Why Management Review Matters in an AI Management System
ISO 42001 is the international standard for AI management systems (AIMS). Like every standard built on the harmonised structure, it requires top management to periodically step back and evaluate whether the system is still working. That obligation sits in Clause 9.3, and it carries more weight in an AIMS than many organisations initially expect.
On this page
AI systems change. Models drift. Risk profiles shift as use cases expand. Regulatory expectations around AI are moving faster than almost any other compliance area. A management review that simply ticks boxes will not catch these changes. Clause 9.3 is designed to force a genuine, evidence-based conversation at the leadership level about whether the AIMS is still fit for purpose.
This article walks through exactly what Clause 9.3 requires, what inputs management must consider, what outputs the review must produce, and what auditors will be looking for when they assess your management review process. If you are a quality manager, AI governance lead, or compliance professional implementing or auditing an AIMS, this is the clause you need to understand in detail.
The Structure of Clause 9.3
ISO 42001 Clause 9.3 is divided into three subclauses that follow the same pattern used across ISO 9001, ISO 14001, ISO 27001, and other harmonised standards.
- Clause 9.3.1 sets out the general requirement to conduct management reviews at planned intervals.
- Clause 9.3.2 specifies the mandatory inputs that must be addressed during the review.
- Clause 9.3.3 defines the outputs the review must produce.
This structure is intentional. It ensures the review is not just a discussion but a documented, evidence-driven process with decisions attached to it. Auditors will test all three subclauses, and a weakness in any one of them can generate a nonconformity.
Exemplar Global Certified Training ProviderRTP No. 310970
Clause 9.3.1: General Requirements
The general requirement is straightforward. Top management must review the AIMS at planned intervals to ensure it remains suitable, adequate, and effective. Those three words are not interchangeable and auditors will probe each one.
- Suitable means the system still fits the organisation's AI context, including its AI roles, the types of AI systems in use, and the interests of affected parties.
- Adequate means the system has enough structure, resources, and controls to address the risks the organisation faces.
- Effective means the system is actually achieving what it was designed to achieve, including the AI objectives and risk treatment outcomes.
The standard does not prescribe how often management reviews must occur. It says planned intervals. In practice, most organisations conduct them annually at minimum, with some choosing to hold them twice a year if their AI landscape is changing rapidly. If your organisation is actively deploying new AI systems, expanding use cases, or responding to emerging regulation, annual reviews may not be sufficient.
The review must be conducted by top management. This is not a task that can be delegated entirely to a quality team or an AI governance committee and then signed off without engagement. The people who have authority over resources, strategic direction, and organisational objectives need to be present and genuinely involved.
Clause 9.3.2: Management Review Inputs
This is where most organisations run into trouble. The inputs listed in Clause 9.3.2 are mandatory. You cannot conduct a compliant management review by discussing only the items you find comfortable. Every item on the list must be addressed, and you need evidence that it was addressed.
The required inputs under ISO 42001 Clause 9.3.2 are as follows.
Status of Actions from Previous Reviews
Management must start by reviewing what was decided last time and whether those decisions were acted on. This is a basic accountability check. If the previous review identified that the AI risk assessment needed updating and that action is still open twelve months later, that is a problem the review must acknowledge and resolve. Auditors will ask to see the minutes or records from the previous review and will trace those actions forward.
Changes in External and Internal Issues Relevant to the AIMS
This input connects directly back to Clause 4.1, the context of the organisation. Since the last review, has anything changed? New AI regulations, shifts in the competitive landscape, changes in the types of AI systems being used, changes in the organisation's AI roles (whether it is now acting as a provider, producer, or customer of AI), or changes in the risk environment all need to be considered here.
In the AI space, this input is particularly important. Regulatory frameworks around AI are developing rapidly in Australia and globally. The EU AI Act has set a precedent. Australian government guidance on responsible AI continues to evolve. If your organisation has not tracked these changes and fed them into the management review, you are not meeting the intent of this input.
Information on AI Performance and Effectiveness
This is the performance data input. It draws on the outputs of Clause 9.1, which covers monitoring, measurement, analysis, and evaluation. What do the metrics say? Are AI objectives being met? Are the monitoring results showing anything concerning? Have there been incidents involving AI systems? What did the internal audits find?
This input should include results from AI system impact assessments conducted under Clause 8.4, any incidents or near misses involving AI outputs, and the results of ongoing monitoring of AI system behaviour. If your organisation is not measuring AI performance in any meaningful way, this input will be empty, and that itself is a finding.
Adequacy of Resources
Top management must consider whether the AIMS has the resources it needs. This includes people with the right competencies (Clause 7.2 covers AI competence requirements), infrastructure, tools, and budget. If the AI governance team is understaffed, if training has not kept pace with the deployment of new AI systems, or if there are gaps in technical capability, this is where that needs to surface.
Effectiveness of Actions Taken to Address Risks and Opportunities
This input looks back at the risk treatment decisions made under Clause 6.1. Were the controls effective? Did the actions taken to address AI risks actually reduce those risks to an acceptable level? Did the opportunities that were identified get pursued? This is not a theoretical exercise. It requires evidence from monitoring, audit results, and incident records.
Opportunities for Improvement
Management must consider where the AIMS can be improved. This does not require a formal improvement project to be launched at every review. It does require genuine consideration of where the system is underperforming or where there are gaps between current practice and the organisation's AI objectives and policy commitments.
Results of Internal Audits
The findings from internal audits conducted under Clause 9.2 must be presented to top management as part of the review. This is one of the most important inputs because it provides an independent view of how the AIMS is actually functioning, not just how it is documented. Auditors will check that internal audit results are genuinely reflected in the management review record, not just listed as an agenda item that was noted without discussion.
For a deeper look at how internal audits feed into this process, the article on internal audit requirements in ISO 42001 under Clause 9.2 covers the connection in detail.
Relevant Communication from Interested Parties
Feedback, complaints, regulatory correspondence, and other communication from interested parties (including customers, regulators, affected communities, and workers) must be considered. In an AI context, this is increasingly significant. If customers have raised concerns about AI-generated outputs, if a regulator has issued guidance that affects your AI systems, or if workers have flagged concerns about how AI is being used in decision-making, those communications belong in the management review.
Clause 9.3.3: Management Review Outputs
The review must produce decisions and actions. Outputs are not optional and they are not just a summary of what was discussed. The standard requires that the outputs include decisions related to continual improvement opportunities and any need for changes to the AIMS.
In practice, this means the management review record must document:
- Specific decisions made during the review.
- Actions assigned, with owners and timeframes.
- Any changes to the AIMS that have been approved or initiated.
- Resource decisions, including approvals for additional investment in AI governance capability.
- Changes to objectives or targets where performance data indicates these need to be revised.
A management review that produces no outputs is almost certainly non-compliant. If everything is fine and no changes are needed, the review should at minimum document that conclusion with the evidence that supports it. In practice, a genuinely engaged management review of an AI system will almost always identify something that needs attention.
The article on management review of an ISMS under Clause 9.3 provides a useful comparison, since the structure and intent are very similar and many organisations are managing both an ISMS and an AIMS in parallel.
What Makes an AI Management Review Different
If you have run management reviews under ISO 9001 or ISO 14001, the structure of Clause 9.3 in ISO 42001 will feel familiar. But there are several features of the AI context that make the review more demanding in practice.
AI Systems Change Without Human Intervention
A quality management system does not change on its own. An AI system can. Machine learning models drift over time as the data they encounter in production differs from the data they were trained on. An AI system that was performing well six months ago may be producing subtly different outputs today. Management reviews need to account for this. The performance monitoring inputs to the review must include evidence of ongoing model monitoring, not just incident reports.
The Regulatory Environment Is Unstable
At the time ISO 42001 was published, the global regulatory landscape for AI was still forming. It continues to evolve. Management reviews under ISO 42001 need to actively track regulatory developments and assess their implications for the AIMS. This is a more dynamic task than tracking changes to environmental legislation under ISO 14001, where the legal framework is relatively stable.
Impact Assessments Must Be Revisited
ISO 42001 introduces the concept of AI system impact assessments, which are addressed under Clause 8.4. These assessments evaluate the potential impacts of AI systems on individuals, groups, and society. The management review is an appropriate forum to consider whether previously completed impact assessments remain current and whether new impact assessments are needed for AI systems that have changed or expanded in scope.
Organisational AI Roles Can Change
An organisation might start as a customer of AI systems and later become a producer or provider. These role changes have significant implications for the AIMS, including the applicable Annex A controls and the scope of the impact assessment obligations. Management reviews should explicitly check whether the organisation's AI roles, as defined under Clause 4.1, have changed since the previous review.
What Auditors Will Check
When an auditor assesses your management review against Clause 9.3, they will be looking for several things.
- Evidence that the review was conducted at a planned interval and that top management was genuinely involved.
- Records showing that every mandatory input was addressed, not just listed on an agenda.
- Documentation of the decisions and actions that resulted from the review.
- Traceability from previous review outputs to current review inputs, showing that assigned actions were followed up.
- A connection between the review outputs and the organisation's AI objectives and continual improvement activities.
The most common nonconformity in this area is a management review that covers the agenda items superficially. The minutes show that internal audit results were presented, but there is no record of what management decided in response. Or the review notes that AI objectives were discussed, but there is no record of whether they were met and what the response was to any shortfall.
Another frequent issue is a review that was clearly prepared by the quality or compliance team and signed off by a senior manager without genuine engagement. Auditors will probe this by asking management representatives what they discussed, what concerned them, and what decisions they made. If they cannot answer those questions, the review does not meet the intent of the clause.
For those preparing to conduct or commission an AIMS management review, the article on auditing management review inputs, outputs and evidence provides practical guidance on what to look for and how to gather it.
Practical Tips for Running an Effective AIMS Management Review
Getting the management review right is not complicated, but it does require preparation and genuine engagement from leadership. Here are some practical steps that work in practice.
Prepare a Pre-Review Package
Circulate a summary of all mandatory inputs to participants before the meeting. This should include the internal audit results, performance metrics, status of previous actions, a summary of relevant regulatory developments, and any incident or near miss data. Participants who arrive without this information will not be able to contribute meaningfully.
Structure the Agenda Around the Mandatory Inputs
Do not run a general discussion and then try to map it to the standard afterwards. Build the agenda directly from Clause 9.3.2. Each mandatory input should be a named agenda item with a responsible presenter and an allocated time.
Assign Actions in the Room
Do not leave the review without assigning specific actions, owners, and completion dates. Vague commitments to improve things do not constitute outputs under Clause 9.3.3. Every action should be specific enough to be verifiable at the next review.
Keep Meaningful Records
The minutes or record of the management review is documented information that must be retained under Clause 7.5. It needs to capture what was discussed, what evidence was presented, what decisions were made, and what actions were assigned. A one-page summary will not satisfy an auditor. Neither will a verbatim transcript that buries the decisions in discussion. Aim for a record that clearly shows what was decided and why.
Connect the Review to the Improvement Process
The outputs of the management review should feed directly into the organisation's continual improvement activities under Clause 10.1. If the review identifies that the AI risk assessment needs updating, that action should be tracked through the same corrective action or improvement process used for other AIMS activities.
Exemplar Global Certified Training ProviderRTP No. 310970Linking Management Review to the Broader AIMS
Clause 9.3 does not operate in isolation. It is connected to almost every other part of the AIMS. The inputs draw on Clauses 4.1, 6.1, 8.4, 9.1, and 9.2. The outputs feed into Clauses 6.2, 7.1, and 10.1. A management review that is genuinely integrated into the AIMS will reflect this. One that treats the review as a standalone compliance exercise will produce outputs that are disconnected from the rest of the system.
If you are working through ISO 42001 clause by clause, the article on monitoring and measuring AIMS performance under Clause 9.1 covers the performance data that feeds directly into the management review inputs.
Training for Auditors and Implementers
Understanding what Clause 9.3 requires is one thing. Knowing how to audit it, or how to build a management review process that will satisfy an auditor, requires practical knowledge of how the standard works as a whole. Audit Workshop delivers ISO 42001 training at the Foundation, Internal Auditor, and Lead Auditor levels, covering the full clause structure including the performance evaluation requirements in Section 9. The courses are built around real audit scenarios, not just clause summaries, and are delivered by a lead auditor with direct experience conducting ISO certification audits. If you are preparing to implement, audit, or certify an AIMS, the training is worth looking at before you get to the review table.
