Requirement
"The organization shall determine where other policies can be affected by or apply to, the organization's objectives with respect to AI systems."[1]
Explanation
AI rarely stands alone — security, privacy, quality, and HR policies all touch it. This control asks the organization to map where existing policies overlap with its AI objectives and either update them or handle the gap in the AI policy. Auditors look for evidence of that analysis and for consistent, non-contradictory policies.
Implementation Guidance
- Many domains intersect with AI, including quality, security, safety and privacy. The organization should consider a thorough analysis to determine whether and where current policies can necessarily intersect and either update those policies if updates are required or include provisions in the AI policy.
- Other information: The policies that the governing body sets on behalf of the organization should inform the AI policy. ISO/IEC 38507 provides guidance for members of the governing body of an organization to enable and govern the AI system throughout its life cycle.
References
- ISO/IEC 42001:2023 — Information technology — Artificial intelligence — Management system, A.2.3
- ISO/IEC 42001:2023 Annex B, B.2.3 (implementation guidance)
