# A.2.2 AI policy

Document a policy governing how the organization develops or uses AI systems. In practice the record is documented AI policy covering development and/or use of AI. Read it against ai policy at the next policy review.

- Framework: ISO/IEC 42001:2023
- Cited to: ISO/IEC 42001:2023, Annex A control A.2.2
- Source: https://www.iso.org/standard/81230.html
- Last updated: 2026-10-20

## What it asks

Document a policy governing how the organization develops or uses AI systems.

## Where generative AI changes the answer

A generative AI policy has to say which tools are permitted, what may never be pasted into them, and who can approve a new use, or staff will infer the answer.

## Who it binds

The AI management system owner and the policy approver.

## Evidence an auditor samples

- Documented AI policy covering development and/or use of AI
- Evidence the policy reflects business strategy, values, risk appetite, legal and contractual requirements and impact on interested parties
- Policy principles and a process for deviations and exceptions

## The test you can run

Ask five staff where the acceptable-use rule is and what it forbids. Compare the answers with the policy.

## Common failures

- Generic IT policy relabelled as the AI policy
- No process for exceptions to the policy

## Before the draft publishes

Compare the current AI policy with what staff actually do with generative tools, and record every gap you find as a policy exception until it is fixed.

## What this page does not say

It does not state the text of ISO/IEC DTS 25568, because ISO has not published the draft's clause text. It does not certify anything.

Not legal advice; does not certify.