ISO 42001 Annex A 2.4 Review the AI policy at planned intervals to keep it effective
What it says
The AI policy shall be reviewed at planned intervals or additionally as needed to ensure its continuing suitability, adequacy and effectiveness.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishYour organisation regularly reviews its artificial intelligence (AI) policy, and reviews it again whenever circumstances change, to confirm it remains suitable, adequate and effective.
An AI policy is the document that sets out how your organisation will use and govern artificial intelligence (AI). Like any rulebook, it can drift out of date as your business grows, as you adopt new AI tools, or as laws and risks change. This control requires you to look over the policy on a set schedule (for example once a year) and also out of cycle whenever something important happens, such as a new regulation, a serious incident, or a major change to how you use AI. The review checks three things: is the policy still suitable (does it fit what the business now does), is it adequate (does it cover everything it should), and is it effective (is it actually working in practice). If gaps are found, the policy is updated and re-approved. This keeps your AI management system (AIMS, the overall framework you use to govern AI) anchored to reality rather than to a document that was written once and forgotten.
Free. Save your status, tasks and notes.
Why it matters
If the AI policy is never reviewed, it drifts out of date as tools, laws and risks change, leaving AI use governed by rules that no longer fit.
How to implement
Top management or the person who owns the AI management system sets a fixed review cycle for the AI policy (commonly every 12 months) and records the next review date in a calendar or governance schedule so it is never missed.
The AI policy owner triggers an additional out-of-cycle review whenever a significant change occurs, such as a new AI law, a major incident, a new high-risk AI use case, or a substantial change to the business, and writes down what prompted the review.
Whoever leads each review gathers practical inputs first (incident reports, audit findings, regulatory updates, results of AI risk assessments, and feedback from staff) so the review judges the policy against real evidence rather than opinion.
The reviewers assess the policy against the three required tests (continuing suitability, adequacy and effectiveness), note any gaps, and update and re-approve the wording so the changes take formal effect.
The AI policy owner records each review in writing (date, who attended, what was found, what changed, and who approved it) and communicates any updated policy to all affected staff so everyone follows the current version.
Keep it running
Set a recurring calendar reminder for the planned review, and keep a short trigger list of events (new law, incident, major change) that force an extra review.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
the schedule or procedure that defines how often the AI policy is reviewed, and confirm a planned interval is actually set rather than left open-ended.
Look at
dated records of the most recent reviews and check that they happened on time according to that schedule, with no large unexplained gaps.
- Check 2 of 2What an auditor asks for
Ask for
what would trigger a review outside the normal cycle, and look for evidence that out-of-cycle reviews really took place after major changes or incidents.
Look at
the review records to confirm the policy was judged against all three criteria (suitability, adequacy and effectiveness) using real inputs such as incidents, audit results and regulatory changes, not just a quick sign-off.
Good evidence
a current, approved AI policy with a documented review history showing dated reviews, identified gaps, resulting updates, formal re-approval, and communication of changes to staff.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.1.
Annex A 2.4 requires the organisation to review its AI policy at planned intervals and as needed to ensure it is suitable, adequate, and effective. ISO/IEC 27001:2022 Annex A 5.1 similarly requires information security policies to be reviewed at planned intervals and upon significant changes, though it also includes requirements for policy definition, approval, and communication.
This control partially overlaps A.5.36.
Annex A 2.4 requires scheduled (and event-driven) review of the AI policy to ensure it remains effective. Annex A 5.36 requires regular review of compliance with information security policies, which can include checking adherence to AI-related security requirements embedded in policy. Annex A 2.4 focuses on policy suitability/adequacy/effectiveness, whereas Annex A 5.36 focuses on whether the organisation is complying with policies (which may not, by itself, validate that the policy remains fit for purpose).
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-2074.
Annex A 2.4 requires the organisation to review its AI policy at planned intervals and when needed to ensure it remains suitable, adequate and effective. ISM-2074 requires the organisation to develop, implement and maintain a general-purpose AI usage policy, which would be one of the key AI policies subject to review under Annex A 2.4. ISM-2074 is broader on policy creation/implementation, while Annex A 2.4 is specifically about the ongoing review and continued effectiveness of the AI policy.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents