ISO 42001 Clause 9.3.1: Review Whether the AIMS Still Fits

What clause 9.3.1 requires in practice

Clause 9.3.1 is the short general requirement at the top of management review. Top management, meaning the person or group that directs and controls the organisation at the highest level, must review the AI management system at planned intervals. The purpose is to ensure the system's continuing suitability, adequacy and effectiveness.

Each of the three words asks something different. Suitability looks at whether the system still fits the organisation's purpose, context and AI activities. Adequacy looks at whether it provides enough, in resources, controls and coverage, for what is needed. Effectiveness looks at whether planned activities are carried out and intended results are achieved. The clause leaves the interval to the organisation and does not prescribe an annual date or a meeting format. Its output is a considered judgement by top management about the system as a whole, supported by the inputs and results covered in 9.3.2 and 9.3.3.

Why clause 9.3.1 matters to the business

AI use tends to grow faster than the structures built to govern it. A system designed for a small internal pilot can quietly become inadequate when the organisation begins to offer AI-based services to customers, yet its procedures may still run smoothly. A review by top management is the point where someone with authority asks whether the whole arrangement still fits. That question protects the business from scaling risk faster than control, and it signals to clients, investors and auditors that governance has real sponsorship. When leaders delegate the judgement entirely, the organisation loses that protection and often discovers resourcing gaps only after a failure.

How to implement clause 9.3.1

Frame the review around the three questions and keep leaders engaged in answering them. One approach that Sterling teams use is described below. Short, well-prepared sessions with real challenge usually beat long ones where leaders only listen to presentations.

1. Identify who counts as top management for the scope of your system and confirm their commitment to attend.
2. Agree the planned interval, considering how quickly your AI uses and suppliers change.
3. For each major finding, ask whether it raises a suitability, adequacy or effectiveness concern, and note which.
4. Invite additional participants where the subject needs them, such as procurement for supplier-dependent services.
5. Allow enough time for discussion and challenge, not only for presentations of results.
6. Make sure urgent concerns are escalated between reviews so management does not wait for the next scheduled date.
7. Check that the full scope of the system is covered, including supporting processes and interfaces, not only the most visible AI project.

Illustrative IT example: the system fits the old service

Illustrative manufacturing example: a resource gap limits effectiveness

A manufacturer has a suitable policy for reviewing uncertain AI inspection results, but the designated experts are available only on one shift. Other shifts record delayed reviews and improvised decisions.

The review examines adequacy of resources and effectiveness of the actual arrangement. Leaders may need to adjust the permitted operation, provide capability or change the control. Repeating that the policy is appropriate would answer only part of the question.

Plan intervals that support decisions

The clause does not prescribe an annual date. Plan intervals suitable to the organisation, considering how quickly its activities and evidence change. A stable constrained use and a rapidly expanding portfolio may justify different arrangements.

Planned review should coexist with timely action on urgent matters. Management need not wait for the next scheduled review to address a significant concern. Conversely, informal decisions during the year should not obscure whether the complete required review has occurred.

Keep top management engaged in the judgement

Specialists and the AIMS coordinator can prepare evidence and explain limitations. Top management performs the review and needs enough understanding to decide about the system. Delegating data collection is different from delegating away the leadership responsibility.

Participation should match the issues. A supplier-dependent service may need procurement input; a new use affecting workers may need relevant operational and specialist knowledge. These are practical choices for informed review, not a fixed ISO attendance list.

Evidence and common weaknesses