ISO/IEC 42005:2025 5.12 Monitoring and review

The organization should set and document how assessments are monitored and revised: how often (on a schedule, in response to trigger events, or both), who is responsible, and what the monitoring and review involve. Review outputs should include decisions on opportunities for continual improvement and needed changes in how assessments are planned and performed, changes to risk assessment and risk treatment processes, changes to the objectives for using AI, and changes to the thresholds used to rank impacts for sensitive or restricted uses.