The AI policy

The requirement, in our words

Top management must set an AI policy suited to the organization's purpose that gives a framework for objectives, commits to meeting applicable requirements and commits to continual improvement. It must be documented, communicated and available to interested parties where suitable.

What it means for human oversight

The policy is where the authority to override and stop a system should be granted. A policy that commits to human oversight without naming who may intervene leaves the operator with a duty and no power.

How to evidence it

Attach the artefacts above to the The AI policy row with the system name, the owner and the date. The first one is the anchor: An approved policy with the four required elements. The OH-03 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Cross-references to related policies. If that artefact for OH-03 cannot be produced, the row is a gap, whatever the policy says.

OH-03 carries 3 evidence items and 2 common gaps. For the ai policy, the auditor looks for a named person with an authority, not a committee title, so the row needs both the name and the sentence that grants the power. The OH-03 statement above is ours, written from ISO/IEC 42001:2023, 5.2, not a reproduction of the standard text.

Common gaps

• Policy lacks the commitment to meet applicable requirements
• Policy never communicated beyond the governance team

Related units

• Context and the role you play
• What the management system covers
• AI risk assessment