ISO 42001 Annex A 9.2 Define and document processes for responsible use of AI systems
What it says
The organization shall define and document the processes for the responsible use of AI systems.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishYour organisation must define and write down the processes that govern how artificial intelligence (AI) systems are used responsibly.
This control asks your organisation to set out, in writing, how people are allowed to use your artificial intelligence (AI) systems in a responsible way. "Processes" here simply means the agreed steps, rules and ways of working that staff follow when they use an AI system in their day-to-day work. Think of it like a set of operating instructions for a piece of equipment. You would not let people use a forklift without a clear procedure for how to operate it safely. AI systems are similar. Without documented processes, each person decides for themselves what is acceptable, which leads to inconsistent and sometimes harmful use. Responsible use means things like checking AI output before acting on it, keeping people in the loop for important decisions, not feeding sensitive or confidential information into systems that should not see it, and using the AI only for the purposes it was approved for. The point of this control is to make those expectations explicit and written down, not left to assumption, so that everyone who touches an AI system knows exactly what they should and should not do. Because this is part of an AI management system (AIMS, the formal way your organisation manages AI), the processes need to be documented and kept current, not just spoken about informally.
Free. Save your status, tasks and notes.
Why it matters
Without documented processes, staff use AI inconsistently and unsafely, leading to errors, data exposure and unaccountable decisions that harm people and the organisation.
How to implement
The AI management system owner should write a short procedure for each AI system describing the approved uses, the steps staff must follow, and what is not allowed, then store it where all relevant staff can find it.
Managers should require staff to review AI-generated output before they rely on it or share it externally, and document this human-check step inside the use process so it is not skipped.
The compliance manager should define rules on what information can and cannot be entered into each AI system, especially personal, confidential or commercially sensitive data, and record these rules in the documented process.
Department heads should map out where AI fits into existing workflows and specify the points where a person must stay involved in or approve a decision, writing these checkpoints into the process document.
The AI management system owner should schedule a regular review (for example every six or twelve months) to update each documented process when the AI system, its purpose or the law changes, and keep dated versions as a record.
Keep it running
Keep each AI system's responsible-use process current; review it whenever the system, its purpose or relevant law changes, and confirm staff follow it.
Evidence and audit
- Check 1 of 2What an auditor asks for
Ask for
the documented processes covering responsible use of each AI system the organisation runs, and confirm a process exists for every system in use, not just one or two.
Look at
whether each process actually describes how the system should be used: approved purposes, required human checks, data handling rules and restrictions, rather than vague statements of intent.
- Check 2 of 2What an auditor asks for
Ask for
staff who use the AI systems to explain the process they follow, and check that what they describe matches the documented version, showing the process is real and not just paperwork.
Look at
version history or review dates on the process documents to confirm they are kept current and updated when systems or purposes change.
Good evidence
clear, current, written processes for responsible use that name approved uses, prohibited actions and human oversight points, with evidence that staff understand and follow them.
Mappings
Closest match in ISO/IEC 27001: A.5.10, Acceptable use policies for information and assets, which partially overlaps with this control.
ISO/IEC 27001: 1 mapping
This control partially overlaps A.5.10.
Annex A 9.2 requires the organisation to define and document processes for responsible AI use, including how AI tools should and should not be used. Annex A 5.10 requires acceptable use rules and handling procedures for information and associated assets, which can overlap where AI use affects data handling, prompts, outputs, and use of AI services as an organisational asset. Annex A 5.10 is not AI-specific and may omit AI lifecycle concerns (e.g. model limitations, human oversight), while Annex A 9.2 is not limited to information-security acceptable use.
ASD Information Security Manual: 1 mapping
This control partially overlaps ISM-2074.
Annex A 9.2 requires the organisation to define and document processes for the responsible use of AI systems. ISM-2074 requires a general-purpose AI usage policy to be developed, implemented and maintained, which provides the governance vehicle that typically drives and anchors those responsible-use processes. ISM-2074 is policy-focused, while Annex A 9.2 is process-focused and can extend beyond a single policy into operational workflows, approvals, monitoring and escalation.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.
Get help with this control
ISO 42001 training
Mindset Cyber runs PECB-accredited ISO/IEC 42001 training that maps directly to the AI controls in this library.
Turn this control into your AI policy
PolicyMint writes customised ISO 42001 policy documents for your business, audit-ready and exported in your branding (Word, PDF, Excel). Skip the blank page and the boilerplate that does not fit. First document free.
Draft your ISO 42001 documents