Is annual review enough?

It depends entirely on how fast what you run changes. Annual is the most common convention and is a reasonable starting point for a stable environment, but it is a convention rather than a standard, and in an environment where vendors ship AI features continuously it will describe the past for most of the period it covers.

Who should do the review?

Somebody who can see practice rather than only the document, which usually means whoever fields the questions about the tools. Where a review is done entirely by whoever wrote the policy, it tends to confirm the policy rather than test it, because they are the reader least likely to notice an assumption.

Does a review have to produce a change?

No, and a review concluding that nothing needs changing is a real outcome worth recording as one. What makes it evidence rather than a formality is that the record says what was checked, not only that a review happened.

Is this legal advice?

No. This describes how organizations set a review interval and what commonly decides it. Whether any rule or contract requires a particular frequency of you, and what it requires, is a question for a qualified adviser who knows your circumstances.

How often should you review an AI policy?

The right interval is derived from how fast the thing being described changes, not from a convention. An organization whose vendors ship AI features every month has a shorter honest interval than one running a system that has not changed in a year. What matters more than the number is whether the interval you set was held: a policy reviewed on a slipping annual cycle is in better condition than one on a quarterly cycle nobody has run. Where a review frequency is required of you, it is required by the rule or contract that requires it rather than by any practice described here. This page describes how organizations derive an interval and what commonly decides it. It is not legal advice.

Derive the interval from what moves

Three things move underneath an AI policy. Vendors ship features and change defaults. What people use the tools for expands, usually without a decision anybody would recognize as one. And the external expectations the policy was written against shift.

The first two are observable in your own organization and are the ones to set the interval from. If a tool in your inventory changed materially twice last year, an annual review will describe the tool as it was for most of the period it covers.

There is a second, more useful trigger that has nothing to do with a calendar: a review prompted by an event. A new tool adopted, a change of use, a vendor feature appearing. Calendar reviews catch drift late by design, because they are scheduled against a date rather than against a change.

The interval matters less than whether it was held

A schedule nobody kept is a plan, and a plan describes intentions rather than what happens in an organization. This is why a held annual cycle beats an unheld quarterly one: the held one is evidence of a process, and the unheld one is evidence of an ambition.

It is also why a record with a missed review noted in it reads better than an unbroken run of perfect ones. The second is what a reconstructed record looks like, and a reviewer who has read a few of these knows that.

The cheap version of this control is a review date on the artifact itself and somewhere that a passed date becomes visible. Neither costs anything, and together they are most of the difference between a document that gets revisited and one that does not.

What a review should actually check

Whether the policy still describes what people do. This is the one that decays fastest and the one a review most often skips, because it requires looking at practice rather than at the document.

Whether the systems named still exist, still do what the policy says, and are still the whole list. Whether anything was adopted that nobody logged.

Whether the named accountable people are still here and still hold those roles. Whether anything closed since the last review has stayed closed.

And whether the last review's changes were actually made. A review that produces actions and no follow-up is a meeting.

Common questions

Is annual review enough?: It depends entirely on how fast what you run changes. Annual is the most common convention and is a reasonable starting point for a stable environment, but it is a convention rather than a standard, and in an environment where vendors ship AI features continuously it will describe the past for most of the period it covers.
Who should do the review?: Somebody who can see practice rather than only the document, which usually means whoever fields the questions about the tools. Where a review is done entirely by whoever wrote the policy, it tends to confirm the policy rather than test it, because they are the reader least likely to notice an assumption.
Does a review have to produce a change?: No, and a review concluding that nothing needs changing is a real outcome worth recording as one. What makes it evidence rather than a formality is that the record says what was checked, not only that a review happened.
Is this legal advice?: No. This describes how organizations set a review interval and what commonly decides it. Whether any rule or contract requires a particular frequency of you, and what it requires, is a question for a qualified adviser who knows your circumstances.

Find out where you stand

The assessment on this site asks up to 24 questions about what makes your evidence stop being reproducible, and returns a score, a verdict and, where a control is short, the one thing to fix first. It names no framework, it takes about ten minutes, and where nobody outside asks, the two questions about somebody else's deadline and somebody else's reader are dropped rather than scored against you.

It is a self-assessment of whether what you can show today would still be showable later, not an audit, not a certification, not a conformity assessment and not legal advice. It says nothing about whether the practice it describes is adequate.

Run the assessment