ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 42001 management review is the meeting where top management proves it actually runs the AI management system. It is also one of the first records an auditor asks for, because it shows whether leadership is involved or merely signing documents.
Most teams get it wrong in a predictable way. They hold a short call, read out some numbers and file a slide deck. The clause asks for more: structured inputs, decisions about improvement and a record of both.
This guide gives you the inputs clause 9.3 expects, an agenda you can reuse and the minutes that satisfy an auditor. For the wider evaluation clause, see clause 9 performance evaluation.
Free gap assessment
How much of ISO 42001 could you evidence today?
Score every clause and Annex A control of the AI management standard, free, and see where the programme really sits.
Run the free ISO 42001 gap assessment → or View premium report sample
Top management must review the AI management system at planned intervals to confirm it remains suitable, adequate and effective. The standard does not fix a frequency, so you choose one that fits your risk and state it in your procedure.
Most organizations review at least once a year, and many hold a lighter quarterly session during the first year of operation. If you are new to the system, more frequent reviews give you better evidence and catch problems earlier.
The clause is split into three parts: a general requirement in 9.3.1, the inputs in 9.3.2 and the results in 9.3.3. Evidence of the results must be kept as documented information.
The authoritative text sits in ISO/IEC 42001:2023, and quoting the clause in your procedure keeps the wording honest.
Treat each ISO 42001 management review as a decision meeting. If nothing is decided, the standard is not being met.
Prepare a pack before the meeting. It should cover the status of actions from previous reviews, changes in external and internal issues relevant to the AI management system and changes in the needs and expectations of interested parties.
It should also report performance: trends in nonconformities and corrective actions, monitoring and measurement results and audit results. Your internal audit findings feed straight in.
Add the items specific to AI that your risk work produces: significant incidents, changes in the AI system inventory, new regulation and the status of impact assessments. The AI risk assessment gives you the risk trend.
Free AI risk assessment
Which of your AI systems could harm people, or you?
List your AI systems, models and data, pick from 38 AI risk scenarios, rate them for the people affected and for you, and plan treatment with ISO 42001 Annex A controls. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free AI risk assessment → or View premium report sample
Ask each owner to deliver their section a week before the meeting. A late ISO 42001 management review pack produces shallow discussion and weak minutes.
Open with attendance and apologies, then actions from the last review. Move to context changes, interested-party feedback and AI objectives progress. Then cover audit results, nonconformities and incidents.
Continue with risk and impact assessment updates, resource needs, and improvement opportunities. Close with decisions and actions, each with an owner and a date.
Keep the agenda fixed from review to review. A stable structure makes trends visible and tells the auditor the process is repeatable.
Our toolkit includes an agenda and minutes template, so you can start with the ISO 42001 Toolkit and adapt it to your cycle.
| Input (clause 9.3.2) | Typical source | Evidence to keep |
|---|---|---|
| Status of previous actions | Action log | Closed and open items |
| Changes in issues and interested parties | Context register | Updated register |
| Nonconformities and corrective actions | Corrective action log | Trend summary |
| Monitoring and measurement results | AI metrics and objectives | KPI report |
| Audit results | Internal and external audits | Audit reports |
Top management must take part, because clause 5 gives them accountability for the system. That usually means the chief executive or equivalent, plus the heads of technology, risk, legal and the AI governance lead.
The management representative or AI governance lead prepares the pack and takes minutes. Technical staff attend for specific items, then leave. Do not fill the room with people who do not decide anything.
If the right executives cannot attend, move the date. A review without top management is a weak record, and auditors notice who actually signed the minutes.
Rotate the chair only if it helps engagement; the accountable executive should still approve the outcomes.
Clause 9.3.3 requires results that include decisions related to continual improvement opportunities and any need for changes to the AI management system. Write those decisions as actions, not as discussion notes.
Capture resource decisions too. If management approves a new monitoring tool or an extra headcount for the governance team, record it. This is direct evidence that leadership supports the system.
Link every action to your corrective action log under clause 10 improvement, so each decision has a visible owner and closure date.
Resist the urge to record everything that was said. Auditors want decisions, owners and dates, not a transcript.
Minutes should be short and specific: date, attendees, inputs reviewed, decisions, actions with owners and due dates, and approval. One to three pages is enough.
Avoid minutes that only say inputs were noted. An auditor reading that will ask what management decided. Show at least a few concrete decisions, even if the system is healthy, such as approving the next audit plan or the objectives for the coming year.
Sign and date the minutes, and store them with the review pack in your document control system.
Management review sits at the centre of the plan, do, check, act loop. Objectives set under clause 6 are measured under clause 9.1, tested by audit under 9.2 and reviewed here under 9.3. Decisions then flow into clause 10.
That is why a good ISO 42001 management review reads like a summary of the whole system. If an input is missing, a part of the system probably is too. Our guide to clause 6 planning shows where the objectives originate.
Also connect it to the AI policy. If the review finds that the policy no longer fits your systems or regulation, the decision to revise it belongs in the minutes.
The usual findings are missing inputs, no evidence of top management attendance and no link between actions and the corrective action process. Another is holding the first review after the Stage 2 audit has already started.
Hold at least one full review before Stage 2. Certification bodies expect to see the system operating, and a completed ISO 42001 management review is part of that evidence. Our certification timeline shows where it fits.
Do not wait until the internal audit is finished to plan the review. Schedule both early so the audit results arrive in time to be an input.
Expect the auditor to ask for the last review pack, the minutes and the action log. They will pick two or three actions and ask to see closure evidence.
They may also interview a member of top management. Be ready for questions such as what the biggest AI risk is today and what changed since the last review. Executives who attended and read the pack answer easily.
Keep the evidence together in one folder. A tidy ISO 42001 management review record shortens the audit and creates confidence early.
In week one, fix the date, confirm attendees and draft the agenda. In week two, collect inputs from the owners: audit results, objectives, incidents, risk changes and supplier issues.
In week three, assemble the pack and send it to attendees. Ask for questions in advance, so the meeting can focus on decisions. In week four, hold the meeting, record the minutes and log the actions.
After the meeting, schedule the next one and add the actions to your tracker. A simple routine repeated on schedule beats an elaborate process that happens once.
The best reviews ask hard questions. Are our AI objectives still the right ones? Which system worries the team most? Which supplier would cause the most damage if it failed?
Bring one or two real cases to each meeting, such as an incident or a near miss, and walk through how the system handled it. Cases make the data real and give executives something to decide on.
Finish by asking whether the organization has the resources it needs. Honest answers here prevent the last-minute scramble before surveillance audits, and they show the leadership commitment that clause 5 requires.
At planned intervals that you define. Annual is the common minimum, and quarterly is wise in the first year. State the frequency in your procedure and follow it.
Yes. Many organizations hold one meeting covering several standards, provided the AI inputs and decisions are clearly separate in the pack and the minutes.
No. A video call is fine. What matters is that top management took part, reviewed the required inputs and made recorded decisions.
The AI governance lead or management representative usually prepares it. Top management approves it, because the decisions belong to them.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026