Quick answer · 5.2
What should an ISO 42001 AI policy contain?
Top management must establish a policy covering these eight points:
- Fit the organisation’s purpose.
- Provide a framework for setting AI objectives.
- Commit to meeting applicable requirements.
- Commit to continual improvement of the AI management system.
- Remain available as documented information.
- Reference other organisational policies where relevant.
- Be communicated within the organisation.
- Be available to interested parties as appropriate.
ISO/IEC 42001 does not prescribe a universal template or a specific policy length.
You do not need to develop AI models to need an AI policy. It also helps govern the use of third-party tools. Scope and commitments should reflect your activities and risks.
If you are starting from scratch, read our complete ISO/IEC 42001 guide: it explains the management system, clauses 4–10 and the 38 Annex A controls. To assess your starting point, use the ISO 42001 checklist.
Three connected pieces
An AI policy sets your organisation’s direction: why it uses or develops AI, the commitments it makes and how it governs decisions. It provides a reference for the objectives and procedures that put those commitments into practice.
The requirements
What management must establish and how the policy must be available.
The controls
Document the policy, align it with other policies and review it.
Implementation
How to put those controls into practice in your context.
The objective of A.2 is to give AI systems management direction and support consistent with business needs. Its controls are A.2.2 (policy), A.2.3 (alignment) and A.2.4 (review).
The eight points to cover in 5.2
A practical summary. The last column suggests useful evidence; it does not prescribe a mandatory document format.
| Point | What to do | Possible evidence |
|---|---|---|
| Connect to your purpose5.2 a | Explain how AI adds value to your organisation within its defined scope. | Purpose and scope adapted to the business. |
| Frame your objectives5.2 b | Set commitments from which concrete AI objectives can be developed. | Policy → objective → indicator → owner. |
| Commit to compliance5.2 c | Explicitly commit to meeting applicable requirements. | Commitment and a reference to the process for identifying and maintaining requirements. |
| Commit to continual improvement5.2 d | Address continual improvement of the AI management system, as well as technical improvements to AI systems. | Commitment linked to reviews and improvement actions. |
| Document the policy5.2 | Keep the policy available as documented information. | An identifiable, accessible current version. |
| Reference other policies5.2 | Include references to other organisational policies where relevant. | Identifiable references to security, privacy or other applicable policies. |
| Communicate internally5.2 | Communicate the policy within the organisation. | Proportionate evidence of communication, onboarding or training. |
| Make it available to interested parties5.2 | Decide who should receive it and through which channel. | Availability criteria and a channel. Publishing it in full online is not a general requirement of 5.2. |
A useful policy should lead to decisions
Connect the direction set by 5.2 with the objectives in 6.2 and evidence you can review.
- Commitment
- Objective
- Indicator
- Owner
- Evidence
Example to adapt: human review of AI-assisted deliverables → review every deliverable before sending it → percentage with a recorded review → operations lead → delivery and review log. ISO does not mandate this document chain or target.
Write it in eight steps
Each step includes two cases: a company using AI to speed up candidate selection and another using ChatGPT for drafting. These are examples to adapt, not additional ISO requirements or validation of those uses. If you develop or supply systems, also adapt the commitments to those activities and their lifecycle.
Place AI in your business context5.2 a · B.2.2
Before drafting, bring together people who understand the business, its AI uses and risks. Ask: do we use, develop or supply AI? In which processes? Who may be affected? Gather strategy, values, risk appetite, risk and impact assessments, and applicable legal and contractual requirements.
1. AI for candidate selection
A company uses AI to summarise CVs and organise applications against job requirements. It aims to speed up recruitment without delegating decisions to a score. HR defines the assisted tasks, data used, supplier, people affected and risks of errors or unequal treatment.
2. ChatGPT for drafting
A company uses ChatGPT to draft articles, emails and commercial proposals. It aims to reduce drafting time while maintaining quality and confidentiality. It defines who may use it, for which content, with which input information and who reviews each text.
Your output: A brief recording purpose, scope, AI roles, relevant uses and risks.
Turn principles into commitments5.2 b–d · B.2.2
Include compliance with applicable requirements and continual improvement of the AI management system. Add principles appropriate to your context: human oversight, transparency, security, privacy or fair treatment. Explain which decisions each principle changes. The specific selection and detail depend on your uses and risks.
1. AI for candidate selection
Instead of “we will recruit responsibly with AI”: “AI recommendations will be checked against job requirements and application documents before a decision is made. The responsible person may correct or reject them; candidates will not be rejected solely on an automated score.” This is an example commitment, not a guarantee that bias is absent.
2. ChatGPT for drafting
Instead of “we will write responsibly with AI”: “Texts drafted with ChatGPT will be reviewed before sending or publication. A person will check facts, sources, tone and the absence of information that should not be disclosed, and will have authority to correct or reject the text.”
Your output: Clear, achievable commitments connected to actual decisions.
Connect policy, objectives and evidence5.2 b · 6.2
The policy provides the framework; the objectives plan specifies the intended result, resources, owner, deadline and evaluation. Keep changing figures in that plan so you can manage them without rewriting the whole policy. Under 6.2, objectives must be measurable where practicable.
1. AI for candidate selection
Commitment: recruitment decisions with documented human review. Example objective: from next quarter, record that review for 100% of AI-assisted decisions. Indicator: decisions with recorded review / AI-assisted decisions. Owner: HR director. Evidence: recruitment log and review sampling. Also monitor errors and complaints: ticking a box does not demonstrate effective review.
2. ChatGPT for drafting
Commitment: review before publication. Example objective: from next quarter, 100% of external texts drafted with ChatGPT have a recorded review. Indicator: reviewed texts / ChatGPT-assisted external texts. Owner: communications director. Evidence: version history and editorial approval. Also compare preparation time and corrections after publication.
Your output: An initial objective for each priority commitment, with an indicator, owner and deadline.
Align it with existing policies5.2 · A.2.3 · B.2.3
Review overlaps with security, privacy, quality, safety, procurement and human resources where relevant. Identify contradictions and decide which document needs updating. Use specific references to current documents and check that the intended readers can access them.
1. AI for candidate selection
The AI policy references recruitment, equality, privacy, security and procurement policies. HR and the privacy and security functions review which data may be processed, who may access applications and how the supplier is assessed. If the planned use conflicts with an existing rule, they resolve the conflict before authorising it.
2. ChatGPT for drafting
The AI policy references confidentiality, security and editorial communication rules. It specifies which information may be entered into ChatGPT and which review an external text requires. Having a licence does not mean being authorised to upload client documents or personal data.
Your output: A table of related policies, overlaps, changes and owners.
Decide how to handle exceptions and deviationsB.2.2
Distinguish an exception requested before acting from a deviation discovered afterwards. For an internal exception, record the reason, scope, risks, safeguards, approving authority, expiry and review. An exception to an internal rule does not authorise breach of law or contract. When a deviation occurs, contain its effects, report it and assess the necessary actions.
1. AI for candidate selection
HR requests a trial of an unapproved screening tool. The proposed internal exception limits the pilot to two weeks, using synthetic applications and making no decisions about real people. Scope, risks, owner and closure are recorded. If an unreviewed rejection is discovered in the regular process, the affected use is contained, reported and the decision reassessed.
2. ChatGPT for drafting
Communications requests a trial of an unapproved drafting workflow with ChatGPT. The trial uses public information, does not publish automatically and expires after two weeks. If someone mistakenly enters a confidential document, the incident channel is activated, exposure is assessed and planned safeguards are applied; retrospective approval does not regularise the incident.
Your output: A reporting channel and decision process the team understands.
Have top management establish and approve it5.2 · B.2.4 · 7.5
Top management establishes the policy. Also assign a management-approved owner for its development, review and evaluation. Identify its version, date, scope, owner and approval. Documented approval is a practical way to evidence the decision; 5.2 does not require a handwritten signature or a fixed page count.
1. AI for candidate selection
Top management establishes and approves the policy following review by HR, privacy, security and other relevant functions. It appoints an AI management system owner to maintain it and HR to apply the recruitment commitments. The minutes identify version, scope, responsibilities and resources.
2. ChatGPT for drafting
Top management establishes and approves the policy and assigns maintenance to the AI management system owner. Communications reviews editorial commitments, while security and privacy review information-related commitments. The roles authorising ChatGPT use and approving external texts are identified.
Your output: A current policy, approval evidence and an owner for maintenance.
Communicate it and make it available5.2 · A.2.2
Accompany internal publication with an explanation of what changes in daily work and where to ask questions. Integrate the policy into onboarding and relevant processes. Identify interested parties who should have access, such as a client requesting it or a supplier affected by its commitments.
1. AI for candidate selection
The company publishes the current policy on the intranet and trains recruitment staff using three situations: an incorrect recommendation, an omitted application and a review request. It explains where to find documentation and report issues. It also defines who provides the policy to candidates or suppliers where appropriate, without confusing it with recruitment-specific notices.
2. ChatGPT for drafting
The company publishes the policy in the communications workspace and includes it in training for staff drafting with ChatGPT. It explains which information must not be entered, how to verify a draft and who approves publication. It retains the material and communication evidence, and defines how to handle client requests about its AI use commitments.
Your output: An access channel, evidence of communication and criteria for external requests.
Schedule reviews and respond to changeA.2.4 · B.2.4
Choose an interval appropriate to your context and review additionally when needed. Consider changes to the business, technology and legal environment, incidents, objectives and management review results. Check whether the policy remains suitable, adequate and effective. Record the decision even when no changes are needed.
1. AI for candidate selection
The company chooses a six-month review interval and additional reviews when the supplier, ranking criteria or roles covered change, or significant errors or complaints arise. HR provides results, incidents and evidence of human review quality. It records whether the policy, process or both need changing. The interval is an example decision, not a universal ISO requirement.
2. ChatGPT for drafting
The company chooses an annual review and additional reviews when the contracted service changes, new information sources are connected, publication is automated or factual errors or confidentiality incidents are detected. Communications reviews indicators and subsequent corrections. The decision to retain or revise the policy is recorded. ISO does not impose an annual frequency here.
Your output: A schedule, review triggers and a record of decisions and improvements.
Free · Editable Word · Version 1.2
Download the AI policy template
Start with drafted sections, fields to complete and examples you can adapt to your organisation.
- Editable policy: purpose, commitments, principles and responsibilities.
- Five appendices for objectives, alignment, exceptions, review and checking.
- Drafting notes and highlighted fields. No macros.
Send your request to ACBSEC and download the file here. Your email is optional: I only need it if you want me to contact you.
Check your draft before approval
Tick what you have addressed. This is a working aid, not a conformity assessment. It resets on reload and your answers are not sent.
0 / 10 points checked
Common questions
Is copying and signing the template enough?
No. Adapt it to your organisation’s purpose, scope, uses, risks and requirements; approve it, communicate it and apply the commitments. The template supports drafting but does not establish conformity or certification.
Do we need to develop AI to need a policy?
The standard addresses both development and use of AI systems. An organisation using only third-party services must also adapt its policy to its role and the scope of its management system.
Does the standard require an AI committee or an annual review?
These sections do not prescribe a committee with that name or a fixed annual frequency. They address decisions and responsibilities; A.2.4 provides for planned reviews and additional reviews when necessary.
Must the policy list every approved tool?
It can refer to a current catalogue or procedure. Separating management commitments from frequently changing details makes maintenance easier. This is a document-design recommendation.
Must we publish the entire policy online?
5.2 requires availability to interested parties as appropriate. Define suitable recipients, access and channels; this is not a general obligation to publish the complete policy online.
Need help adapting it to your organisation?
We can work through scope, commitments and evidence so the policy fits your AI uses and the rest of your management system.
Original guidance on ISO/IEC 42001:2023, sections 5.2, A.2 and B.2, supported by 6.1.3, 6.2 and 7.5. The current Spanish adoption is UNE-EN ISO/IEC 42001:2026, dated 8 April 2026, replacing UNE-ISO/IEC 42001:2025. AENOR declares it technically identical to the 2023 international standard. AENOR · BOE · ISO/IEC 42001:2023.
The examples, checklist and template are implementation suggestions, not the official text or a guarantee of certification. Consult the standard for its complete requirements.