ISO 42001 Clause 5.2: Write an AI Policy That Guides Real Choices

What clause 5.2 requires in practice

Clause 5.2 requires top management to establish an AI policy with four qualities. It suits the purpose of the organisation. It gives a framework for setting AI objectives. It includes a commitment to meet applicable requirements. And it includes a pledge to keep improving the management system.

The policy must also meet handling requirements. It is available as documented information, refers to other organisational policies where relevant, is communicated within the organisation and is available to interested parties as appropriate. The standard points to Annex A, theme A.2, for related controls on policy, and to Annex B for guidance, and mentions another standard for considerations when developing AI policies. A single document is not mandated; an integrated policy is acceptable if the required content is identifiable and controlled. What matters is that the policy gives genuine direction, so people can see how it shapes choices about AI use.

Write direction that survives a difficult decision

A useful policy helps people understand what the organisation is trying to achieve and what it expects when AI creates uncertainty. Avoid a collection of attractive words without a connection to the business. “Human oversight” means little if no process explains when a person reviews, what they can challenge and who has authority to act.

The policy need not contain every procedure. It can establish direction while linked instructions define particular use conditions. As an original drafting test, give a proposed policy to a process owner and ask which decision it would change. If no one can answer, the language may be too abstract.

Why a useful AI policy matters to the business

A policy that nobody can apply wastes the effort of writing it. A good one answers a practical question: when a team proposes a new use of AI, what is the organisation trying to achieve and what does it expect? It lets procurement recognise when an AI purchase needs assessment, helps front-line staff spot a use outside agreed conditions, and gives managers a stable basis for objectives. Because the policy can be shared with interested parties, it also supports customer confidence, provided it matches reality. Writing it to connect with security, privacy and quality policies avoids contradictions and duplicated effort, which saves time during audits and client reviews.

How to implement clause 5.2

The standard fixes the content and handling of the policy but not its style. A practical way to reach a usable document is to draft it against real decisions.

1. Gather the existing policies on security, privacy, quality and professional conduct, and note where AI creates questions they do not answer.
2. Draft statements of direction that fit the organisation's purpose, avoiding words such as oversight or fairness unless the supporting arrangements are understood.
3. Include the commitment to meet applicable requirements and the commitment to continual improvement in plain language.
4. Give the draft to a process owner and ask which decision it would change; rewrite any statement that changes nothing.
5. Make clear links to related policies instead of copying them, and to the objectives that will translate the policy into measurable results.
6. Approve the policy at top management level, store it as controlled documented information and decide which audiences receive which version.
7. Brief teams using realistic scenarios, and review the policy when scope, roles or obligations change.

Evidence an auditor expects for clause 5.2

The documented policy is the one item clearly required. Auditors then test whether it is alive in the business.

• The approved policy, with identification, date and approval that show it is controlled.
• Evidence of communication, such as briefings, onboarding material or staff explanations of how it affects their work.
• Cross-references to other policies and a clear link to the AI objectives.
• A decision on what is shared with interested parties and the version actually made available.
• Interviews in which managers describe a recent decision shaped by the policy.

Electronic acknowledgement alone rarely proves understanding.

Common nonconformities with clause 5.2

Typical findings show a policy that satisfies the wording of the clause but does not guide any real decision.

• The policy was copied from an AI developer's template although the organisation only uses purchased services.
• It contains attractive commitments but no link to objectives, so progress cannot be judged.
• Staff and managers cannot explain how it changes procurement or approval decisions.
• The policy is not available to the interested parties the organisation has itself identified, and no decision on this exists, so availability depends on chance.

Illustrative manufacturing example: inspection and employee assessment

Illustrative construction example: generated working material

A construction consultancy uses AI to draft meeting summaries and explore planning options. Its existing professional-practice policy governs authorised engineering decisions. The AI policy refers to that policy and clarifies how AI use fits the organisation's professional responsibilities.

Project teams then develop suitable instructions for distinguishing generated working material from approved information. Repeating the whole professional policy inside the AI policy would create maintenance problems. Ignoring the interface would create ambiguity. A relevant reference and a consistent operating route provide a more coherent result.

Communicate the meaning to different audiences

Internal communication should make the policy understandable to the people who apply it. Procurement needs to recognise when an AI purchase triggers assessment. Customer-facing teams need to avoid unsupported claims. Technical teams need to understand the direction behind development and evaluation requirements.

Availability to interested parties is qualified by appropriateness. Decide what version or explanation suits a customer, supplier or affected group. The clause does not demand unrestricted publication of sensitive operational details. Ensure that any public policy statement remains consistent with actual scope and practice.

Keep the policy aligned and controlled

Required evidence includes the documented policy and its required availability and communication. Review and approval, version control and access arrangements connect with documented information. The Annex A policy theme adds the control perspective on policy, alignment and review, selected through risk treatment.

Common weaknesses include copying a developer's policy into a user-only organisation, promising universal explainability without examining the systems used, or imposing responsibilities that conflict with existing security and quality policies. Another is treating an employee's electronic acknowledgement as proof that they can apply a difficult decision. Test understanding through relevant scenarios.

Connect the direction with AI objectives so management can evaluate progress. A policy that never informs objectives or operating choices is unlikely to guide the AIMS effectively.