Requirement
"The organization shall document a policy for the development or use of AI systems."[1]
Explanation
This control requires a written AI policy — the top-level statement of how the organization develops or uses AI systems. It is usually the first document an auditor asks for, and they expect it to reflect business strategy, risk appetite, and legal obligations, to be approved by management, and to anchor every other AI control.
Implementation Guidance
- The AI policy should be informed by:
- business strategy;
- organizational values and culture and the amount of risk the organization is willing to pursue or retain;
- the level of risk posed by the AI systems;
- legal requirements, including contracts;
- the risk environment of the organization;
- impact to relevant interested parties (see 6.1.4).
- The AI policy should include (in addition to requirements in 5.2):
- principles that guide all activities of the organization related to AI;
- processes for handling deviations and exceptions to policy.
- The AI policy should consider topic-specific aspects where necessary to provide additional guidance or provide cross-references to other policies dealing with these aspects. Examples of such topics include:
- AI resources and assets;
- AI system impact assessments (see 6.1.4);
- AI system development.
- Relevant policies should guide the development, purchase, operation and use of AI systems.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.2.2
- ISO/IEC 42001:2023 Annex B, B.2.2 (implementation guidance)
