Requirement
"The AI policy shall be reviewed at planned intervals or additionally as needed to ensure its continuing suitability, adequacy and effectiveness."[1]
Explanation
A policy written once and forgotten fails this control. The AI policy must be reviewed on a planned schedule — and sooner when the business, law, or technology changes — with a management-approved role owning the review. Auditors check for review records, dates, and evidence that management review results fed into policy updates.
Implementation Guidance
- A role approved by management should be responsible for the development, review and evaluation of the AI policy, or the components within. The review should include assessing opportunities for improvement of the organization's policies and approach to managing AI systems in response to changes to the organizational environment, business circumstances, legal conditions or technical environment.
- The review of AI policy should take the results of management reviews into account.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.2.4
- ISO/IEC 42001:2023 Annex B, B.2.4 (implementation guidance)
