Periodic AI review and recertification

What it does

It brings every system back for a decision on whether it should continue. On a fixed cycle the owner confirms that the system is still used as approved, still performs, is still correctly tiered and still has working controls, and the approving authority renews, conditions or withdraws approval. The system owner carries out the review and the governance function runs the calendar. The cycle is set by tier, with the highest tiers reviewed at least annually.

How to implement it

• Set the review frequency for each tier.
• Use a standard checklist: actual against approved use, performance, incidents, changes, open findings, supplier position and regulatory class.
• Require evidence, not attestation alone, for higher tiers.
• Record the outcome as renewed, renewed with conditions, or withdrawn.
• Make approval expire when a review is overdue, and escalate.
• Use the review to retire systems nobody still needs.

Evidence it operates

Design: a review procedure with frequencies and checklist. Operation: a review calendar with completion status; review records and decisions; examples of conditions imposed or systems withdrawn; reporting of overdue reviews.

Where it fits

Recurs through operation as the lifecycle's standing checkpoint. It supports the AI system lifecycle controls gap, use beyond validated scope and AI model drift and degradation by catching what event-driven controls missed, and it complements AI change management, which acts only when a change is declared.

Limits

A review on a calendar finds problems late, up to a full cycle after they began. Reviews done by the owner alone tend to confirm the present position. A lapsed approval has force only if someone is prepared to switch the system off. It is a backstop to monitoring and change control and cannot replace either.