ISO 42001 Annex A 2.2 AI policy
What it says
The organization shall document a policy for the development or use of AI systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishThe organisation writes down an approved policy that sets the rules for how it builds and uses AI systems, and states which AI activities the policy covers.
Your organisation needs one written, approved document that says how it is allowed to build and use AI systems: things like what AI may be used for, what is off limits, and what rules people must follow. The policy should also say plainly which AI work it governs (for example, only customer-facing AI, or every AI tool staff touch), so nobody has to guess whether it applies to them. AI system means software that learns patterns from data to make predictions or decisions, such as a chatbot or a tool that scores job applicants.
Free. Save your status, tasks and notes.
Why it matters
If there is no documented AI policy, a team can quietly launch something like an automated loan-decline or resume-screening tool with no agreed rules, and when it rejects a protected cohort, the organisation has no written position to point to when a regulator such as the Office of the Australian Information Commissioner (OAIC) asks who authorised it and on what basis. Auditors treat a missing or undated AI policy as a top-level gap that can fail the whole management system, and remediation means halting AI projects until the policy is written and approved. The absence also leaves staff inventing their own rules for both building and using AI, so practice varies team to team with no way to enforce a baseline.
How to implement
Get an accountable leader or the leadership team to approve a single AI policy that states the organisation's intent for AI and the limits on it: for example which uses are allowed, which are banned, and what decisions AI must never make alone.
Hold a short session to agree these points, then capture them in one document rather than scattering rules across emails.
Whoever owns the policy should write a clear scope section at the front saying exactly which AI activities it governs (building your own models, using bought-in AI tools, staff use of generative AI, or all of these) so the document maps directly to the development-or-use wording in the requirement and no team is left guessing.
Make sure the policy speaks to both halves of the requirement: have a section on developing AI systems (how models are built, tested and documented) and a separate section on using AI systems (how staff and the business may operate them day to day), so neither side is left uncovered.
Put a version number, an approval date and the approver's name on the document, and store it where staff can find it, so anyone can confirm they are reading the current approved rules rather than an old draft.
The policy owner should set a trigger to revisit the policy whenever AI use changes materially or a relevant law moves, write the new review date into the document, and circulate a short note to staff summarising what changed.
Keep it running
Date and version every release of the policy and record who approved it, so the current rules are never in doubt. Refresh it whenever AI use materially changes or a relevant law shifts (such as new EU AI Act obligations or Privacy Act 1988 reforms), rather than waiting for a fixed annual slot. Make sure the scope statement still matches reality. If the organisation starts developing its own models when the policy only covered buying AI, the scope line has to be updated.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Request the current AI policy document and the record of who approved it and when.
Look at
A version number and an approval date near the top, and a named approver or approving body rather than an anonymous draft.
Good evidence
The organisation produced a single approved, dated AI policy that an accountable leader or committee signed off.
- Check 2 of 5What an auditor asks for
Ask for
Read the scope section of the policy.
Look at
Whether it states plainly which AI activities are covered: building AI, buying AI, staff using AI tools, or all of these.
Good evidence
The policy clearly names the AI development and use activities it governs so a reader can tell whether their work is in scope.
- Check 3 of 5What an auditor asks for
Ask for
Ask whether the policy covers both building AI and using AI, and point to where each is addressed.
Look at
Sections or rules that deal with developing AI systems and separate ones that deal with using or operating them.
Good evidence
The policy addresses both the development and the use of AI systems, matching the requirement, not just one of the two.
- Check 4 of 5What an auditor asks for
Ask for
Request the policy's revision history or change log.
Look at
Dated entries showing the policy has been reviewed or updated, and a recent enough last-review date to still reflect current AI use.
Good evidence
The change log shows the policy is kept current and was reviewed after the most recent material change in AI use or law.
- Check 5 of 5What an auditor asks for
Ask for
Ask how staff are told about the AI policy and request the proof.
Look at
An intranet link, a circulated email, or an acknowledgement register showing people received it.
Good evidence
The organisation can show the approved policy was published to the people expected to follow it.
Mappings
Closest match in ASD Information Security Manual: ISM-2074, Develop and maintain AI usage policy, which asks for the same thing.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.1.
Annex A 2.2 requires a documented policy governing AI system development or use. Annex A 5.1 supports this by setting the organisational expectations for policies to be defined, management-approved, published, communicated, acknowledged, and reviewed-attributes that an AI policy created under Annex A 2.2 would typically need to meet. Annex A 5.1 is information-security-policy governance generally and does not itself establish AI-specific policy content or scope.
ASD Information Security Manual: 1 mapping
This control is equivalent to ISM-2074.
Annex A 2.2 requires the organisation to document an approved policy governing the development or use of AI systems and defining its scope. ISM-2074 specifically requires a general-purpose AI usage policy to be developed, implemented and maintained, which directly satisfies the need for a documented AI policy. ISM-2074 is framed around "usage" (and adds implementation/maintenance expectations), while Annex A 2.2 explicitly covers both development and use and emphasises defining what AI activities are in-scope.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents