ISO/IEC 42001
Clause 5.2 — AI policy
An AI policy is not an ethics statement. Clause 5.2 places the duty on top management and asks for something operational: a policy suited to the organisation’s purpose that provides the framework within which AI objectives are set, commits to the requirements that apply and to improving the system, and is documented and communicated inside the organisation.
§ 1 — In practice
The test a policy has to pass
The working test for an AI policy is whether an objective can be derived from it. Clause 5.2 asks for a policy that provides the framework within which the organisation’s AI objectives are set, so a document from which no objective follows has not done the job, however carefully it was drafted. That is what separates a policy from a charter of principles, and the difference is not semantic: statements of principle are written to be agreed with, and a framework for objectives is written to be applied. It is also why the policy is read against the scope statement rather than on its own — a commitment reaching further than the boundaries of the management system commits the organisation to something the system does not manage.
Two properties of the clause are structural rather than editorial. The first is authorship: the duty rests on top management, so a policy drafted by a governance function and never formally adopted is unowned, and adoption has to be a dated, attributable act rather than an appearance on an intranet. The second is fit — the policy has to suit what the organisation actually does, which means an AI policy contradicting the organisation’s security, procurement or data-protection instruments is a defect in the management system rather than an inconsistency to be tidied later. Where the organisation has worked through Annex A and Annex B, the applicability decisions recorded there and the commitments made in the policy have to be capable of standing next to each other.
Two limbs of the clause are routinely traded against each other. Communication inside the organisation is the one with teeth and the one evidenced most thinly, because communication is measured by reach rather than by circulation: who received the policy, in what form, and whether the people whose work it governs can say what it requires of them. Availability beyond the organisation is the limb that attracts effort, and the effort usually produces a second, thinner document written for a website — which is then the version an assessor finds first, sitting beside an internal policy that says something slightly different. Where the organisation is also a deployer of a high-risk system in the Union, the staff bound to follow instructions for use under Article 26 are precisely the population the internal limb has to reach.
§ 2 — What discharges it
What the policy file must show
The artefacts an assessor asks to see, and what makes each one sufficient rather than merely present.
01
The dated adoption record of the policy by top management
Who approved it, on what date, and in what forum. An assessor is looking for an act of adoption attributable to a person with authority to bind the organisation, not for a document carrying a version number and an author field.
02
A derivation trace from the policy to each AI objective
One line per objective naming the part of the policy it answers. Objectives tracing instead to an operational plan are evidence that the document is not functioning as the framework this clause asks it to be.
03
The alignment analysis against other organisational instruments
Which policies were compared, what conflicts emerged, and how each was resolved. Where nothing emerged the record should still show what was examined, because an unrecorded comparison and an unperformed one look identical afterwards.
04
A communication record showing reach rather than circulation
Which populations received it, by what means, and what proportion of the roles it governs is covered. A link on an intranet page establishes availability and says nothing about whether anyone was reached.
§ 3 — Who it binds
Who owes it
Audited organisation
Any organisation operating an AI management system to ISO/IEC 42001, from the point at which it claims conformity. The duty sits with top management rather than with the function that drafts the document, and it does not scale down: a single-team AIMS needs a policy from which its objectives derive exactly as a group-wide one does. Where the organisation holds several roles in relation to AI systems, one policy still has to cover all of them.
§ 4 — Worked example
Worked example — three objectives, none from the policy
A payments company adopts a two-page AI policy signed by the chief executive. It commits the company to fairness, transparency, human accountability and compliance with applicable law, and states that no AI system will be deployed without review. Three AI systems are in production. The AI objectives set for the year are: reduce model incident response time, complete supplier due diligence for two vendors, and deliver awareness training to the operations team.
The policy is adopted, signed and circulated. Where does it fall short?
On the framework limb rather than the commitment limb. Trace each objective backwards: incident response time comes from an operations metric, supplier due diligence from a procurement programme, awareness training from a training plan. None derives from anything the policy says, and nothing the policy says would have produced a different set — which is the test. Fairness, transparency and accountability are positions, and a position cannot generate an objective because it names no property that can be set at a level and then missed. The second defect is the deployment review sentence: it commits the company to a control the document locates nowhere, so nobody can say who performs the review, what it decides, or what follows when it is skipped. Neither defect is cured by re-signing. The policy has to name the areas in which the organisation will set objectives — the properties of its AI systems it intends to manage — at a specificity from which a measurable objective can actually be written.
§ 5 — What a weak answer looks like
A charter of principles
The charter of principles offered as the policy. A page of commitments — fairness, accountability, transparency, human oversight — endorsed at board level, published, and genuinely believed. It fails on one question, and always the same one: name an AI objective it produced. Nothing in it can be exceeded, missed or scoped, so it binds the organisation to a disposition instead of to a framework, and the objectives that do get set turn out to have been written by whoever owned the budget. The document is not wrong. It is doing a different job.
§ 6 — When it applies
Which edition this is
31 December 2023
Publication date of the BSI adoption of the first edition, BS ISO/IEC 42001:2023. This is an edition date, not a compliance deadline: ISO/IEC 42001 is voluntary and nothing falls due on anyone on this date.
31 March 2026
European and UK adoption, BS EN ISO/IEC 42001:2026. BSI states there are no technical differences between it and BS ISO/IEC 42001:2023, so the requirements and guidance are unchanged; again an edition date rather than a deadline.
§ 7 — Elsewhere
The commitments a policy has to carry
Where another instrument addresses the same obligation. These are correspondences, not comparisons — the Council does not rank one framework against another.
Article 26 requires a deployer of a high-risk system to use it in accordance with the instructions for use and to assign human oversight to people with the competence and authority to exercise it — internal duties a policy commitment has to be capable of carrying.
NIST AI RMF
The NIST-hosted crosswalk maps the GOVERN 1.1 and GOVERN 2.3 subcategories of the AI Risk Management Framework onto clause 5.2, which is the route between an AIMS policy and an organisation working to that framework instead.
A correspondence indicates that two instruments address the same underlying obligation. It is not a mapping endorsed by either body, not a statement that one satisfies the other, and not a judgement about which is more demanding.
§ 8 — provenance
The provision itself
This page sets out what the instrument requires and what discharges it. The official text is the authority — these go straight to it.
- Official contents page of ISO/IEC 42001:2023 in the free document preview — clause 5.2 AI policy, within clause 5 Leadership.
- BSI Knowledge product record for BS ISO/IEC 42001:2023, published 31 December 2023, status Current, identical to ISO/IEC 42001.
- BSI Knowledge product record for BS EN ISO/IEC 42001:2026, published 31 March 2026: no technical differences from BS ISO/IEC 42001:2023.
- NIST-hosted crosswalk between the NIST AI RMF and ISO/IEC 42001, attributed on the AIRC crosswalks index to Microsoft; a contributed document rather than NIST guidance.
§ 9 — Also read
Also read
Annex A and Annex B — both normative
Certification
Assessed on the same standard of evidence
Every Council credential is examined on applied judgement against a published anchor, set out the way the obligations on this page are. The Certified Applied AI Associate, the Council’s flagship, is open to any adult today, its fee waived by a coupon code from the AI-Readiness Check, and the register lists what is open for enrolment.