# AI management of change: MOC for AI in process safety management AI management of change means putting a model through the site's existing MOC procedure whenever its output reaches a decision about a hazardous process. A deployment, a retraining, a change to its input data and a vendor update each need the same technical basis, impact review, authorisation and training before start-up as any other change. It matters most once AI writes to the control system and operators move from human in the loop to human on the loop. This page is part of [AI in process safety management](https://www.autonomous-operations.ai/ai-process-safety-management/). ## Where has AI already moved from advice to control? - Aramco Fadhili gas plant. Since 29 October 2025, AI agents using Yokogawa's FKDPP algorithm directly and autonomously control the acid gas removal unit through CENTUM VP ([Yokogawa](https://www.yokogawa.com/news/press-releases/2025/2025-10-29/)). - ENEOS Kawasaki refinery. A crude distillation unit has run autonomously since January 2024 on Preferred Networks' AI, which adjusts 13 valves at once ([Preferred Networks](https://www.preferred.jp/en/news/pr20240524)). - ENEOS Materials. FKDPP was formally adopted for direct control of a distillation column on 30 March 2023 ([Yokogawa](https://www.yokogawa.com/news/press-releases/2023/2023-03-30/)). During the Yokkaichi field test, operators phoned "asking if it was OK to stop the AI" ([Yokogawa case study](https://www.yokogawa.com/library/resources/references/successstory-eneos-materials/)). - Big West Oil. The refiner and Imubit describe closed-loop optimisation with deep learning controllers ([PTQ Q3 2025](https://ptqmagazines.digitalrefining.com/PTQ-Q3-2025/57)). - Drilling. Closed-loop control on an Equinor well in Norway on 26 February 2025 ([Halliburton](https://www.halliburton.com/en/about-us/press-release/halliburton-sekal-deliver-world-first-automated-on-bottom-drilling-system-equinor-north-sea)) and on an Eni deepwater well offshore Indonesia on 9 July 2026 ([World Oil](https://www.worldoil.com/news/2026/7/9/halliburton-eni-achieve-industry-first-closed-loop-rig-automation-in-deepwater-indonesia)). ## Why does MOC for AI matter now? The duty already exists in [OSHA PSM, 29 CFR 1910.119(l)](https://www.osha.gov/laws-regs/regulations/standardnumber/1910/1910.119), [Seveso III, Annex III](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32012L0018) and [COMAH 2015, Schedule 2](https://www.legislation.gov.uk/uksi/2015/483/schedule/2). None of them mentions models. Havtil's audit report on Vår Energi's automated drilling, published 6 February 2026, records three non-conformities and orders criteria for development, testing and use "before the systems are taken into use", with a binding plan within two weeks ([Havtil](https://www.havtil.no/en/supervision/audit-reports/2026/var-energi--risk-assessment-and-qualification-of-automated-drilling-operations/)). Its audit of Aker BP's Yggdrasil development, published on 22 October 2026, found two non-conformities on new technology such as AI: technology qualification, and risk understanding linked to the planned use of robots ([Havtil](https://www.havtil.no/en/supervision/audit-reports/2026/aker-bp-yggdrasil--risk-management-and-qualification-of-new-technology-such-as-artificial-intelligence/)). See [are your automation and AI changes ready for a regulatory audit?](https://www.autonomous-operations.ai/ai-regulatory-audit-readiness/) On 12 June 2026 HSE stated that the law already requires a risk assessment for uses of AI affecting health and safety ([HSE](https://press.hse.gov.uk/?p=8268)). The Machinery Regulation (EU) 2023/1230 applies from 20 January 2027, as corrected in [OJ L 169, 4 July 2023](https://eur-lex.europa.eu/eli/reg/2023/1230/corrigendum/2023-07-04/oj/eng). Its Annex I lists safety components with self-evolving machine learning behaviour, and its substantial modification definition covers digital changes ([Regulation (EU) 2023/1230](https://eur-lex.europa.eu/eli/reg/2023/1230/oj/eng)). See [the key dates](https://www.autonomous-operations.ai/eu-ai-act-machinery-regulation-dates/) and [after a regulator order](https://www.autonomous-operations.ai/after-regulator-ai-order/). ## When is an AI change a change under MOC? - First deployment into a decision path, including a pilot operators act on. - Retraining, even with the same architecture. Its behaviour is meant to change, so it is rarely a replacement in kind. - A change to an input, such as a tag, an instrument range or a historian feed. - A vendor model update. ## Why do most MOC procedures miss AI changes? Screening asks about hardware, setpoints, procedures and chemicals, and a model change alters none of them visibly. Hosted models can be updated remotely without the site knowing. In the illustrative [Quillmere case](https://www.autonomous-operations.ai/cases/quillmere/), vendor updates to an alarm ranking model bypassed MOC and one pushed a reactor high temperature alarm down the list. The fix sits in the existing procedure. Add a screening question on models, track the model version as process configuration, and require the vendor by contract to notify each update and let the site hold it until MOC is complete. ## What should the MOC review ask about a model? - Training data. Which operating modes it covers, upsets included. - Operating envelope. The input range where the output is valid, and whether leaving it is alarmed. - Blind spots. Failure modes and conditions outside its inputs. - Barriers. Whether it sits in the path of a protection layer credited in the [HAZOP or LOPA](https://www.autonomous-operations.ai/ai-hazop/), and whether that layer stays independent. - Fallback. How the unit runs when the model is down or wrong, and who decides to stop using it. - Approval. The process technical authority signs, as well as the model owner. - Start-up. Pre-start-up review and training on the model's limits and when to disregard it. ## What is the MOC step at each stage gate? - Pilot. MOC before operators act on any output, with an end date. - Advisory. Envelope and fallback reviewed; operators trained to reject advice. - Closed loop. Barrier independence, write limits in the control system, pre-start-up review and a tested route back to manual. - Fleet. A fresh MOC at each site, since tags and crews differ, with version control. Most programmes stall between pilot and scale, as [why AI is not delivering](https://www.autonomous-operations.ai/why-ai-is-not-delivering/) explains. ## When does AI need organisational MOC? When it shifts tasks. OSHA's [2009 memorandum](https://www.osha.gov/laws-regs/standardinterpretations/2009-03-31-0) applies MOC to staffing changes affecting a covered process, and HSE notes such changes are "usually not analysed and controlled as thoroughly as plant or process changes" ([HSE](https://www.hse.gov.uk/humanfactors/topics/orgchange.htm)). Ask which tasks move, who keeps the manual skill, and whether staffing covers an upset with the model down. See [operator competence](https://www.autonomous-operations.ai/operator-competence-ai/). ## Can AI draft the MOC risk review? Yes, as a controlled tool. A fluent draft can still omit a hazard, so it needs an approved tool, controlled inputs, a competent reviewer and a record that AI was used. I scope and conduct each review myself, after ten years on an upper-tier Seveso plant and seven auditing operational risk across bp upstream, refining and chemicals. [M-OPS OMI](https://www.autonomous-operations.ai/omi/) tests your MOC procedure against these points; the [autonomous operations briefing](https://www.autonomous-operations.ai/#how-do-i-work-the-m-ops-service-range) takes one of your models through it. ## What you can expect from XO Autonomous Operations - A test of your MOC procedure against the AI changes it has to catch: deployment, retraining, new input data and vendor updates. - The MOC step defined for each stage gate, from pilot to closed loop. - The review questions to ask about a model, ready to add to your MOC forms. - Each review scoped, conducted and led by Carl Goodwin. ## Questions ### How do I apply MOC to an AI model in a refinery control system? Treat the model as process technology. Its deployment, each retraining, a change to its input data and each vendor update go through the site's existing MOC procedure, with a technical basis, an impact review covering the hazard analysis and operating limits, authorisation, and operator training before start-up. Moving from advice to closed loop is a separate change and needs its own review.