Review dates

What has a review date

• Approved and published policies: review due date. Reminders start 30 days before.
• Open and mitigating risks: review date. Accepted risks: acceptance review date.
• Vendors: next review date. A vendor's latest approved assessment also expires, which calls for a reassessment.
• AI systems that are not retired: next review date.
• Bias assessments: next review date.
• Active exceptions: expiry date.
• Shadow AI tools: decide-by or re-review date.

Except for policies, reminders start 14 days before the date. Controls are re-tested through retest tasks instead (see Controls).

What happens as the date approaches

1. 1When the date comes into range, the record shows Review due soon and its owner is notified once.
2. 2Once the date passes, it shows Review overdue and the owner is notified once more. It stays overdue until the review is done.
3. 3The review is listed in the owner's My Assignments, under Reviews, until it is done.

The owner is the person named on the record. A record with no owner goes to whoever created it, then to the project owner. If one check would send you more than five reminders, you get one summary instead.

Mark a review done

1. 1Choose Mark reviewed: on a policy, vendor or AI system page it is in the review banner; on My Assignments and the Policies, Risks and Bias Assessments lists it is next to the record.
2. 2Optionally set the next review date. If you leave it empty, the usual interval is used: 12 months for policies; 3 months for critical and high risks, 6 for others; 6 months for accepted risks; 6 months for high-risk vendors and AI systems, 12 for others; 12 months for bias assessments.
3. 3Optionally note what you checked. Policy, vendor and AI system pages then show Last reviewed with the date, your name and the note, and the review is recorded in the Audit Trail.

Some reviews are done elsewhere: a vendor approval by a new assessment, an exception by renewing it through Approvals, and a Shadow AI tool by recording or confirming its decision. Changing the review date on the record also closes the current review.