ASD ISM 2074 Develop and maintain AI usage policy
What it says
A general-purpose AI usage policy is developed, implemented and maintained.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishOrganisations must create and update policies for using AI systems.
This control requires organisations to have guidelines on using Artificial Intelligence (AI). It matters because AI can impact privacy and decision-making, and unregulated use could lead to data breaches or unethical outcomes.
Free. Save your status, tasks and notes.
Why it matters
Without a clear AI usage policy, organisations may face legal issues and ethical breaches, leading to damage to reputation and trust.
How to implement
Managers should prepare a draft AI usage policy.
Identify the AI tools in use and outline permissible types of data and functions for each tool to ensure responsible use.
The compliance team should review legal and ethical guidelines.
Ensure that AI use doesn't violate privacy laws or ethical norms by aligning the policy with Australian laws and standards.
Human Resources should train staff on AI policy.
Conduct workshops to explain what the AI usage policy covers, illustrating with real-world scenarios on acceptable and unacceptable use.
IT teams should monitor AI systems regularly.
Set up checks to track AI decision-making processes, ensuring they operate within policy guidelines and highlight unusual behaviour.
Management must periodically review and update the AI policy.
Schedule annual reviews to address new developments in AI technology and legislative changes that affect AI use.
Keep it running
Regularly update AI usage policy to adapt to new legal requirements and technological advancements, ensuring continued compliance and ethical use.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
the AI usage policy document.
Look at
its structure and content to ensure it covers data types, allowed AI tools, and user responsibilities.
Good evidence
shows a comprehensive policy aligning with laws and ethical standards.
- Check 2 of 5What an auditor asks for
Good evidence
includes up-to-date records with details of each AI tool's purpose and scope.
- Check 3 of 5What an auditor asks for
Ask for
training records on AI policy.
Look at
attendance records and training materials to ensure staff understand and follow the policy.
Good evidence
shows widespread staff participation and clear instructional content.
- Check 4 of 5What an auditor asks for
Look at
intervals and findings to ensure regular analysis of AI outputs against policy standards.
Good evidence
includes recent review entries and identified adjustments where necessary.
- Check 5 of 5What an auditor asks for
Ask for
records of policy reviews. Check dates and notes to ensure policy updates reflect current AI and legal standards.
Good evidence
shows regular updates and rationales for changes.
Mappings
Closest match in ISO/IEC 42001: A.2.2, AI policy, which asks for the same thing.
ISO/IEC 27001: 3 mappings
This control partially meets A.5.1.
ISM-2074 requires an organisation to develop, implement and maintain a general-purpose artificial intelligence usage policy. Annex A 5.1 requires the organisation's information security and topic-specific policies to be defined, approved, communicated, acknowledged and periodically reviewed, which is the broader governance mechanism under which an AI usage policy would be created and maintained. ISM-2074 is effectively one topic-specific policy requirement within the wider policy framework mandated by Annex A 5.1.
This control partially meets A.5.10.
Annex A 5.10 requires organisations to set and implement acceptable use rules for information and assets. ISM-2074 maps as a specific acceptable-use policy area by mandating a general-purpose AI usage policy governing how personnel use AI tools in ways that can affect information handling and access. ISM-2074 is narrower (AI tool usage), whereas Annex A 5.10 encompasses acceptable use rules for all relevant technologies and assets.
This control supports A.5.4.
ISM-2074 requires an organisation to have a documented and maintained policy governing general-purpose AI usage. Annex A 5.4 requires management to ensure personnel apply information security in accordance with established policies and procedures, which is critical to making the AI usage policy enforceable in practice. Without management responsibility and direction (Annex A 5.4), implementing and sustaining compliance with ISM-2074's AI usage rules is unlikely to be effective.
ISO/IEC 42001: 5 mappings
This control is equivalent to A.2.2.
Annex A 2.2 requires the organisation to document an approved policy governing the development or use of AI systems and defining its scope. ISM-2074 specifically requires a general-purpose AI usage policy to be developed, implemented and maintained, which directly satisfies the need for a documented AI policy. ISM-2074 is framed around "usage" (and adds implementation/maintenance expectations), while Annex A 2.2 explicitly covers both development and use and emphasises defining what AI activities are in-scope.
This control partially overlaps A.2.4.
Annex A 2.4 requires the organisation to review its AI policy at planned intervals and when needed to ensure it remains suitable, adequate and effective. ISM-2074 requires the organisation to develop, implement and maintain a general-purpose AI usage policy, which would be one of the key AI policies subject to review under Annex A 2.4. ISM-2074 is broader on policy creation/implementation, while Annex A 2.4 is specifically about the ongoing review and continued effectiveness of the AI policy.
This control partially overlaps A.6.1.2.
Annex A 6.1.2 requires the organisation to set and document responsible-development objectives for AI systems and integrate them into the development life cycle through measures and checkpoints. ISM-2074 requires an AI usage policy, which can operationalise organisational expectations and constraints that inform those responsible-development objectives and the acceptance criteria for release. The overlap is AI governance and documented intent, but ISM-2074 focuses on use and user behaviour post-deployment rather than SDLC integration of development objectives.
This control partially overlaps A.9.2.
Annex A 9.2 requires the organisation to define and document processes for the responsible use of AI systems. ISM-2074 requires a general-purpose AI usage policy to be developed, implemented and maintained, which provides the governance vehicle that typically drives and anchors those responsible-use processes. ISM-2074 is policy-focused, while Annex A 9.2 is process-focused and can extend beyond a single policy into operational workflows, approvals, monitoring and escalation.
This control partially overlaps A.9.3.
Annex A 9.3 requires the organisation to identify and document objectives that guide the responsible use of AI systems (e.g. fairness, safety, transparency, human oversight and legal compliance). ISM-2074 requires developing and maintaining a general-purpose AI usage policy, which typically operationalises those objectives into rules and expectations for staff and projects. The overlap is that both set direction for how AI is used responsibly, but Annex A 9.3 is specifically about defining objectives/targets, whereas ISM-2074 is about the policy instrument and its lifecycle (implementation, maintenance and enforcement).
ASD Essentials for enterprise IT: 1 mapping
- IT.GOV-08.1Name an executive accountable for AI use, governance and risk managementPartially overlaps
This control partially overlaps IT.GOV-08.1.
IT.GOV-08.1 requires executive accountability for the use, governance and risk management of artificial intelligence; ISM-2074 supports the governance side, requiring a general-purpose AI usage policy to be developed, implemented and maintained.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.