ISO/IEC 42001 FAQ AI Policy

Top management must establish the AI policy. It must fit the organisation's purpose, provide a framework for AI objectives, commit to applicable requirements and continual improvement of the AIMS, refer to other organisational policies where relevant, be documented and communicated internally, and be available to interested parties as appropriate. Availability does not always mean public posting; record which parties need access, in what form, and why.

Annex B guidance says the policy should reflect business strategy, values and culture, risk tolerance, AI-system risk, legal and contractual requirements, the risk environment, and impacts on interested parties. It should also set guiding principles and a process for deviations and exceptions. It can cross-reference topic policies instead of repeating security, privacy, safety, quality, procurement, data, or product rules.

Keep the current approved policy, version history, review record, communication evidence, and records showing that people under the organisation's control know the policy and understand their contribution and the consequences of nonconformity. Trace commitments to AI objectives, responsible-development or use processes, risk-treatment decisions, and any affected topic policies. For an exception, retain the request, affected commitment, rationale, risk or impact review, approving authority, conditions, expiry date, and closure or renewal decision.

Top management establishes the policy and remains responsible for leadership and commitment. Management may approve a role to develop, review, and evaluate it, but assigning maintenance does not transfer top management's accountability.

Owners of affected security, privacy, safety, quality, procurement, data, product, legal, or risk policies should review proposed changes within their authority. Route changes in organisational direction, risk tolerance, commitments, or resources back to top management.

Review the policy at planned intervals and additionally when needed to ensure continuing suitability, adequacy, and effectiveness. ISO/IEC 42001 does not set one universal review frequency. Relevant triggers can include changes to the AIMS scope, organisational environment, business circumstances, legal or contractual conditions, technical environment, AI objectives, risk tolerance, AI uses, material impact findings, or management-review results.

Record the review result even when no change is needed; when the policy changes, update affected objectives, procedures, communications, awareness material, control ownership, and operating evidence rather than treating approval as the final step.