ISO/IEC 42001:2023
Annex A AIMS controls - A.2 Policies related to AI

ISO/IEC 42001:2023 A.2.4: Review of the AI policy

Review the AI policy at planned intervals, and additionally when needed, so it stays suitable, adequate and effective.

Maintained by Gerard BlokdykControl text last updated

What else in your programme already covers this

This control maps to 10 controls across 9 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27001:2022 · 2 controls

  • 5.1 Policies for information security
  • 5.35 Independent review of information security

ASEAN Guide on AI Governance and Ethics · 1 control

  • AIGE-IG-5 Periodic review of the governance model

BCBS 239 · 1 control

  • BCBS239-P12 Review

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

EU AI Act · 1 control

ISO 27002:2022 · 1 control

  • 5.1 Policies for information security

NIST AI Risk Management Framework (AI RMF 1.0) · 1 control

  • AIRMF-GV-1.5 Ongoing monitoring and periodic review of the risk management process and its outcomes are planned, organizational roles and responsibilities are clearly defined, including determining the frequency of periodic review

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-GV.PO-02 Policy for managing cybersecurity risks is reviewed, updated, communicated, and enforced to reflect changes in requirements, threats, technology, and organizational mission

PCI DSS 4.0 · 1 control

  • 12.1.2 12.1.2 Security policy reviewed annually and updated as needed

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in Annex A AIMS controls - A.2 Policies related to AI

You are reading one control. How much of ISO/IEC 42001:2023 have you already done?

ISO/IEC 42001:2023 A.2.4 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of ISO/IEC 42001:2023 your existing evidence covers. Hold NIST AI Risk Management Framework (AI RMF 1.0) and 30 of 38 ISO/IEC 42001:2023 controls already carry evidence.

If you hold NIST AI Risk Management Framework (AI RMF 1.0)78.9% covered · 8 gapsIf you hold EU AI Act57.9% covered · 16 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the NIST AI Risk Management Framework (AI RMF 1.0) pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 10 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ISO/IEC 42001:2023 controls