AI policy

Document a policy governing how the organization develops or uses AI systems. In practice the record is documented AI policy covering development and/or use of AI. Read it against ai policy at the next policy review.

What it asks

Document a policy governing how the organization develops or uses AI systems.

Where generative AI changes the answer

A generative AI policy has to say which tools are permitted, what may never be pasted into them, and who can approve a new use, or staff will infer the answer.

Who it binds

The AI management system owner and the policy approver. For A.2.2 the named role is the owner of documented AI policy covering development and/or use of AI.

Evidence an auditor normally samples

• Documented AI policy covering development and/or use of AI
• Evidence the policy reflects business strategy, values, risk appetite, legal and contractual requirements and impact on interested parties
• Policy principles and a process for deviations and exceptions

The test you can run

Compare documented AI policy covering development and/or use of AI with the use as it runs today; the gap between the two is the finding to record.

Common failures

• Generic IT policy relabelled as the AI policy
• No process for exceptions to the policy

Before the draft publishes

For A.2.2, compare the current AI policy with what staff actually do with generative tools, and record every gap you find as a policy exception until it is fixed. The first artefact to produce is documented AI policy covering development and/or use of AI.

Where this sits against the draft

The draft's published scope names controls for the risks it identifies, and A.2.2 (ai policy) is the published ISO/IEC 42001 control closest to that work. The draft does not replace it, and an audit still tests it against the evidence listed here.