Purpose & timing

ISO 42001 Clause 9.3 requires top management to review the AIMS at planned intervals to ensure its continuing suitability, adequacy and effectiveness. The review must confirm that AI risk controls remain effective and aligned with strategic objectives and legal requirements.

• Frequency: At least annually and after major incidents, significant AI changes or audit cycles.
• Chair: Authorising Officer or Managing Director.
• Coordinator: AIMS Manager (prepares inputs and minutes).
• Outputs: documented decisions, action plans, resource adjustments.

Inputs to management review

• Results of internal and external audits.
• Risk register updates and treatment status.
• Post-market monitoring data and incident summaries.
• Effectiveness of CAPA actions and training programmes.
• Stakeholder feedback, complaints, regulatory queries.
• Changes in laws (EU AI Act, UK AI Principles, ICO guidance).
• Supplier performance and third-party audit results.

Meeting agenda & roles

1. Opening & objectives confirmation.
2. Review of previous actions and CAPA status.
3. Review of AIMS objectives and KPIs vs targets.
4. Risk register updates and new/emerging risks.
5. Incidents & post-market monitoring outcomes.
6. Supplier & third-party performance.
7. Training & competence metrics.
8. Resource adequacy (budget, staffing, tools).
9. Improvement actions & assignments.
10. Summary & sign-off by Authorising Officer.

Core AIMS performance metrics (KPIs)

KPIs measure how well the AIMS achieves its policy objectives and risk tolerances. They must be evidence-based and aligned to strategic goals.

• Risk controls: % of controls implemented vs planned.
• Incident frequency: number per 1000 AI transactions.
• Bias/fairness index: ratio of outcome variance vs threshold.
• Human intervention rate: % of decisions requiring manual override.
• CAPA closure time: median days to closure.
• Training coverage: % of staff with current certification.
• Supplier conformance: % vendors with active DD review.

Trend analysis & dashboards

• Visualise incident rates over time segmented by AI system and severity.
• Use RAG (KPI status vs threshold) dashboards for Board reporting.
• Correlate risk treatment completion with incident reductions.
• Track training coverage vs audit NCs to validate competence impact.

Outputs & records

• Minutes with decisions, responsibilities, deadlines.
• Updated AIMS objectives and KPIs.
• Action register with owner and due date.
• Evidence attachments (audit summaries, KPI exports).
• Approval by Authorising Officer and distribution to stakeholders.

Continual improvement & CAPA

• Each review identifies improvement opportunities linked to root-cause trends.
• Prioritise actions by risk and regulatory impact.
• Feed new objectives into the next plan–do–check–act cycle.

Board & stakeholder reporting

• Quarterly AIMS performance pack to Board & Oversight Forum.
• Include heat map of risks, KPI trends, CAPA progress, supplier status.
• Summarise regulatory changes and preparedness status.

Tools & templates

Date: 2025-11-20  
Chair: Authorising Officer  
Attendees: AIMS Manager, Privacy Lead, Security Lead, POs  
Agenda: KPI Review, Risk Register Update, CAPA Progress  
Decisions:
  1. Add fairness drift KPI to monthly dashboard.  
  2. Commission supplier audit Q1 2026.  
  3. Increase training budget for Human Oversight team.  
Actions: Owner, Deadline, Evidence Link.  
  

KPI examples by clause

Common pitfalls & mitigation

• No evidence of review: Minutes missing decisions → use template with sign-off.
• KPIs too broad: Add quantitative thresholds and trends.
• Actions unclearly tracked: Link to CAPA register with owner and deadline.
• Reactive only: Introduce predictive metrics (early-warning KPIs).

Implementation checklist

• Management Review conducted and documented annually.
• Inputs collected from risk, audit, incidents, suppliers, and training.
• KPI dashboard maintained and validated.
• Outputs recorded with actions and deadlines.
• Evidence archived and accessible for audits.
• Improvement plan reviewed quarterly.

© Zen AI Governance UK Ltd • Regulatory Knowledge • v1 08 Nov 2025 • This page is general guidance, not legal advice.