AI Policy: [Organisation name]

Top-level AI policy for an AI management system (AIMS), structured on clause 5.2 of ISO/IEC 42001:2023 and Annex A control objective A.2, with roles under clause 5.3 and a framework for AI objectives under clause 6.2. It states the organisation's commitments for developing, providing and using AI systems, the responsible AI principles, the prohibited and restricted uses (aligned with Article 5 of the EU AI Act, Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744), and the duties for risk and impact assessment, data, third parties, transparency, incidents and AI literacy. Replace every [bracketed] value and every row marked Example. This is a documentation format, not legal advice.

Document control

Approvals

Revision history

Contents

1. Purpose
2. Scope
3. Policy statement
4. How this policy meets clause 5.2
5. Responsible AI principles
6. AI objectives framework
7. Roles and responsibilities
8. Acceptable, restricted and prohibited uses
9. Risk and impact assessment
10. AI system life cycle
11. Data for AI systems
12. Third parties and customers
13. Transparency and information
14. Human oversight
15. Incidents and concerns
16. Competence, awareness and AI literacy
17. Exceptions
18. Compliance and monitoring
19. Policy review
20. Related documents
21. Glossary and references

1. Purpose

This policy sets the direction and commitments of [Organisation name] for the responsible development, provision and use of artificial intelligence. It establishes the AI management system, gives the framework within which AI objectives are set, and assigns accountability so that AI systems create value for [customers, citizens, patients or other beneficiaries] while risks to people, the organisation and society are identified and kept within accepted limits.

Example: As a provider of customer service software, we use AI to resolve customer requests faster. This policy makes sure that every AI feature we build or buy is safe, lawful, transparent to the people who use it, and supervised by accountable staff.

2. Scope

This policy applies to:

• all AI systems that [Organisation name] designs, develops, trains, fine-tunes, provides, deploys, operates, buys or integrates, including AI features embedded in third-party software and general-purpose AI models used through an API;
• all employees, contractors, temporary staff and partners who work with those systems on the organisation's behalf;
• all locations and business units listed in [SCOPE-AIMS-001].

Personal use of AI tools for work tasks is covered by the AI acceptable use policy, which implements section 8 of this policy for individual staff. Where the two conflict, this policy prevails.

3. Policy statement

Top management of [Organisation name] commits to:

1. Develop, provide and use AI systems only for purposes that are lawful, documented and aligned with our values and this policy.
2. Meet the legal, regulatory and contractual requirements that apply to our AI systems, including the EU AI Act where it applies to us, data protection law and sector rules.
3. Identify, assess and treat AI risks and impacts before deployment and throughout the life of each system, and accept residual risk only at the authority level set in the risk methodology.
4. Keep meaningful human oversight proportionate to the risk of each system.
5. Be transparent with the people who use or are affected by our AI systems about the role AI plays and its limits.
6. Provide the resources, competence and AI literacy measures needed to run the AIMS.
7. Set, monitor and review AI objectives within the framework in section 6.
8. Continually improve the suitability, adequacy and effectiveness of the AIMS.

Signed: [@ceo], [Chief executive officer], YYYY-MM-DD

4. How this policy meets clause 5.2

5. Responsible AI principles

6. AI objectives framework

AI objectives are set at least [annually] by the AI governance board, proposed by owners of AI systems and functions, and approved by top management. Each objective must:

• derive from at least one principle in section 5 or a requirement in the legal register;
• have a measure, a target, an owner, the resources needed, a due date and the method for evaluating results;
• be reviewed at each management review and updated when context changes.

7. Roles and responsibilities

8. Acceptable, restricted and prohibited uses

8.1 Acceptable uses

AI may be developed or used for a documented business purpose after the use case is registered through the AI use case intake process and the required reviews in section 9 are complete. Example: drafting customer replies for agent review, summarising internal documents, detecting anomalies in invoices, code assistance under the acceptable use policy.

8.2 Prohibited uses

[Organisation name] does not develop, provide, buy or use AI systems for any of the following practices. The list follows Article 5 of the AI Act, which has applied since 2 February 2025, and is extended by internal rules where marked.

8.3 Restricted uses (board approval required)

9. Risk and impact assessment

Every AI system in scope goes through these steps before deployment and on any material change:

Risk scoring, tolerance and acceptance authority follow the risk methodology [RISK-METH-001].

10. AI system life cycle

For each AI system the technical owner makes sure that:

• requirements, including performance, safety and fairness acceptance criteria, are documented before development starts;
• design decisions, data, models, prompts and evaluation results are recorded and version-controlled;
• verification and validation results meet the acceptance criteria before release, and a launch review records the decision;
• event logs are kept at least while the system is in use, with the retention period set in the logging standard;
• operation is monitored for performance, drift, misuse and incidents, with a documented rollback or shutdown procedure;
• technical documentation and user information are prepared for each audience that needs them;
• retirement is planned, including data and model disposal.

11. Data for AI systems

• Data used to train, fine-tune, evaluate or ground AI systems has a documented source, licence or lawful basis, and an owner.
• Data quality criteria are defined per use and checked before use.
• Provenance is recorded so the organisation can answer what data a model was built with and where it came from.
• Personal data is minimised, pseudonymised where possible, and processed under the privacy policy and DPIA.
• Customer data is used for AI training only when the contract allows it and the customer has been informed as agreed.

12. Third parties and customers

• Responsibilities between the organisation, suppliers, partners and customers are allocated in writing for each AI system.
• AI suppliers, including providers of general-purpose AI models, are assessed with the AI vendor risk questionnaire before contract and on renewal.
• Contracts include, as relevant: data use limits, security, incident and change notification, audit or evidence rights, documentation, model change notice, AI Act cooperation duties and exit support.
• Before rebranding, substantially modifying or repurposing a third-party AI system, legal reviews whether the change makes the organisation a provider under AI Act Article 25.
• Customer requirements and expectations for AI are captured and reflected in product decisions and documentation.

13. Transparency and information

• People are informed when they interact directly with an AI system, unless this is obvious from the context.
• Synthetic audio, image, video or text content is marked or disclosed where the law requires it, following the content transparency plan.
• User documentation states the intended purpose, known limitations and how to report problems.
• A summary of this policy is published for interested parties [location].

14. Human oversight

Staff assigned to oversight have the competence, authority and time to do it, and can override or stop the system without penalty.

15. Incidents and concerns

• Anyone can raise a concern about an AI system through [channel], with protection against retaliation under the speak-up policy.
• AI incidents and near misses (for example harmful outputs, data exposure, discriminatory results, unsafe actions by an agent) are reported to [[email protected]] and handled under the AI incident response plan.
• The incident manager assesses legal and contractual notification duties for each incident and records the decision.
• Lessons learned feed the risk register and the Statement of Applicability.

16. Competence, awareness and AI literacy

• The policy is communicated to all staff at onboarding and after each revision, and acknowledgement is recorded.
• Role-based AI literacy measures follow the AI literacy plan and take into account people's knowledge, experience and the context of use.
• People with AI governance, development, oversight or audit roles have documented competence, refreshed at least [annually].

17. Exceptions

Requests for an exception to this policy are submitted to the AIMS manager with the business reason, the risk, compensating measures and the end date. The AI governance board decides. Exceptions are recorded in the exceptions register, last no longer than [12 months] and are reviewed before renewal. No exception can be granted for a practice prohibited by law.

18. Compliance and monitoring

• The AIMS manager reports AIMS performance, objective status, incidents and audit results to top management at least [twice a year].
• Internal audit covers this policy within the AIMS audit programme.
• Breaches are handled under the disciplinary or contractual process and are recorded as nonconformities with corrective action (clause 10.2).

19. Policy review

The owner reviews this policy at least [annually] and also when: a new AI law or major amendment applies to the organisation; the organisation takes on a new AI role (for example becomes a provider); a serious AI incident occurs; management review or audit finds the policy ineffective; or the business strategy for AI changes. Each review is recorded in the revision history, even when no change is made.

20. Related documents

21. Glossary and references

References: ISO/IEC 42001:2023, clauses 5.2, 5.3, 6.1, 6.2, 7.2, 7.3, 9, 10 and Annex A (A.2 to A.10), Annex C; Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744 (consolidated text on EUR-Lex), Articles 4, 5, 14, 25, 26, 27, 50, 73 and Annex III; NIST AI RMF 1.0; ISO/IEC 42005:2025.

Standard and licence note

Structure aligned with ISO/IEC 42001:2023, clauses 5.2, 5.3 and 6.2 and Annex A control objective A.2. ISO/IEC standards are copyrighted: this template cites clause and control numbers only, and all policy text is original; obtain the standard for the normative requirements and check the current edition. The prohibited practices are summarised in original wording from Article 5 of Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744; EU legislative texts are free to reuse. Check the consolidated text on EUR-Lex for binding wording and application dates. This is a documentation format, not legal advice. Template licence: MIT.