An ISO/IEC 42001 AI policy must fit your purpose, frame your AI objectives, commit to meeting applicable requirements and to continual improvement, and be communicated and reviewed. If you run agents that act, it must also say who may grant an agent authority, on what evidence, which actions no agent may take, and how that authority is reviewed and withdrawn.
What does ISO/IEC 42001 require of the AI policy?
The standard requires top management to establish an AI policy. In substance, the policy must:
- be appropriate to the organisation's purpose;
- provide a framework for setting AI objectives;
- include a commitment to meet applicable requirements;
- include a commitment to continual improvement of the AI management system;
- be documented, communicated within the organisation and available to interested parties as appropriate.
The standard's control set adds that the policy should be documented, take account of other organisational policies such as information security, privacy and quality, and be reviewed at planned intervals. Our explainer on what ISO/IEC 42001 is covers the wider system the policy sits in.
Who does it apply to?
Any organisation implementing an AI management system under ISO/IEC 42001, whether it develops AI, provides it or only uses it. The policy is the top document of the system; everything else should trace back to it.
Why do agents need more than a generic AI policy?
Most AI policies were written for tools that produce outputs people then use. They speak of acceptable use, data handling, transparency and bias. All still apply. But an agent that acts creates questions a generic policy leaves open:
- Who in the organisation may authorise an agent to take an action on its own?
- What evidence is needed before that authority is given?
- Are there actions no agent may take, however good the evidence?
- How long does authority last, and what removes it?
- Who must be able to stop an agent, and how quickly?
Without answers, these decisions get made team by team, often in a vendor console. The policy is where top management decides them once.
What should an agent-aware AI policy contain?
A policy should be short enough to be read. Detail belongs in procedures. These are the statements that matter for agents:
- Scope. The policy covers AI systems the organisation develops, provides or uses, including agents that take actions in its systems or towards customers.
- Purpose and principles. AI is used to serve customers and the organisation within law and risk appetite; people remain accountable for outcomes.
- Accountability. Each agent has a named business owner accountable for what it does.
- Authority to act. Agents may read, draft, execute routine work, move money or take hard-to-undo actions only as specifically authorised per capability by a named role, on documented evidence.
- Evidence. Authority is granted on the basis of testing on the organisation's own cases and withdrawn when evidence lapses or performance falls.
- Prohibited actions. A list, maintained by risk, of actions no agent may take.
- Human oversight. Every agent capability can be stopped; decisions significantly affecting people have defined human involvement.
- Data. Agents use only the data needed for their purpose and comply with privacy and information security policies.
- Change. Changes to an agent's instructions, sources, model or permissions follow change control.
- Transparency. People are told when they deal with an agent and how to reach a person.
- Objectives and improvement. AI objectives are set and reviewed; incidents and findings drive improvement.
- Review. The policy is reviewed at a set interval and after significant change.
How do you show the policy works?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Appropriate to purpose | Policy approved by top management with reference to business context | Board or executive approval |
| Framework for objectives | Objectives derived from the policy, such as no agent acting without current certification | Objectives register |
| Commitment to requirements | Policy references legal and contractual requirements | Requirements register |
| Commitment to improvement | Incidents and audit findings tracked to closure | Improvement log |
| Communicated and available | Policy published internally; summary for customers where relevant | Intranet record; published summary |
| Aligned with other policies | Cross-references to security, privacy and risk policies | Policy map |
| Reviewed at planned intervals | Review dates set and met | Review records |
The objectives row is where agents make the policy concrete. "No agent capability operates without current evidence of performance" is measurable. So is "every held action is decided by a named person within the service standard".
A good policy also helps with law. Many of its statements evidence EU AI Act duties directly; see EU AI Act and ISO/IEC 42001: using one to evidence the other.
What will a certification auditor ask?
- Who approved the AI policy, and when was it last reviewed?
- How do your AI objectives follow from the policy?
- Does the policy say who may authorise an agent to act? Show us an authorisation that followed it.
- Which actions are prohibited for agents, and who maintains the list?
- How does the policy relate to your information security policy?
What does the policy not cover?
It does not replace procedures, risk assessments or impact assessments; it governs them. It does not certify any agent. It does not override law. Information security remains under its own policy; see does ISO/IEC 27001 cover AI agents. For the risk method that the policy should call for, see how ISO/IEC 23894 applies to AI agents. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
The policy statements on authority and evidence map onto how Pryme works. Depth is earned, not configured: the role sets a ceiling, Attest evidence sets the depth, and the lower wins. Certificates lapse after 90 days. Withheld actions are refused at the platform floor for every agent, and your own limits narrow further. How a management system certificate and per-agent certification fit is covered in ISO/IEC 42001 and agent certification.
Questions people ask
Should the AI policy name specific agents?
No. Agents change; the policy should not. Name roles and principles in the policy and keep the agent register separately.
How long should an AI policy be?
Two to four pages is usually enough. If it runs longer, move detail into procedures that the policy references.
Does the policy need board approval?
The standard requires top management to establish it. Many regulated firms take it to the board or a board committee because AI risk is a board-level topic.