ISO 42001 Clause 9: Evaluate AI Governance with Evidence

What clause 9 requires in practice

Clause 9 asks the organisation to find out whether its AI management system works, through three linked activities. Clause 9.1 requires it to decide what to monitor and measure, the methods that give valid results, when to measure, and when to analyse and evaluate the results, then to evaluate performance and effectiveness, keeping evidence of results. Clause 9.2 requires internal audits at planned intervals, run under an audit programme, to establish whether the system meets the organisation's own requirements and the standard and is effectively implemented and maintained. Clause 9.3 requires top management to review the system at planned intervals for continuing suitability, adequacy and effectiveness, using specified inputs and recording decisions about improvement and any change needed. The result is evidence of how the system performs, tested independently and judged by leaders.

Why clause 9 matters to the business

Without evaluation, an AI management system is a set of intentions. Clause 9 supplies the evidence that leaders need to decide whether to extend, restrict or redesign AI uses. It also protects against comfortable but misleading signals, such as high adoption or an absence of complaints. For commercial teams, a working evaluation cycle is the proof that answers customer due-diligence questions about ongoing governance. For certification, it is often where weaknesses surface, because auditors can quickly tell whether measurement leads to decisions. Done well, it lowers the cost of surprises by bringing problems to management while there is still room to choose a response.

How to implement clause 9

Build the three activities as a single evidence chain, so that what is measured feeds the audit and what is audited feeds the review. A workable path used by Sterling teams follows.

1. List the decisions top management needs to make about AI, then choose measures that would genuinely inform each one.
2. Define each measure's source, population, method and timing, and write down what it does not show.
3. Plan an audit programme that gives most attention to consequential, fast-changing or repeatedly weak areas.
4. Define objectives, criteria and scope for each audit, and arrange auditors who can be objective about the area.
5. Assemble a review pack that connects measurement results, audit results and nonconformity trends, with unresolved items from before.
6. Record management decisions in a way that names the change or improvement chosen and who will carry it out.
7. At the next cycle, check whether earlier decisions actually changed results, not only whether they were closed.

9.1: decide what evidence can answer the question

9.2: audit the system against defined criteria

Internal audits at planned intervals examine conformity with the organisation's own AIMS requirements and ISO 42001, and effective implementation and maintenance. The programme addresses frequency, methods, responsibilities, planning and reporting, considering process importance and previous audit results. Each audit has defined objectives, criteria and scope, with objective and impartial conduct. Results reach relevant management, and documented evidence of programme implementation and results is retained.

Consider a software company introducing a new model provider. An internal audit can follow the change from its initial request through assessment, approval, operating conditions and monitoring. The auditor compares evidence with relevant requirements rather than assuming that supplier approval proves all downstream uses were considered.

Auditors need sufficient competence for the process and criteria. They do not have to personally reproduce every specialist evaluation to examine whether the required evaluation was competently performed and used. Where specialist judgement is necessary, arrange suitable expertise instead of drawing conclusions beyond the team's capability.

9.3: bring the evidence to top management

Management review takes place at planned intervals to consider continuing suitability, adequacy and effectiveness. Required inputs include previous review actions, changes in relevant context and interested-party requirements, AIMS performance trends in nonconformities and corrective actions, monitoring and measurement, audit results, and improvement opportunities. Outputs include decisions on improvements and needed AIMS changes, with documented evidence of results.

The organisation can include other useful information. As an original suggestion, significant risk changes, impact findings, objective progress and unresolved supplier limitations may help explain performance and required decisions. These should not be misrepresented as a verbatim list of separately named clause 9.3.2 inputs.

In the BPO example, management may need to adjust the allowed use, review arrangements or service resources after examining the omitted-remedy problem. A useful review record explains the decision and enables follow-up. Simply recording that the dashboard was presented leaves the substantive issue unresolved.

Evaluate a system, not a collection of favourable numbers

An auditor may trace a reported metric to underlying evidence, examine programme coverage and follow review outputs into action. The organisation should understand what its measures do not establish. Results from one language, product line or customer group may not justify a conclusion about all uses.

Common weaknesses include changing a measure without explaining the effect on comparisons, treating “no complaints” as proof of no harm, and accepting repeated overdue actions without reconsidering the cause. An increase in reported concerns may reflect better reporting, while a low number may reflect an inaccessible reporting route.

For a global programme, consolidate information without erasing consequential local differences. A group-wide average can hide a serious issue affecting a small population. Use shared methods to support comparison and preserve the detail needed to decide whether a local condition changes the response.

Explore each numbered part

Common nonconformities with clause 9

Clause 9 weaknesses usually appear where evidence stops short of a decision. Typical findings include the following.

• Measures chosen because they were easy to collect, such as usage counts, with nothing showing whether controls or review steps work.
• Internal audits that confirm documents exist but never follow an actual AI use across assessment, operation and evaluation.
• Management review records that list attendance or dashboard titles without any decision on improvement or change.
• Audit programmes that skip technically difficult processes or repeat last cycle's checklist after a major change.
• Review inputs that omit unresolved actions from earlier reviews or hide local problems inside a group-wide average.

Illustrative example: a dashboard hides a depot problem

A hypothetical Netherlands logistics operator uses AI to propose delivery time slots to customers. Its dashboard shows rapid handling and few complaints, and management reads this as success. An internal audit follows one proposal from request to outcome and finds that drivers at one depot routinely overrule suggestions because the tool ignores local loading constraints, yet those overrides never reach any measure. The audit reports the gap against the organisation's own monitoring requirement. At management review, leaders receive the audit result alongside the complaint trend and an explanation of what each does not show. They decide to narrow the permitted use at that depot, add override information to the measures and revisit the result at the next review. The record states the decision, the owner and the evidence expected, so progress can be examined later.