Management reviews
A management review is leadership's periodic look at the AI governance program: is it working, what has changed, and what should change next. Management Reviews keeps each one as a record you can show an auditor.
A review
Each review has a title, the date it was held, a chair, the members who attended and any other attendees without an account. Tick the inputs the review considered and note what was said about each:
- progress on actions agreed at earlier management reviews;
- changes inside and outside the organization that bear on the AI governance program;
- performance of the AI governance program and its AI systems, including monitoring results and progress on AI objectives;
- incidents, nonconformities and corrective actions;
- internal and external audit results;
- the status of the AI risk register and risk treatment;
- changes in what interested parties need and expect, and feedback from users and affected people;
- opportunities for improvement.
Then record the minutes, the decisions about changes and the next review date.
On a saved draft, when AI is available to your organization, Draft the minutes and decisions with Watney drafts whichever of the two is still empty, from the program's numbers for the review period and the inputs you ticked with their notes. Drafted decisions are proposals for the meeting to confirm; Watney never writes what was said or decided where your notes do not say it, and nothing is saved until you save the review. Your notes are sent to the AI model provider to produce the draft.
The program's numbers
The review shows the program as it stands: the program score (only once it is scored), open findings by risk, open AI risks, incidents discovered in the review period, AI systems by lifecycle stage, and how many actions from earlier reviews are still open. The period runs from the last finalized review to this one (or the twelve months before it, for the first review). On a draft these numbers are live; finalizing freezes them as of that day.
Draft, then finalized
A review starts as a draft, which any member who can write may edit. An org admin finalizes it once it names a chair, marks at least one input as considered and has minutes. A finalized review cannot be edited or deleted, and it carries an integrity stamp: its page and PDF say whether it is unchanged since it was finalized. It keeps the wording of the inputs as they read when it was finalized, so a later change to that wording does not change the record. A draft can be deleted by an org admin.
Actions
Each follow-up the review decides is an action: a remediation task, assigned, reminded and closed with the rest of your tasks. Actions can be added to a draft or a finalized review. The next review lists the earlier reviews' actions and their status.
The calendar
The compliance calendar shows when the next review is due: the date the last review set, or a year after it, or a year after your organization was set up if none has been held. While a draft is being prepared, the calendar shows the draft's date instead. The Internal audit of the AI governance program is an annual activity in the compliance calendar's catalog. An organization that did not answer No to using AI starts with it on the calendar, added when the setup questions are first answered; if yours does not show it, an admin adopts it from the activity catalog under Manage activities. Record each audit there, with its report as evidence, and bring the results to the next review.
Exports
Admins and auditors can export the register as CSV and any review as a PDF.
Who can do what
Every member can read the reviews, and members who can write can draft them and add actions. Only an org admin can finalize or delete a draft. An auditor with an active engagement can read them, read-only.