ISO 42001 Annex A.2.4: Review AI Policy as the Organisation Changes
ISO 42001 control A.2.4 concerns reviewing AI policy at planned intervals and additionally when needed to maintain its suitability, adequacy and effectiveness. A current review date is useful only if the organisation has actually examined whether the policy still provides appropriate direction.
What control A.2.4 requires in practice
Control A.2.4 requires the AI policy to be looked at again on a planned rhythm and whenever circumstances demand, so that it stays suitable, adequate and effective. Two triggers are therefore built in: a planned rhythm, and an as-needed review when circumstances call for one. The clause does not specify an annual cycle, a review template or who must attend.
Annex B, as guidance, says management should approve a role to take charge of developing the policy or its components, and of reviewing and evaluating them. It adds that the review should look for ways to improve the organisation's policies and its approach to managing AI as its surroundings, business circumstances, legal conditions or technology change, and should draw on the outcomes of management review. A review may conclude that the wording stays as it is.
Give the review a clear owner and question
Annex B.2.4 guides organisations to assign a management-approved role for developing, reviewing and evaluating the policy or its components. It connects review with changes in business, organisational, legal and technical conditions and with management-review results. Clause 6.1.3(e) requires consideration of this guidance; B.1 permits a tailored implementation.
As an original review prompt, ask which decisions the policy no longer explains well. A policy can remain suitable in principle while lacking direction for a new activity. It can also contain commitments that operating evidence shows are not achievable under current arrangements.
Why control A.2.4 matters to the business
A policy that was right when written can quietly become wrong as the business launches new services, changes suppliers or faces new customer demands. Staff then either follow a rule that no longer makes sense or ignore it, and the organisation loses control of the very decisions the policy was meant to steer. A genuine review keeps direction aligned with real activity and surfaces patterns, such as repeated exceptions that signal a design problem rather than individual bad behaviour. It also provides current, credible answers when customers and certification auditors ask whether policy reflects present practice, and it prevents the embarrassment of a policy whose only recent change is its date.
How to implement control A.2.4
Make review an evidence-based decision with a named owner. The following steps show one method that Sterling teams use, and the control leaves the exact design to the organisation. Keep the process light enough to be repeated reliably, yet rigorous enough that a review could actually conclude the policy needs to change.
- Appoint a management-approved owner with access to incidents, exceptions, audit findings and management review results.
- Set the planned interval and list the events that would prompt an early review, such as a new customer offering.
- Collect inputs before each review, including repeated exceptions, staff questions and changes in obligations.
- Ask which decisions the policy no longer explains well and whether any commitments cannot be met in practice.
- Record the conclusion and its basis whether or not wording changes, and avoid altering the date alone.
- Where an operating boundary changes, send the revision through review and approval and tell affected staff directly.
- Check related procedures and other policies for conflicts created by the change.
Illustrative software example: internal assistance becomes a product
A software company writes policy for employees using AI to improve internal productivity. Later it offers an AI-assisted feature to customers. The existing policy says little about provider responsibilities, information supplied to users or customer reliance on outputs.
The review considers the changed role and relevant evidence before deciding which policy provisions and references need revision. A simple renewal of the old document would miss the reason the policy no longer fits. Related operating processes also need attention; policy review alone does not establish a controlled launch.
Illustrative BPO example: exceptions reveal a design problem
A BPO provider repeatedly grants exceptions to a policy restriction because the approved process cannot handle a common client request. Supervisors treat each case as isolated and management sees only the final approval count.
Policy review brings the pattern into view. The organisation examines whether the policy, scope or delivery model needs change, or whether exceptions are being granted without a sound basis. It does not automatically relax the rule to match current behaviour. The decision should consider risk, affected parties and applicable requirements.
Use evidence from operation and management review
Policy evaluation can draw on concerns, audit findings, changed objectives and operating limitations. Management-review results may identify a need for clearer direction or a different arrangement. The policy owner should understand those decisions rather than review wording in isolation.
Ask whether employees can explain how the policy affects their work and whether customer-facing statements remain accurate. Inconsistent explanations may indicate a communication issue, a policy issue or both. Diagnose the problem before adding more text.
Make revisions controlled and usable
Where changes are needed, connect them with review and approval of documented information and communication to affected people. A change in an operating boundary should not be hidden in a minor editorial revision.
Where no change is needed, retain a proportionate account of the review and its basis. The control does not prescribe an annual cycle, a specific minutes template or automatic replacement of the policy. A reasoned decision to maintain suitable wording can be valid.
Evidence and failure patterns
Useful evidence includes review responsibility, the issues considered, resulting decisions and implementation of material revisions. An auditor can compare policy statements with current uses and ask how a significant change affected the review.
Common weaknesses include changing only the date, using a review owner who cannot access relevant information, and revising policy without resolving conflicts with other documents. Link with policy alignment when another organisational rule is affected. Policy review should improve direction, not merely create a newer file.
Frequently asked questions
Must AI policy be reviewed once a year?
No universal annual interval is prescribed by this control. Establish planned reviews and additional review when circumstances require it.
Does a review have to produce new wording?
No. It may confirm that the policy remains suitable, provided the conclusion follows meaningful consideration of relevant evidence.
Who should perform the review?
Use a management-approved role with suitable access and capability. Relevant policy owners and specialists can contribute to the evaluation.
Test whether policy still fits your AI activities
Discuss a changed AI role or recurring exception with Sterling to scope a policy review and implementation response. Agreed support can include Effivity ISO & GRC automation software. ISO/IEC 42001 Awareness supports understanding of the wider AIMS. See the policy controls and the complete library.