ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 42001 policy template is rarely a single document. The standard expects a
policy layer covering how AI is acquired, built, used and retired — and organisations that write one
“AI policy” and stop are the ones that discover the gap at their first audit.
ISO/IEC 42001:2023 is the first edition of the AI management system standard, published December
2023. It uses the harmonized structure — clauses 4 to 10 — so the management-system scaffolding will
look familiar to anyone who has run an ISMS or a QMS.
What is not familiar is Annex A. Like ISO 27001, the standard carries a control annex and requires
a Statement of Applicability recording which controls apply and why. That single requirement shapes
the policy set: your policies are how you claim the applicable controls are met, so they have to map
onto the annex rather than read as general good intentions about responsible AI.
| Policy | The question it settles |
|---|---|
| AI risk management | How AI risk is identified, assessed, treated and accepted, and by whom |
| AI tool usage | Which systems staff may use, for what, and what must never go into one |
| Generative AI acceptable use | The general-purpose tools people already use, treated explicitly |
| AI development and deployment | How systems are built, evaluated and released, and what gates apply |
| AI change control | What counts as a change to a model, and what re-approval it triggers |
| AI data protection and data governance | Training data provenance, personal data in AI, retention and security |
| AI incident recording and reporting | What an AI incident is, and who is told within what time |
Read that list and the shape becomes clear: an ISO 42001 policy template set is mostly about
decisions that already have owners elsewhere in the business — procurement, security, data protection,
engineering — being made explicit for AI.
Most policy sets handle acquisition and use well and then treat a model as static. It is not. A
retrained model, a new base model version, a changed prompt or a widened use case can all alter
behaviour materially without any code being deployed.
So the change control policy has to define what counts as a change worth re-approving, and what
evidence is required before it goes back into service — usually a re-run of the impact assessment and
the bias and fairness tests. Sets that omit this produce a system that was assessed once, at launch,
and never again, which is exactly the state an auditor is looking for.
The policy set, the procedures under it, and the records that prove it.
The ISO 42001 Toolkit ships 70 items in clause order — AI risk management, tool usage, generative AI acceptable use, development and deployment, change control, AI data protection and incident reporting policies; procedures for context, scope, risk and impact assessment, risk treatment and operational control; and the registers that carry the evidence: AI system inventory, automated decision-making register, training data registry, human oversight log, bias and fairness testing records, prohibited practice screening and a Statement of Applicability.
A policy asserting that AI systems are inventoried, that human oversight applies to consequential
decisions, and that models are tested for bias is worth nothing without the records behind it. Four
registers do most of that work.
Bias and fairness testing records and prohibited practice screening sit alongside them for
organisations touching the EU market, where certain practices are banned outright rather than merely
high-risk.
ISO 42001 is certifiable. The NIST AI
RMF is a voluntary framework with no certification, and the EU AI Act is law with obligations that
follow from how a system is classified. The evidence overlaps heavily; the force does not.
Practically, write the policy set once against ISO 42001 — because it is the most prescriptive
about documentation — and maintain a crosswalk to the other two. Our comparison of
ISO 42001 and the NIST AI RMF covers
which to lead with, and
ISO 42001 versus the EU AI Act covers
the regulatory side.
Two things stay with you. The first is risk appetite — what error rate, in what context, is
acceptable. No template can set that, and an AI policy that does not state it has avoided the question
rather than answered it.
The second is where a human must remain in the loop. Writing an oversight procedure is easy;
deciding which decisions may never be fully automated is a business judgement, and it is the one both
customers and regulators probe hardest.
An AI management system is certified against a stated scope, and the first draft is almost always
too narrow — because it covers the AI the organisation built and misses the AI it bought.
Three categories get overlooked. Embedded AI inside procured software, which arrives through a
purchasing route that never triggered a review. General-purpose assistants that staff adopted
individually, often the most-used AI in the business. And supplier-side AI, where a processor uses
a model on your data under a contract that predates anyone thinking about it.
Scope the inventory before you scope the AIMS, and write the policy set against what the inventory
finds. An ISO 42001 policy template applied to an imagined estate gets rewritten within a quarter.
Three habits separate a policy set that survives assessment from one that reads well and fails.
Is one AI policy enough for ISO 42001?
Rarely. The standard’s Annex A spans acquisition, development, use, data and incidents, and a single
document covering all of them tends to be too shallow to demonstrate any of them.
Does ISO 42001 require a Statement of Applicability?
Yes. Like ISO 27001, it carries a control annex and expects you to record which controls apply, with
justification for any excluded.
Do we need a separate generative AI policy?
In practice yes, because general-purpose tools are already in use, the risks differ from bespoke
models, and staff need a clear answer about what they may put into a prompt.
Can an ISO 42001 policy template satisfy the EU AI Act?
Not by itself. The evidence often transfers, but obligations under the Act depend on risk
classification, so a crosswalk is needed rather than an assumption.
Which edition is current?
ISO/IEC 42001:2023, the first edition, published December 2023.
Order matters, because several policies depend on decisions made in others.
Start with the inventory, then the risk management policy —
because it sets the appetite and the assessment method everything else refers to. Then the
usage policies, which are the ones staff actually need and the ones that reduce risk
fastest. Development, deployment and change control follow for organisations building their own
systems, and can be light for organisations that only buy.
Incident recording comes last in drafting and first in importance the day something goes wrong, so
do not leave it undrafted. A short, clear definition of what counts as an AI incident is worth more
than a long procedure nobody reads.
Treat the ISO 42001 policy template as a set rather than a document, and build it against Annex A
so each policy is traceable to a control you claim to meet. Cover change control explicitly, because
a model that drifts after launch is the most common gap.
Then put the registers in place. Policies are claims, and an AI management system is assessed on
whether the inventory, the oversight log and the testing records show them operating.
The full set is available as the ISO 42001 Toolkit, or start with the free ISO templates.
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026
August 31, 2026