This step organizes the inputs for top management's review and records the decisions. It is needed because decisions and resource support from top management are required. You receive an input summary, management review outputs (decisions, resources, changes) and a decision tracking table.
It organizes the management review inputs and draws out top management's decisions, resources and changes. The inputs are the follow-up actions from previous management reviews, changes in external and internal issues, achievement of AI policy and objectives, AI performance and monitoring, changes in risk and impact assessments, incidents, the results of 12 Internal Audit and 13 Legal Requirements Identification and Monitoring, the status of corrective actions, changes in interested parties and legal requirements, adequacy of resources, and opportunities for improvement.
Of the decisions, nonconformities are passed to 15 Nonconformity and Corrective Action, and improvement tasks to 16 Improvement.
Output
- Management review input summary (1 page)Including the results of 12 Internal Audit and 13 Legal Requirements Identification and Monitoring and the status of corrective actions
- Management review outputDecisions, resources and changes (including decisions to update the risk assessment, impact assessment and Statement of Applicability) and a decision tracking table
- Guide to input data, checklist (prepared Y/N, evidence, decisions needed), meeting facilitation and result report (as the meeting record)
- Three output tracksCorrective action (→ 13) · reflection in next year's business plan · training and follow-up action control register (→ 6 and 9)
What to do in this step, by scope of application
| Development | Supply | Use |
|---|---|---|
| Development results, defects and retraining decisions | Customer complaints, incidents, market feedback and improvement of the terms of provision | Effects of use, incidents, supplier evaluation and adjustment of the scope of use |
How to operate the management review
ISO/IEC 42001 9.3 requires top management to review the AI management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness. Inputs are gathered (9.3.2) and reviewed at a meeting, and decisions (9.3.3) are grouped into three tracks, corrective action · reflection in next year's business plan · training, and tracked through 15 Nonconformity and Corrective Action, 16 Improvement and the next management review.
Interval, preparation and conduct
- Regular: at least once a yearAd hoc: major legal changes, major incidents, major changes to the organization or business, before a certification audit
- About two weeks before, the department in charge of AI sets the schedule and agenda and obtains top management's approval → notifies attendees and prepares the input data (designate folders and files under "Designating management review input data" below)
- FormatIn-person or video meeting, or partial reviews by division followed by a consolidated report to top management. When held together with other management systems, keep the AI management system agenda and records separate
- ConductOpening → review of input items → discussion → decisions → closing; action items are clearly marked in the minutes, with the person responsible, deadline and required resources
9.3.2 input items: mark missing ones as "incomplete"
| Input item | What to look at | Linked step |
|---|---|---|
| Status of actions from previous management reviews | If this is the first review, "not applicable"; carry unfinished actions forward as continuing actions | Previous minutes |
| Changes in external and internal issues | Changes in AI regulation, technology, organization and business strategy | 1 AI Context Analysis |
| Changes in the needs and expectations of interested parties | Feedback from customers, regulators, employees and AI suppliers; changes in compliance obligations | 1 · 13 Legal Requirements Identification and Monitoring |
| Status (trends) of nonconformities and corrective actions | Number, trends, recurrence, unfinished actions | 15 Nonconformity and Corrective Action |
| Monitoring and measurement results (trends) | AI usage, error rates, performance degradation, KPIs | 9 Operational Control · 11 Monitoring |
| Internal and external audit results | Nonconformities, observations, good practices | 12 Internal Audit |
| Achievement of AI objectives | Objectives, results, achieved or not achieved, and causes | 16 Improvement |
| Changes in the results of AI risk assessment and impact assessment | Changes in high-risk tasks, new risks | 4 · 5 |
| AI incidents and prevention of recurrence | Major incidents and actions | 9 · 13 |
| Performance of external suppliers | Supplier evaluation, contract performance, changes to terms | 6 · 11 |
| Adequacy of resources | Staff, budget, tools, computing, competence | 7 Controls |
| Effectiveness of actions on risks and opportunities | Implementation of the treatment plan, residual risk | 5 AI Risk Assessment |
| Opportunities for continual improvement | Suggestions, observations, improvement recommendations | 16 Improvement |
Output: three tracks
| Track | Content | Passed to |
|---|---|---|
| corrective action | Elimination of the causes of nonconformities and shortcomings: owner, deadline, verification | 15 Nonconformity and Corrective Action |
| Reflection in next year's business plan | Budget, resources, system investment, organization; revision of the AI policy and AI objectives | 16 Improvement · next year's 1 Context Analysis |
| Training | Education and training plan to raise competence and awareness | 7 Controls (competence) · 9 Awareness training |
Viewpoints for judgement
Suitability (fits the purpose, AI policy and AI objectives, and sustains performance with the resources) · adequacy (sufficient to meet the requirements of 42001, interested parties and laws) · effectiveness (achieves the intended results, such as AI objectives and risk treatment) · strategic alignment (integrated into the business strategy).
Responsibilities (example): planning, preparing inputs and minutes: department in charge of AI / chairing, decisions and approval: top management / implementing actions: department heads.
Only the method has been generalized from ISO/IEC 42001 9.3 and operating cases of actual client companies (management review procedures, plans and reports); company names and results are not included.
Next steps
Previous steps: 1 AI Context Analysis · 2 AI Policy, Roles and Objectives · 5 AI Risk Assessment · 9 Operational Control · 11 Monitoring, Change and Revision Control · 12 Internal Audit · 13 Legal Requirements Identification and Monitoring · 15 Nonconformity and Corrective Action · 16 Improvement · 10 Documented Information Control · The results of this step feed into: 1 AI Context Analysis · 2 AI Policy, Roles and Objectives · 5 AI Risk Assessment · 6 AI System Impact Assessment · 7 Control Implementation and Statement of Applicability (SoA) · 15 Nonconformity and Corrective Action · 16 Improvement
