How can you release a new model version with low risk?

Replace the old model for everyone at once, at night
Send a small share of real traffic to the new version (a canary), compare its metrics with the old one, and increase the share step by step (Correct option)
Test it only offline and then deploy
Give it to the internal team forever

Send a small share of real traffic to the new version (a canary), compare its metrics with the old one, and increase the share step by step

A canary exposes only a few users to a possible problem, while real traffic shows how the model behaves with real data and real load.

If the error rate, latency or business metrics are worse, you stop and send the traffic back. If they are fine, you ramp up.

Offline tests cannot show everything that happens in production.

Canary: small share first, then ramp up.