Why the AI Policy Is More Than a Document
Every ISO management system standard has a policy requirement, and ISO 42001 is no different. Clause 5.2 asks top management to establish an AI policy for the organisation. But if you treat this as a simple document exercise, you will miss the point entirely. The AI policy under ISO 42001 is the organisation's public statement of intent about how it develops, deploys, and uses artificial intelligence. It sets the tone for every other part of the AI management system (AIMS) that follows.
On this page
This article unpacks what Clause 5.2 actually requires, why each requirement exists, what a well written AI policy looks like in practice, and what auditors will be looking for when they assess conformity. Whether you are implementing an AIMS for the first time, preparing for a certification audit, or auditing an organisation's AI policy as part of an internal review, this is the detail you need.
What Clause 5.2 Actually Says
The standard requires that top management establish an AI policy that:
- Is appropriate to the purpose of the organisation and the context of its AI activities
- Provides a framework for setting AI objectives
- Includes a commitment to satisfy applicable requirements
- Includes a commitment to continual improvement of the AIMS
The policy must also be available as documented information, communicated within the organisation, and made available to interested parties as appropriate. That last phrase carries real weight. Unlike some internal documents, the AI policy is intended to be visible. It signals to customers, regulators, partners, and the public how the organisation approaches AI responsibly.
If you have worked with ISO 9001, ISO 14001, or ISO 45001, this structure will feel familiar. The High Level Structure that underpins modern ISO standards includes a common policy requirement at Clause 5.2 across all of them. What makes the ISO 42001 version distinctive is the subject matter. AI introduces considerations that do not arise in quality or environmental management, including algorithmic fairness, transparency, human oversight, and the potential for AI systems to cause harm at scale.
Exemplar Global Recognised Training ProviderRTP No. 310970
Appropriate to the Organisation's Purpose and AI Context
The first requirement is that the policy must be appropriate to the organisation's purpose and the context in which it uses AI. This is not a boilerplate statement. It connects directly back to the work done under Clause 4, where the organisation identified its context, its AI roles (provider, producer, customer, or some combination), and the nature of the AI systems it operates.
A small business using an AI powered scheduling tool faces a very different risk landscape than a financial institution using AI to make lending decisions. The policy for each should reflect that difference. A policy that could belong to any organisation, in any industry, deploying any kind of AI system, is almost certainly too generic to be meaningful.
In practice, this means the policy should reference the types of AI systems the organisation uses or develops, the sectors it operates in, and the populations its AI systems affect. A healthcare organisation using AI for diagnostic support should acknowledge the sensitivity of that context. A recruitment firm using AI to screen candidates should acknowledge the fairness and bias risks inherent in that activity.
What Auditors Look For Here
When auditing this requirement, look for evidence that the policy was written with the organisation's actual AI activities in mind, not copied from a template. Ask the person responsible for the AIMS how the policy reflects the organisation's specific context. If they cannot explain the connection, that is a signal worth following.
Providing a Framework for AI Objectives
The policy must provide a framework for setting AI objectives. This is an important structural requirement. The policy itself does not contain the objectives, but it creates the conditions under which meaningful objectives can be set. Think of it as the policy establishing the direction, and the objectives translating that direction into measurable commitments.
For example, if the policy states a commitment to transparency in AI decision making, that commitment should flow through to an objective such as ensuring that all customer facing AI decisions can be explained upon request, with a target and a method for measuring progress. If the policy mentions human oversight as a principle, that should connect to objectives around human review rates or escalation processes.
The link between policy and objectives is something auditors will trace. If you find objectives that have no clear connection to the policy, or a policy that contains commitments with no corresponding objectives, that misalignment is worth raising. It suggests the system is operating in silos rather than as an integrated whole.
Commitment to Satisfy Applicable Requirements
The third element is a commitment to satisfy applicable requirements. In ISO management system language, requirements come from two sources: the requirements of the standard itself, and any external requirements the organisation has determined apply to it through its context and compliance obligations work.
For AI, applicable requirements might include:
- The Australian Privacy Act and the Australian Privacy Principles, particularly where AI systems process personal information
- Sector specific regulations such as APRA guidance for financial services or the Therapeutic Goods Administration requirements for medical device software
- Contractual requirements from customers or partners who specify how AI systems must behave
- The organisation's own internal standards and codes of conduct
- Emerging regulatory frameworks such as the EU AI Act, which may affect Australian organisations that operate internationally or supply AI systems to European customers
The policy commitment here is not just a legal compliance statement. It is a signal that the organisation takes its obligations seriously and has a process for identifying and keeping up with them. That process is developed through the AIMS, but the policy anchors the commitment at the top management level.
Commitment to Continual Improvement
The fourth requirement is a commitment to continual improvement of the AIMS. This is standard language across ISO management systems, but it carries particular significance in the AI context. AI systems change. Models are retrained. New use cases emerge. Regulatory expectations evolve. A static management system will quickly fall behind the reality of how AI is being used in the organisation.
The continual improvement commitment means the organisation is not just managing AI risks as they exist today. It is committing to regularly review and improve how it manages those risks over time. This connects to the monitoring and measurement requirements in Clause 9.1, the internal audit requirements in Clause 9.2, the management review requirements in Clause 9.3, and the corrective action and improvement requirements in Clause 10.
In an audit, you would expect to see evidence that the policy commitment to continual improvement is reflected in actual improvement activity, not just stated as an aspiration.
What the AI Policy Should Actually Address
Beyond the four structural requirements in Clause 5.2, a well constructed AI policy typically addresses several themes that reflect the responsible AI principles underpinning ISO 42001. These are not all explicitly mandated by Clause 5.2, but they are consistent with the standard's intent and with the guidance in Annex A.
Human Oversight and Control
One of the distinguishing features of ISO 42001 is its emphasis on keeping humans in the loop. The policy should articulate the organisation's commitment to maintaining appropriate human oversight of AI systems, particularly where those systems make or influence decisions that affect people. This is not a blanket requirement for human review of every AI output, but it does mean the organisation has thought about where human judgment is essential and has built that into its operating model.
Fairness and Non Discrimination
AI systems can perpetuate or amplify bias if they are trained on biased data or designed without adequate attention to fairness. A credible AI policy acknowledges this risk and commits the organisation to addressing it. For organisations in sectors like recruitment, lending, insurance, or law enforcement, this is a particularly critical commitment to make visible.
Transparency and Explainability
People affected by AI decisions have a legitimate interest in understanding how those decisions were made. The policy should reflect the organisation's commitment to transparency, both internally (so that staff understand how AI systems work and what their limitations are) and externally (so that customers and other affected parties can seek explanation or redress).
Privacy and Data Protection
AI systems are often data hungry. The policy should acknowledge the organisation's commitment to handling personal information responsibly in the context of AI, consistent with its obligations under the Privacy Act and any other applicable requirements.
Accountability
The policy should make clear that the organisation accepts responsibility for the AI systems it deploys, even where those systems are developed or supplied by third parties. This is a significant commitment. It means the organisation cannot simply point to a vendor when something goes wrong. The AIMS, and the policy that anchors it, places accountability squarely with the organisation.
Documented Information, Communication, and Availability
Clause 5.2 requires the AI policy to be maintained as documented information. This means it must be controlled in accordance with the documented information requirements in Clause 7.5. It needs a version number, an approval date, an approving authority, and a review cycle. It must be stored in a way that ensures the current version is accessible to those who need it.
The policy must also be communicated within the organisation. This does not mean emailing it to staff once and ticking a box. Communication means ensuring that people who work within the scope of the AIMS understand the policy and their role in giving effect to it. Awareness requirements under Clause 7.3 reinforce this, requiring that relevant personnel know the AI policy and understand how their work contributes to it.
Finally, the policy must be available to interested parties as appropriate. In most cases, this means publishing the policy, or at least a summary of it, on the organisation's website or making it available on request. Customers, regulators, and the public increasingly expect organisations to be transparent about how they use AI. The policy is an important vehicle for that transparency.
Common Weaknesses Auditors Find in AI Policies
Having reviewed AI policies across a range of organisations, certain weaknesses come up repeatedly. Being aware of them will help you either write a stronger policy or conduct a more effective audit.
- Generic language with no connection to actual AI activities. Statements like “we use AI responsibly” mean nothing without specifics. The policy needs to reflect what the organisation actually does with AI.
- No link to AI objectives. If the policy does not provide a framework that flows through to measurable objectives, it is decorative rather than functional.
- Missing commitment to applicable requirements. Organisations sometimes list their AI principles without acknowledging the legal and regulatory requirements that bind them.
- Approved by someone below top management. The standard is explicit that top management must establish the policy. An AI policy signed off by a middle manager does not meet this requirement.
- Not communicated or not available. A policy that sits in a document management system but has never been shared with staff or published externally does not meet the communication and availability requirements.
- Never reviewed. A policy with an approval date from three years ago, in an organisation that has significantly expanded its use of AI since then, raises serious questions about whether it still reflects the organisation's context.
Exemplar Global Recognised Training ProviderRTP No. 310970How the AI Policy Connects to the Rest of the AIMS
The AI policy does not exist in isolation. It is the anchor for the entire management system. Understanding how it connects to other clauses helps you audit it more effectively and implement it more coherently.
The policy flows from the context work in Clause 4, which established the organisation's AI roles, its internal and external issues, and its interested parties. It feeds into the objectives in Clause 6.2, which translate the policy commitments into measurable targets. It informs the risk assessment in Clause 6.1.2, where the organisation identifies AI risks that need to be treated. It shapes the competence and awareness requirements in Clause 7.2 and 7.3, ensuring that people understand their role in giving effect to the policy. And it is reviewed as part of the management review process in Clause 9.3, where top management considers whether the policy remains appropriate.
If you are auditing the AI policy and want to assess its effectiveness rather than just its existence, trace these connections. Ask how the policy commitments are reflected in the risk assessment. Ask how they flow through to the objectives. Ask how staff awareness of the policy is measured. A policy that is genuinely integrated into the AIMS will have visible connections throughout the system. One that was written to satisfy a certification requirement will stand alone, disconnected from everything else.
For a deeper look at the leadership obligations that sit alongside the AI policy, the article on Leadership and Commitment in ISO 42001: What Clause 5.1 Requires provides useful context. And if you want to understand how the policy connects to the risk and opportunity work that follows in Clause 6, the walkthrough of AI Risk Assessment Under ISO 42001: A Clause 6.1.2 Walkthrough covers that ground in detail.
Writing an AI Policy That Will Satisfy an Auditor
If you are responsible for drafting or reviewing your organisation's AI policy, here is a practical checklist to work through before you consider it ready.
- Does the policy reflect the organisation's actual AI activities, not a generic description of AI?
- Does it cover all four structural requirements: appropriate to purpose and context, framework for objectives, commitment to requirements, commitment to continual improvement?
- Does it address the responsible AI themes relevant to your sector: human oversight, fairness, transparency, privacy, accountability?
- Has it been approved by top management, not delegated to a middle manager?
- Is it controlled as documented information with a version number, approval date, and review cycle?
- Has it been communicated to all relevant personnel, with evidence of that communication?
- Is it available to interested parties, either published or available on request?
- Does it provide a genuine framework that connects to your AI objectives?
If you can answer yes to all eight questions, you have a policy that will stand up to scrutiny. If any of those questions expose a gap, address it before the audit rather than during it.
For those looking to build competence in auditing AI management systems, including how to assess the AI policy and the broader AIMS, Audit Workshop offers training that covers ISO 42001 from a practical auditing perspective. The courses are built around real audit scenarios, not just clause by clause theory, which means you leave knowing how to actually apply the standard in the field.
