Organizational Policy Reviews

[All Actors]
1. Review AI- and cloud-related policy, procedure and governance document at least annually or immediately after a material change (new model, regulation, technology, acquisition).

2. Align policies with current industry standards, ethical-AI guidelines and applicable regulations (data quality, transparency, bias mitigation, security).

3. Run a documented change-management process for policy updates, including stakeholder notification, approval and version control.

4. Maintain a central repository or dashboard that tracks policy status, next-review dates and outstanding actions; grant stakeholders read access.

5. Trigger interim reviews from continuous-monitoring signals (for example, model-drift alerts, incident post-mortems, new threat intel) so that policies evolve with operational risk.

6. Provide periodic training or awareness sessions so staff understand updated responsibilities for responsible-AI, privacy and security.

1. Policy Examination
a. Verify that the organization maintains a documented inventory of internal policies and associated procedures relevant to the operation, security, and governance of AI-enabled cloud services and infrastructure.
b. Confirm that the organization has defined which policies are considered "relevant" for AI infrastructure, model hosting, training pipelines, customer-facing AI services, and shared responsibility environments.

2. Policy Assessment
a. Verify that policies and procedures are reviewed at least annually, with documented version control, timestamps, and evidence of formal review and approval.
b. Confirm that designated policy owners (e.g., platform governance leads, compliance officers) are accountable for conducting reviews and that governance bodies (e.g., risk committees or AI oversight boards) are involved in approvals where applicable.

3. Review Process Evaluation
a. Determine whether the organization has established criteria for identifying substantial changes (e.g., platform upgrades, introduction of new AI services, or revised SLAs that affect customers) that may require out-of-cycle policy reviews.
b. Verify that the organization has a documented process to initiate policy reviews in response to such changes, and that it includes notification and escalation procedures where customer-facing impacts are expected.

4. Implementation Validation
a. Inspect records of the organization's policy reviews to confirm that the annual review cycle is in place and that policies tied to AI operations (e.g., tenant isolation data handling, model serving) reflect current practices.
b. Examine a sample of recent substantial changes (e.g., changes to model deployment processes, updates to infrastructure automation) and validate that associated policies and procedures were reviewed and updated as a result.

From CCM:
1. Examine the policy and/or procedures related to the Enterprise Risk Management (ERM) program to determine if the organization reviews these documents at least annually or when a substantial change occurs within the organization.
2. Confirm that Policy reviews have taken place in compliance with the organization's review requirements and that any exceptions identified are investigated and remediated.