, or to request AI enablement for your organisation, contact your ChangePlan account manager or support@changeplan.co.