How often should IT policies be reviewed?

Annually is the baseline for most policies. Fast-moving areas – AI use, cybersecurity – need more frequent review, ideally every six months, because the risk landscape moves faster than an annual cycle can keep up with.