ISO 42001 management review: the inputs, the outputs, the record, and the AI evidence behind them

What clause 9.3 of ISO/IEC 42001 requires

Management review is the point at which the people accountable for your AI look at what the AIMS has actually produced and decide what changes. ISO/IEC 42001:2023 applies the harmonised structure, which gives management system standards identical clause numbers, titles and core text, so its clause 9.3 follows the same pattern as the other ISO management system standards: a general requirement, the inputs, and the results.

The general requirement is that top management reviews the system at intervals it has planned, to confirm that the AIMS remains suitable, adequate and effective.

The inputs, by topic

• the status of actions decided at earlier reviews;
• changes in the external and internal issues relevant to the AIMS;
• changes in the needs and expectations of interested parties;
• information on how the AIMS is performing, including trends in nonconformities and corrective actions, monitoring and measurement results, and audit results;
• opportunities for continual improvement.

The results, by topic

The review has to end in decisions on continual improvement opportunities and on any need to change the AIMS, and documented information has to be kept as evidence of those results. Resources are usually decided here too, because a change to the system often means people, tooling or budget.

The AI evidence behind each input

A review built only from the generic headings will miss what makes an AIMS different. Sterling maps each heading to the records the rest of the standard already requires, so the pack comes from the system rather than from slides written for the meeting:

• Changes in issues and interested parties: new or retired AI systems, changes of role (developer, provider, user), new customer or legal expectations about AI, and whether climate change remains a relevant issue under clause 4.1.
• Risk: the AI risk register after the latest reassessment under clause 8.2, progress on the treatment plan under 8.3, and any treatment that did not work.
• Impact: which AI system impact assessments were completed or repeated under clause 8.4 since the last review, and what they found about individuals, groups and society. The impact assessment guide covers the method.
• Controls: changes to the Statement of Applicability, and controls added beyond Annex A.
• Performance: AI objectives against target, monitoring results from systems in operation, AI incidents and concerns reported, internal audit findings and corrective actions.
• Third parties: changes to models, data or services supplied from outside, and to the responsibilities agreed with suppliers and customers.

None of these items is an extra requirement; each is the AI content of an input the standard already names. The risk assessment guide explains the register and treatment plan the review reads.

How often, and who attends

Certification bodies look for the reviews from the start. ISO/IEC 17021-1, the standard they are accredited against, has the Stage 1 readiness review evaluate whether management reviews are planned and performed, and every surveillance audit includes management review. A dated plan for the year, followed, is therefore evidence in its own right.

Top management must attend: the people who direct and control the organisation, or the part of it the AIMS covers. Around them, the AIMS lead prepares the pack and writes the minutes, system owners present their own systems, the data science or engineering lead reports on monitoring, legal and procurement cover obligations and suppliers, and the internal audit lead reports on the programme.

Running the review in one meeting a quarter

An annual review meets the words of the standard, but a model retrained in March and a supplier changed in May would wait until December for a decision. Sterling recommends 90 minutes every quarter with a fixed agenda, the pack circulated a week ahead at one page per item, a recommendation from every presenter, and an extra sitting when a significant change arrives between dates.

Once a year, add a check that the AI policy, the AI objectives and the scope still fit. Where an ISO/IEC 27001 review already runs, the same meeting can cover both systems if each standard's inputs are addressed; the ISMS to AIMS guide explains the combined approach.

The record auditors ask for

The minutes are the record, not the slide deck. An auditor reads them for the date and attendees, every input addressed even if only to note no change, decisions under improvement and changes to the AIMS, and an owner and due date for each action, with its status reported at the following review.

The auditor then traces decisions into the system. A decision to add a control should appear in the Statement of Applicability and the treatment plan; a decision to change the AIMS should appear as a planned change under clause 6.3; a new AI system approved for use should appear in the inventory with an impact assessment. Clause 6.1.3 requires designated management to approve the AI risk treatment plan and accept the residual AI risks, and many organisations take that approval in the review, which only works if the minutes name the risks accepted and who accepted them. Auditors also ask a member of top management what the last review decided.

What a weak AI management review looks like

In our gap analyses, weak reviews share a few patterns:

• the AIMS lead presents to an empty chair, and a director signs the minutes afterwards;
• the pack covers information security metrics but never mentions an impact assessment, an AI incident or a model change;
• minutes say the risk register was "noted" without any decision on treatment or acceptance;
• the same action rolls forward from quarter to quarter with no owner;
• one review is held just before the certification audit and none after it.

The fix is the same in each case: a fixed agenda built from the inputs, top management in the room, and a decision recorded against every item, including a reasoned decision to change nothing.

How Effivity holds the review

Effivity's Management Review module lets you set the agenda or start from a suggested one, e-mails attendees automatically, records minutes against each agenda point and turns decisions into action plans, so the status reported at the next review comes from the same place. The risk register, treatment plan, objectives, audits and corrective actions that feed the pack sit in its other modules, and the AI system inventory is a register configured for you. Effivity is included with the engagement, at no additional cost, and is used in 50+ countries; the Effivity guide covers the set-up.

ISO 42001 management review: questions buyers ask