# A.2.4 Review of the AI policy

Review the AI policy at planned intervals, and additionally when needed, so it stays suitable, adequate and effective. In practice the record is policy review schedule and review records. Read it against review of the ai policy at the next policy review.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.2.4
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Review the AI policy at planned intervals, and additionally when needed, so it stays suitable, adequate and effective.

## Where generative AI changes the answer

Review has to be triggered by a new model or a new use, not only by the calendar, or the policy describes a tool the organisation no longer runs.

## Who it binds

The AI management system owner and the policy approver.

## Evidence an auditor samples

- Policy review schedule and review records
- Named management-approved role responsible for the policy
- Evidence management review results fed the policy review

## The test you can run

Ask five staff where the acceptable-use rule is and what it forbids. Compare the answers with the policy.

## Common failures

- Policy unchanged since issue despite new AI uses or law
- No owner for the policy

## Before the draft publishes

Compare the current AI policy with what staff actually do with generative tools, and record every gap you find as a policy exception until it is fixed.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.