AI Security Annual Review Calendar
AI security is a cycle, not a project. This tool turns your start month, the number of AI systems and whether you hold ISO/IEC 27001 or ISO/IEC 42001 into a 12-month calendar of up to 10 recurring activities, each with an owner and a link to the PlayCISO tool that does the work. Download it as an .ics file for your team calendar, or as CSV.
Free, in your browser, nothing uploaded. ISO/IEC 27090 is guidance and sets no review frequencies: the cadences are planning defaults to adjust to your own risk assessment.
Your programme
January 2027
- AI inventory reviewMon, 11 Jan 2027 · 1 of 2
Confirm every AI system has an owner, a provider or deployer role and a current risk rating, and add new, shadow and embedded AI found since the last review. Retire what is gone.
Owner: AI governance lead (with AI system owners) · Tool: AI System InventoryPRO
- Threat-model refreshTue, 12 Jan 2027 · 1 of 4
Re-run the AI threat themes (prompt injection, poisoning, evasion, extraction, inversion, supply chain, output handling, agency) against each AI system and update the threat register for anything that changed.
Owner: AI security lead (with AI system owners) · Tool: AI Threat ModelPRO
February 2027
- Red-team / prompt-injection retestWed, 17 Feb 2027 · 1 of 4
Retest prompt injection, jailbreaks and output handling on each AI system, and retest any open findings from the last round. Record date, tester and outcome.
Owner: Security testing lead or red team · Tool: Prompt Injection TesterPRO
- Model and provenance checksThu, 18 Feb 2027 · 1 of 4
Check model versions, weights hashes or signatures, dataset sources and licences against the AI bill of materials, and flag anything that changed without a review.
Owner: AI / ML engineering lead · Tool: AI Training Data ProvenancePRO
March 2027
- AI security metrics reviewFri, 19 Mar 2027 · 1 of 4
Review the AI security KPIs for the quarter (test coverage, open findings, inventory completeness, supplier status) and agree actions for anything off target.
Owner: CISO (with GRC lead) · Tool: AI Security Metrics Set
April 2027
- AI supplier reassessmentThu, 1 Apr 2027
Re-send the AI supplier questionnaire to model, platform and AI SaaS providers, and check for changes to training-on-your-data, retention, sub-processors and incident notification terms.
Owner: GRC / vendor risk lead · Tool: AI Supplier QuestionnairePRO
- Threat-model refreshTue, 13 Apr 2027 · 2 of 4
Re-run the AI threat themes (prompt injection, poisoning, evasion, extraction, inversion, supply chain, output handling, agency) against each AI system and update the threat register for anything that changed.
Owner: AI security lead (with AI system owners) · Tool: AI Threat ModelPRO
May 2027
- Red-team / prompt-injection retestWed, 19 May 2027 · 2 of 4
Retest prompt injection, jailbreaks and output handling on each AI system, and retest any open findings from the last round. Record date, tester and outcome.
Owner: Security testing lead or red team · Tool: Prompt Injection TesterPRO
- Model and provenance checksThu, 20 May 2027 · 2 of 4
Check model versions, weights hashes or signatures, dataset sources and licences against the AI bill of materials, and flag anything that changed without a review.
Owner: AI / ML engineering lead · Tool: AI Training Data ProvenancePRO
June 2027
- AI incident tabletopWed, 9 Jun 2027
Run a tabletop on an AI incident: model compromise, harmful output, data exposure through the model or a misbehaving agent. Capture actions for the incident response plan.
Owner: CISO / incident response lead · Tool: Agent IR Tabletop LabPRO
- AI security metrics reviewFri, 18 Jun 2027 · 2 of 4
Review the AI security KPIs for the quarter (test coverage, open findings, inventory completeness, supplier status) and agree actions for anything off target.
Owner: CISO (with GRC lead) · Tool: AI Security Metrics Set
July 2027
- AI inventory reviewMon, 12 Jul 2027 · 2 of 2
Confirm every AI system has an owner, a provider or deployer role and a current risk rating, and add new, shadow and embedded AI found since the last review. Retire what is gone.
Owner: AI governance lead (with AI system owners) · Tool: AI System InventoryPRO
- Threat-model refreshTue, 13 Jul 2027 · 3 of 4
Re-run the AI threat themes (prompt injection, poisoning, evasion, extraction, inversion, supply chain, output handling, agency) against each AI system and update the threat register for anything that changed.
Owner: AI security lead (with AI system owners) · Tool: AI Threat ModelPRO
August 2027
- Red-team / prompt-injection retestWed, 18 Aug 2027 · 3 of 4
Retest prompt injection, jailbreaks and output handling on each AI system, and retest any open findings from the last round. Record date, tester and outcome.
Owner: Security testing lead or red team · Tool: Prompt Injection TesterPRO
- Model and provenance checksThu, 19 Aug 2027 · 3 of 4
Check model versions, weights hashes or signatures, dataset sources and licences against the AI bill of materials, and flag anything that changed without a review.
Owner: AI / ML engineering lead · Tool: AI Training Data ProvenancePRO
September 2027
- AI security metrics reviewFri, 17 Sept 2027 · 3 of 4
Review the AI security KPIs for the quarter (test coverage, open findings, inventory completeness, supplier status) and agree actions for anything off target.
Owner: CISO (with GRC lead) · Tool: AI Security Metrics Set
October 2027
- Threat-model refreshTue, 12 Oct 2027 · 4 of 4
Re-run the AI threat themes (prompt injection, poisoning, evasion, extraction, inversion, supply chain, output handling, agency) against each AI system and update the threat register for anything that changed.
Owner: AI security lead (with AI system owners) · Tool: AI Threat ModelPRO
November 2027
- ISMS management review input (ISO/IEC 27001, 9.3)Tue, 2 Nov 2027
Prepare the AI security input for management review: results of testing and audits, open risks, incidents, supplier changes, metrics, resources and decisions needed. Feed this into the management review your management system already holds.
Owner: CISO prepares; top management reviews · Tool: ISO 42001 Management Review PackPRO
- Red-team / prompt-injection retestWed, 17 Nov 2027 · 4 of 4
Retest prompt injection, jailbreaks and output handling on each AI system, and retest any open findings from the last round. Record date, tester and outcome.
Owner: Security testing lead or red team · Tool: Prompt Injection TesterPRO
- Model and provenance checksThu, 18 Nov 2027 · 4 of 4
Check model versions, weights hashes or signatures, dataset sources and licences against the AI bill of materials, and flag anything that changed without a review.
Owner: AI / ML engineering lead · Tool: AI Training Data ProvenancePRO
December 2027
- AI security policy annual reviewThu, 9 Dec 2027
Review the AI security and acceptable-use policies against the year's incidents, test findings and management review decisions, update them and record the approval.
Owner: Policy owner (CISO); approved by top management · Tool: AI Governance PackPRO
- AI security metrics reviewFri, 17 Dec 2027 · 4 of 4
Review the AI security KPIs for the quarter (test coverage, open findings, inventory completeness, supplier status) and agree actions for anything off target.
Owner: CISO (with GRC lead) · Tool: AI Security Metrics Set
Activities, owners and cadence
| Activity | Owner | Cadence | Day | People-days each | Tool |
|---|---|---|---|---|---|
| Threat-model refresh | AI security lead (with AI system owners) | Quarterly (4×) | 2nd Tuesday | 3.5 | AI Threat ModelPRO |
| Red-team / prompt-injection retest | Security testing lead or red team | Quarterly (4×) | 3rd Wednesday | 7 | Prompt Injection TesterPRO |
| AI supplier reassessment | GRC / vendor risk lead | Annual (1×) | 1st Thursday | 2.5 | AI Supplier QuestionnairePRO |
| AI inventory review | AI governance lead (with AI system owners) | Twice a year (2×) | 2nd Monday | 1.1 | AI System InventoryPRO |
| Model and provenance checks | AI / ML engineering lead | Quarterly (4×) | 3rd Thursday | 2 | AI Training Data ProvenancePRO |
| AI incident tabletop | CISO / incident response lead | Annual (1×) | 2nd Wednesday | 3 | Agent IR Tabletop LabPRO |
| AI security metrics review | CISO (with GRC lead) | Quarterly (4×) | 3rd Friday | 1 | AI Security Metrics Set |
| ISMS management review input (ISO/IEC 27001, 9.3) | CISO prepares; top management reviews | Annual (1×) | 1st Tuesday | 2 | ISO 42001 Management Review PackPRO |
| AI security policy annual review | Policy owner (CISO); approved by top management | Annual (1×) | 2nd Thursday | 2 | AI Governance PackPRO |
Planning aid only. ISO/IEC 27090 is guidance and sets no review frequencies: the cadences are PlayCISO planning heuristics. Adjust them to your risk assessment. PlayCISO is not affiliated with ISO or IEC. The .ics file imports into Google Calendar, Outlook and Apple Calendar as all-day events; recurring activities arrive as one repeating event.
TL;DRWhat this calendar gives you
4 points
- A 12-month calendar of the recurring work that keeps ISO/IEC 27090 guidance alive after the project ends: threat-model refreshes, red-team and prompt-injection retests, supplier reassessments, AI inventory reviews, model and provenance checks, an incident tabletop, metrics reviews, management review input, an internal audit slot and the policy review.
- Set the start month, the number of AI systems and whether you hold ISO/IEC 27001 or 42001. More AI systems means more frequent retests, inventory reviews and supplier checks; holding 42001 adds the internal audit slot.
- Every event has an owner role and a link to the PlayCISO tool that does the work.
- Download a standard .ics calendar (all-day events, repeating where the activity recurs) for Google Calendar, Outlook or Apple Calendar, or a CSV. Switch between a list and a month grid. Free, in your browser.
How the cadence is chosen
These are PlayCISO planning defaults, not requirements of ISO/IEC 27090. The only rules that change them are your inputs:
- Threat-model refresh: Quarterly for every organisation, starting in month 1.
- Red-team / prompt-injection retest: Twice a year with up to 5 AI systems; quarterly with more than 5.
- AI supplier reassessment: Annual with up to 10 AI systems; twice a year with more than 10.
- AI inventory review: Twice a year with up to 10 AI systems; quarterly with more than 10.
- Model and provenance checks: Quarterly for every organisation, a month after each threat-model refresh.
- AI incident tabletop: Annual with up to 10 AI systems; twice a year with more than 10. Effort assumes about six people for half a day plus preparation.
- AI security metrics review: Quarterly, at the end of each quarter of the window.
- Management review input: Annual, in month 11, after the internal audit and before the policy review.
- ISO/IEC 42001 internal audit slot (9.2): Annual, in month 9, only when ISO/IEC 42001 is held.
- AI security policy annual review: Annual, in the last month of the window, so it reflects the management review.
The order is deliberate: threat models are refreshed before the retests that check them, the internal audit comes before the management review it feeds, and the policy review comes last so it reflects the management review’s decisions. Indicative effort per event is a base number of people-days plus a share per AI system; the ISO 27090 cost estimator uses the same figures for its ongoing annual effort.
ISO 27090 toolkit
Explore all AI & ISO standards →Everything on PlayCISO for ISO/IEC 27090, from the first self-check to the auditor’s questions. ISO/IEC 27090 is guidance, not a certifiable standard.
ISO 27090 Readiness Checklist
Reference · GuideCan you be certified to ISO 27090?
Planner · ProISO 27090 Project Plan
Roadmap · ProISO 27090 Maturity Timeline
Templates · ProISO 27090 Sample Artefacts
Lab · ProISO 27090 Implementation Lab
Lab · ProISO 27090 Threat-Mapping Lab
Template · ProISO 27090 AI Security Test Plan
Template · ProISO 27090 RACI Template
Template · ProISO 27090 Project Plan Template
Matrix · FreeISO 27090 Traceability Matrix
Generator · FreeISO 27090 Alignment Statement
Labs · FreeISO 27090 Practice Path
Matrix · FreeAI Shared-Responsibility Matrix
Briefing · FreeAI Security Board Briefing Pack
Metrics · FreeAI Security Metrics Set
Estimator · FreeISO 27090 Cost Estimator
Course · FreeISO 27090 in 10 Minutes
Simulator · FreeISO 27090 Auditor Interview
Article · GuideISO 27090 explained
Frequently asked questions
How often should AI systems be security reviewed?
ISO/IEC 27090 is guidance and does not set review frequencies, so you decide them in your risk assessment. A common planning pattern, and the default in this calendar, is a quarterly threat-model refresh, retests twice a year (quarterly once you run more than five AI systems), an annual supplier reassessment and incident tabletop, and a review whenever a new model, data source or use case arrives.
Does ISO/IEC 42001 require an internal audit and a management review?
Yes. ISO/IEC 42001 requires an internal audit programme (clause 9.2) and management reviews (clause 9.3) at planned intervals, as ISO/IEC 27001 does for an ISMS. This calendar adds an internal audit slot when you hold 42001 and labels the management review input for whichever management system you have. Without either, it schedules a leadership review with the same inputs.
Will the .ics file work in Outlook and Google Calendar?
It should. The file follows the iCalendar standard (RFC 5545): all-day events with a unique ID and timestamp, a repeat rule for activities that recur within the year (for example the second Tuesday every three months), and lines folded to the standard length. Import it into a shared team calendar rather than a personal one so owners see their slots.
Why are events on a set weekday rather than a date?
Each activity runs on a fixed weekday of the month, such as the second Tuesday, so it never lands on a weekend and the repeat rule stays exact in every calendar app. Move individual events after import if they clash with holidays or other reviews.
Is my data uploaded anywhere?
No. The calendar is built in your browser from the four inputs, and the .ics and CSV files are created on your device.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.