ISO 42001 Annex A 2.3 Alignment with other organisational policies
What it says
The organization shall determine where other policies can be affected by or apply to, the organization's objectives with respect to AI systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishWork out which of your existing organisational policies are affected by, or already apply to, your goals for AI systems, then amend or cross-reference them so the two do not contradict each other.
Your organisation already has rules written down for things like privacy, security, safety, records and hiring. This control asks you to look at what you want to do with AI (your AI objectives) and figure out which of those existing rules either touch the AI work or need updating because of it. For example, your privacy policy already covers personal information, so if an AI tool uses customer data, the privacy policy applies and may need a few extra lines about automated decisions.
Free. Save your status, tasks and notes.
Why it matters
If you never map your AI objectives against existing policies, an AI hiring tool can quietly breach your own anti-discrimination or recruitment policy and screen out a protected cohort, surfacing later as a complaint to the Australian Human Rights Commission or the OAIC. A chatbot trained on customer records can also collide with a privacy policy that never authorised that use, forcing you to switch the system off and notify affected individuals while you reconcile the two documents.
How to implement
Get whoever owns your management policies (often the company secretary or a governance lead) to pull together the full list of existing policies (privacy, information security, safety, quality, records, recruitment, procurement and the code of conduct) and run each one against your stated AI objectives to mark whether the objective affects that policy or that policy already applies to the AI work.
This is the determination the control actually asks for, so capture it in one register.
Have the privacy or data-protection policy owner check, line by line, whether the AI objectives bring new processing your current Privacy Act 1988 commitments do not cover, and add the missing wording (for example a note on automated decisions) directly into that policy rather than leaving it only in the AI policy.
Ask the information security lead to confirm whether your existing security policy already applies to AI models, training data and prompts, and where it does not reach, decide openly whether to widen the security policy or to handle the point in the AI policy so there is one clear owner per rule.
Where the AI objective touches people decisions, get the HR or recruitment policy owner to read those policies against the objective so any AI-assisted screening or monitoring stays inside your existing anti-discrimination and recruitment commitments before the tool goes live.
Follow the ISO 42001 Annex B.2.3 guidance and have a senior manager sign off the completed alignment register, recording for each policy whether it was amended, cross-referenced to the AI policy, or confirmed as unaffected, and set a trigger to redo this whenever a new AI objective or use case appears.
Keep it running
Keep a simple register that lists each existing policy (privacy, information security, safety, quality, records management, HR and recruitment, procurement, code of conduct) against a note on whether your AI objectives affect it, apply to it, or leave it untouched. Revisit the register whenever you set a new AI objective or stand up a new AI use case, because a policy that was irrelevant last year may now be in scope. Where you find a conflict or a gap, decide explicitly whether to amend the existing policy or carve the AI rule into your AI policy, and record which document now owns the point so nobody has to guess.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the register or matrix that maps AI objectives against the organisation's other policies.
Look at
Whether it actually lists named policies (privacy, security, safety, HR, records, procurement) and states for each one whether AI objectives affect it or apply to it, rather than just naming the AI policy.
Good evidence
The register names each existing policy, marks which are affected by or apply to the AI objectives, and points to the resulting amendment or cross-reference.
- Check 2 of 5What an auditor asks for
Ask for
Ask to see a policy that was amended because of AI, such as the privacy or recruitment policy.
Look at
Whether the tracked changes add AI-specific wording and carry a date and approver.
Good evidence
The amended policy shows dated, approved changes that address the AI objective identified in the alignment review.
- Check 3 of 5What an auditor asks for
Ask for
Ask the person who owns the AI policy which other policies it depends on and where that is written down.
Look at
Whether they can point to concrete cross-references between the AI policy and the security, safety and privacy policies rather than describing it from memory.
Good evidence
The owner shows two-way cross-references linking the AI policy to the specific other policies it relies on.
- Check 4 of 5What an auditor asks for
Ask for
Ask for evidence that the alignment review was repeated when a new AI use case was approved.
Look at
Whether the register has a change entry tied to a recent AI use case rather than a single one-off review.
Good evidence
The register has a dated entry showing it was rechecked when the new AI use case was introduced.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the gap analysis covering policies that were silent on AI.
Look at
Whether each gap records a decision to either amend the existing policy or cover the point in the AI policy.
Good evidence
Every identified gap carries a recorded decision naming which document now owns the AI-specific rule.
Mappings
Closest match in ISO/IEC 27001: A.5.1, Policies for information security, which partially overlaps with this control.
ISO/IEC 27001: 2 mappings
This control partially overlaps A.5.1.
Annex A 2.3 requires the organisation to determine where other organisational policies are affected by, or apply to, the organisation's objectives for AI systems. Annex A 5.1 requires defining, approving, communicating and periodically reviewing information security policies. They overlap because Annex A 2.3 will often drive updates to, and consistency checks against, information security policy sets governed under Annex A 5.1, but Annex A 5.1 is specifically about information security policy lifecycle rather than cross-policy AI alignment.
This control partially overlaps A.5.10.
Annex A 2.3 requires identifying which existing policies are impacted by or constrain AI objectives. Annex A 5.10 establishes acceptable-use rules for information and assets, which AI use (e.g., prompting, data entry, tool usage) can directly affect. The overlap is that AI objectives commonly necessitate updating acceptable-use rules, but Annex A 5.10 is a specific policy topic rather than an organisation-wide alignment requirement.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents