The Policy Versioning Problem

Ask an institution what its policy was on a Tuesday eighteen months ago and you will usually get a current PDF, a changelog written by a person, and an apology. The policy exists; the state of the policy at a point in time does not.

Why documents cannot version

• Amendments arrive as prose describing edits to other prose, not as diffs against a structure.
• A single clause change can silently alter the meaning of clauses elsewhere with no dependency graph to consult.
• Effective dates, transition periods and grandfathering rules live in footnotes rather than in the model of the policy itself.
• Multiple valid versions frequently coexist for different populations, and documents have no way to express that.

What versioned authority requires

An authority artifact should be content-addressed and immutable: publishing a new version never mutates the old one. Every decision record cites the exact artifact identifier that produced it. Temporal validity is a first-class field, not commentary. And migration between versions is explicit — the artifact states which decisions carry forward and which must be re-evaluated.

artifact  eu-ai-act/high-risk-class
version   2.3.0
digest    b7f0…9ac1
in force  2026-02-01 → present
supersedes 2.2.1 (re-evaluation: not required)

The payoff is quiet but structural: an audit becomes a lookup instead of an investigation.

Three years after a refusal, an appeal is filed. The current policy text has been amended twice. The institution can produce the current document and a changelog, but cannot reconstruct the exact rule set applied on the day.

With versioned artifacts, the decision record cites a hash. The artifact is retrieved, re-executed against the original inputs, and produces the same outcome — or reveals that it does not.