ISO 42001 Management Review: Where Leadership Steers the System

A management review is where an AI management system either gets steered or quietly drifts. Clause 9.3 of ISO 42001 puts that steering in the hands of top management, at planned intervals, and it is the one requirement that stops leadership from treating AI governance as someone else's job.

In plain terms, Clause 9.3 asks the people who run the organization to sit down periodically, look at how the AI management system is actually performing, and make decisions about it. It is the governance checkpoint that keeps the system from decaying between certification cycles, and it is the same mechanism found across management system standards, which you can see described in overviews of ISO management system standards.

This guide from the AI Governance Certification Institute (AIGCI) explains what the review must examine, what it has to produce, who has to be in the room, and how often, and ends with an agenda you can copy. The theme throughout is that a management review is a decision-making meeting, not a status update.

What Clause 9.3 Requires

Clause 9.3 requires top management to review the AI management system at planned intervals to make sure it remains suitable, adequate, and effective. Three words carry the whole requirement, and each is a distinct test.

The review is explicitly a top-management responsibility, not something that can be delegated to the implementer and signed off later. The point is that the people with the authority to change the organization's direction and allocate its resources are the ones looking at whether the AI governance is working, because they are the only ones who can act on what they see.

The Three Questions a Management Review Answers

Suitability, adequacy, and effectiveness are not interchangeable. Each asks leadership a different question about the system.

• Suitability. Does the AI management system still match the organization's AI strategy, risk profile, and ethical commitments, or has the business moved on while the system stood still?

• Adequacy. Are the resources, people, data processes, and tools sufficient to govern AI responsibly, or is the system under-resourced for what it is being asked to do?

• Effectiveness. Is the system actually achieving its intended outcomes, such as risk reduction, fairness, and transparency, rather than just existing on paper?

A review that answers all three honestly tells leadership whether to invest more, change direction, or stay the course. A review that skips them produces a signature and nothing else.

The Agenda: What the Review Must Consider

The standard specifies the inputs a management review has to take in, so the agenda is largely written for you. It mirrors other ISO standards but carries a distinctly AI-specific focus on fairness, impact, and risk. Copy the agenda below as your starting template.

Items three through five are where the rest of the system reports in: the internal audit results, the monitoring data, and the open nonconformities all land on this agenda. That is by design, because the management review is where the evidence the organization has been gathering finally gets acted on.

Preparing the Inputs: Who Gathers What

A review only works if the inputs arrive ready, so most of the real effort happens before anyone sits down.

In practice the implementer or governance lead compiles the package: internal audit results from the auditor, monitoring and measurement data from system owners, the open nonconformity and corrective action log, feedback from stakeholders and affected groups, and the current status of risk and impact assessments. Leadership should receive this ahead of time, so the meeting is spent deciding rather than reading. A review where the inputs are assembled in the room is one that runs out of time before it reaches the decisions, which are the part the standard actually requires.

The Outputs: Decisions, Not Discussion

A management review that produces only minutes of a conversation has failed the requirement. The clause demands outputs, and they have to be concrete:

• Improvement decisions. What the organization will do about the opportunities and problems the review surfaced.

• Changes to the system. Any needed changes to the AIMS scope, policy, or objectives, including fairness, accountability, and explainability targets.

• Resource decisions. Budget, tools, team expansion, or specialized training the system needs.

• Documented records. Minutes and decisions retained as evidence, which an external auditor will ask to see.

Those decisions are the fuel for continual improvement, which is the clause that turns a review's conclusions into actual change. A review without decisions starves the improvement cycle of everything it needs.

Who Attends, and How Often

Two practical questions decide whether a review carries real weight: who is in the room, and how regularly they meet.

Top management must be present, because the review's authority comes from the fact that the people who can act are the ones reviewing. In practice the implementer or governance lead prepares the inputs and presents them, risk and system owners attend for their areas, and leadership makes the decisions. On frequency, the standard says planned intervals rather than a fixed number; most organizations review at least annually, but a fast-moving AI portfolio or a shifting regulatory landscape justifies reviewing more often, because a year is a long time in AI.

How to Run an Effective Management Review

The difference between a review that steers and one that rubber-stamps is in how it is run. Five habits keep it useful:

• Circulate the inputs first. Give leadership the package in advance so the meeting is for decisions, not briefing.

• End every item in a decision. Each agenda point should close with a decision, a confirmed action, or an explicit no change.

• Assign owners and dates. Decisions without an owner and a deadline are suggestions, not commitments.

• Record as you go. Capture minutes and decisions in the meeting, because they are the evidence an auditor will ask for.

• Close last time first. Open by checking the previous review’s actions, so nothing quietly lapses between cycles.

How the Review Fits the Rest of the Standard

The management review is not a standalone meeting; it is the hinge between checking the system and improving it. The inputs flow in from performance evaluation, the monitoring and audit activity, and the outputs flow out into improvement and corrective action. Seen across clauses 4-10, it is the point where leadership closes the loop: the system reports its state upward, and direction and resources flow back down. It is the same review mechanism found across the ISO 9000 family and every modern management system standard, applied here to AI.

That position is why auditors treat the management review as a signal of whether governance is real. A thin, irregular review with no decisions tells an auditor that leadership is not genuinely engaged, no matter how good the documents below it look.

What to Put in the Management Review Record

The minutes are the evidence, so the record needs to capture more than who attended. A thin note that a review happened is the version auditors distrust most.

A useful record states the date, who attended, and the interval since the last review, then each input considered and the decision taken on it, with an owner and a due date for every action, and a clear conclusion on whether the system remains suitable, adequate, and effective. The test an auditor applies is simple: could someone who was not in the room reconstruct what was decided, why, and whether those decisions were carried out. A record that passes that test proves the review was real and mattered. A single line saying a review took place proves only that a meeting was held, which is not the same thing, and it is exactly the gap a surveillance audit is built to expose.

Common Management Review Mistakes

A few failures turn the review from a steering function into a ritual:

• No top management in the room. Delegating the review to the implementer, which strips it of the authority that makes it meaningful.

• Discussion without decisions. Talking through the inputs but producing no concrete actions, changes, or resource commitments.

• Skipping the hard inputs. Reviewing performance but ignoring stakeholder feedback, impact assessments, or fairness concerns.

• No records. Holding the review but not retaining the minutes and decisions an auditor will ask for.

• Reviewing too rarely. Meeting once a year out of habit when the AI portfolio changes every quarter.

Frequently Asked Questions

What Is a Management Review in ISO 42001?

It is a periodic, top-management evaluation of the AI management system required by Clause 9.3, checking whether the system remains suitable, adequate, and effective. The review takes in defined inputs such as audit results and stakeholder feedback, and it must produce decisions on improvement, changes, and resources, all retained as records.

Who Must Attend the Management Review?

Top management must take part, because the review's purpose is to have the people who can allocate resources and set direction evaluate the system. The implementer or governance lead typically prepares and presents the inputs, and risk and system owners attend for their areas, but leadership has to be in the room and making the decisions.

How Often Should the Management Review Happen?

At planned intervals, which the standard does not fix to a number. Most organizations review at least once a year, but a rapidly changing AI portfolio or regulatory environment justifies reviewing more frequently. The test is whether the interval keeps leadership genuinely aware of the system's state, not whether a box was ticked annually.

What Are the Required Inputs and Outputs of the Review?

The inputs include actions from previous reviews, changes in context, performance data such as nonconformities and monitoring and audit results, stakeholder feedback, and the status of risk and impact assessments. The outputs are decisions on continual improvement, any changes to the system, resource allocations, and the documented minutes that record them.

What Is the Difference Between a Management Review and an Internal Audit?

The internal audit gathers evidence about whether the system conforms and actually works; the management review is where leadership considers that evidence and decides what to do about it. The audit is the check, the review is the act, and the audit feeds the review. They are sequential parts of the same loop rather than alternatives, which is why an audit with no management review to act on its findings leaves the loop open.

Is the Management Review Mandatory?

Yes. Clause 9.3 is a requirement, and a certification audit will look for evidence that genuine management reviews are happening and producing decisions. A missing or hollow management review is a common finding, because it signals that leadership is not actually governing the AI the documents describe.

Make the Review Worth Holding

A management review is only as valuable as the decisions it produces, and leading one well takes an understanding of what the inputs mean and what good governance decisions look like. That judgment is built through training. You can see every route through the ISO 42001 courses, with the implementer path taught clause by clause in the Lead Implementer certification, so your management review steers the system rather than rubber-stamping it.