Review of the AI policy

Review the AI policy at planned intervals, and additionally when needed, so it stays suitable, adequate and effective. In practice the record is policy review schedule and review records. Read it against review of the ai policy at the next policy review.

What it asks

Review the AI policy at planned intervals, and additionally when needed, so it stays suitable, adequate and effective.

Where generative AI changes the answer

Review has to be triggered by a new model or a new use, not only by the calendar, or the policy describes a tool the organisation no longer runs.

Who it binds

The AI management system owner and the policy approver. For A.2.4 the named role is the owner of policy review schedule and review records.

Evidence an auditor normally samples

• Policy review schedule and review records
• Named management-approved role responsible for the policy
• Evidence management review results fed the policy review

The test you can run

Compare policy review schedule and review records with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Policy unchanged since issue despite new AI uses or law
• No owner for the policy

Before the draft publishes

For A.2.4, compare the current AI policy with what staff actually do with generative tools, and record every gap you find as a policy exception until it is fixed. The first artefact to produce is policy review schedule and review records.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.2.4 (review of the ai policy) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.