Control A.2.4: Review of the AI policy
Review the AI policy at planned intervals, and additionally when needed, so it stays suitable, adequate and effective.
What control A.2.4 asks
Review the AI policy at planned intervals, and additionally when needed, so it stays suitable, adequate and effective.
Why it matters for privacy
A policy written once and never reviewed will still describe last year's model, last year's supplier and last year's law. The review date is part of the control.
Where the draft lands: the review is the evidence that the record is current. The draft is still moving. A policy that is reviewed on a fixed interval is how an organization keeps pace without rebuilding the system each time a stage changes.
Basis for A.2.4: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The public record supports the point at the level of the abstract; the draft text is not public. Evidence, review and the date.
Evidence for control A.2.4
These are the records that turn the control from a statement into something checkable. For control A.2.4 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- AI policy Policy review schedule and review records
- AI policy Named management-approved role responsible for the policy
- AI policy Evidence management review results fed the policy review
Where control A.2.4 commonly fails
- Policy unchanged since issue despite new AI uses or law
- No owner for the policy
What to do about control A.2.4 before the draft lands
Set a review interval and a trigger list: a new model, a new data source, a change of purpose, a regulator decision or a published edition of the standard. Record the review even when nothing changed.
The certificate, if you hold one, is against ISO/IEC 42001:2023. Control A.2.4 is where the privacy work lands, and it is auditable before the draft is published.
Read across from control A.2.4
- Control A.6.2.3, Documentation of AI system design and development
- Control A.6.2.7, AI system technical documentation
- Control A.8.5, Information for interested parties
← Control A.2.3 | Control A.3.2 →
Open the full index. The public record behind control A.2.4 shows the scope and the lifecycle.
The record behind control A.2.4 is the ISO/IEC 42001:2023 Annex A set, retrieved 22 October 2026. The public 27091 abstract supplies the privacy direction, not a draft requirement. Check the sources.