ISO 42001 Clause 7.5.2: Review and Approve AI Information Before Use

What clause 7.5.2 requires in practice

Clause 7.5.2 applies each time documented information is created or updated. The organisation must make sure three things are appropriate. The first is identification and description, for which the standard offers examples such as a title, date, author or reference number. The second is format and media, which covers language, software version, graphics, and whether the item is on paper or in electronic form. The third is review and approval for suitability and adequacy.

Review and approval are named together, so both need to happen in a way that can be understood afterwards. Review means someone examines whether the content is fit for its purpose and sufficient. Approval is the authorised decision to accept it. The clause does not fix a numbering scheme, a signature type or a number of approvers. The outputs are information that readers can recognise and trust, plus visible evidence that someone with suitable authority and understanding considered it.

Make the information identifiable

The reader should be able to understand what the information concerns and which version applies. The standard gives examples of identification details but does not impose one numbering convention. Choose identification that supports actual use, especially where an assessment refers to a particular AI configuration, purpose or population.

As a practical check, separate a completed assessment's identity from the current template used to produce assessments. Changing the template should not make the earlier record appear to have been created using a method that did not yet exist.

Why clause 7.5.2 matters to the business

People act on what documents tell them. If an operating limit was edited without anyone who understood its consequences, the organisation may extend an AI use further than it ever decided to. Clear identification protects the business when a customer or auditor asks which rule applied on a given date. Sensible format choices matter commercially as well, because an instruction that cannot be read on the device used at the point of work is, in practice, an instruction that does not exist. A credible review and approval step also protects individual employees, who can show they followed an authorised decision rather than an unchecked draft.

How to implement clause 7.5.2

Make review and approval meaningful rather than ceremonial. Sterling teams usually begin by deciding what suitability and adequacy mean for each kind of information, then match reviewers to those meanings.

1. Decide the identification details you need, such as title, owner, date and the AI use or configuration concerned.
2. For each information type, state what a reviewer should examine, for example technical accuracy, governance fit or readability.
3. Name who may approve each type and confirm that the person has the authority and enough understanding to decide.
4. Ask authors to say what changed and why, so reviewers can focus on the effect rather than reread everything.
5. Check the format on the real device and in the real setting where the information is used.
6. Keep completed assessments distinct from the templates used to produce them, so a method change does not rewrite history.
7. Sample recent approvals and confirm that each shows real consideration, not an automatic status change.

Illustrative software example: approval follows the wrong review

Illustrative IT example: the format hides a critical limitation

An IT service owner publishes an AI incident-routing instruction as a wide desktop table. On the device used by on-call staff, the column containing escalation conditions is difficult to see. The content may be correct, but the format is unsuitable for the operating setting.

The team reviews the information in the actual environment and revises its presentation. It preserves the meaning and makes the limitation accessible where a decision occurs. Clause 7.5.2's attention to format and media is therefore a practical usability issue, not merely a branding exercise.

Review the effect of a change

An update may alter wording, data, authority or an operating condition. The review should examine the relevant effect, not assume every revision has equal significance. A small wording change can be consequential if it changes what users believe they are authorised to do.

Suggested practice is to explain the material change to the reviewer and identify affected information. If a treatment decision changes, related instructions and communication may also need revision. This is a useful method for coordination, not a mandated change-summary field.

Distinguish review and approval

Review examines whether the information is suitable and sufficient for its purpose. Approval provides the authorised decision to accept it. The organisation can design proportionate arrangements and may combine activities where suitable, but both functions need to occur.

The clause does not universally require two different people or a handwritten signature. The process should make authority and evidence understandable. Where specialist judgement is needed, involve competent people rather than assume that seniority alone establishes technical suitability.

Evidence and common weaknesses