Strategy & Value ยท STR-08
Strategy review cycle
The AI strategy is reviewed on a set cycle and whenever defined triggers occur, and each change is recorded with its reason.
Why it matters
A strategy written for one state of the technology and the rules will be wrong within a year or two. A fixed cycle keeps it current, defined triggers catch changes that cannot wait, and a change record lets people see why direction shifted.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | The strategy is not reviewed once written, or is rewritten only when leadership changes. |
| 2 Developing | Reviews happen, but irregularly, without defined triggers, or without a record of what changed and why. |
| 3 Defined | The AI strategy is reviewed by its owner on a set cycle and when defined triggers occur, and each change is recorded with its reason. |
| 4 Managed | Reviews draw on measured evidence such as value achieved, risk and incident trends and horizon scanning, and actions from each review are tracked to completion. |
| 5 Optimising | The review cycle and triggers are themselves adjusted from experience, so the strategy is updated at the pace the organisation needs. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- STR-08.1 The AI strategy has a set review cycle.
- STR-08.2 Defined triggers, such as major regulatory, technology or organisational change, prompt a review outside the cycle.
- STR-08.3 Each review is carried out by the strategy's owner.
- STR-08.4 Changes to the strategy are recorded with their reasons.
Assessment questions
- When was the AI strategy last reviewed, and when is the next review due?
- What events would cause an unscheduled review?
- What changed at the last review, and why?
- Strategy version history or change log, with reasons
- Papers and minutes from the most recent review
How to reach Level 3
- Set a review cycle for the AI strategy, such as yearly, aligned to business planning.
- Define the triggers that require a review outside the cycle, such as major regulatory, technology or organisational change, and link them to horizon scanning (STR-05).
- Make the strategy owner responsible for carrying out each review and reporting the result to leadership.
- Keep a change log that records each change to the strategy with its reason and date.
Common pitfalls
- Setting triggers that nobody watches for, so only the yearly review ever happens.
- Changing the strategy without recording why, so later readers cannot follow its history.
Starter artefacts
- Strategy review schedule and trigger list
- Strategy change log
Cross-references
| ISO/IEC 42001 | 6.3 partial |
|---|---|
| MITRE AI Maturity Model | P2.1 partial |
| UNESCO AI Maturity Framework | 1.1 partial; 1.3 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.