What does an ISO/IEC 42001 AI policy need to contain?

An ISO/IEC 42001 AI policy needs to contain top management's commitment to an AI Management System (AIMS) and define assigned roles, responsibilities, and authorities for AI governance. This policy should be documented and aligned with business objectives and other organizational policies.

Specifically, the AI policy should address:

• AI roles, responsibilities, and reporting lines within the organization, ensuring they are defined and resourced. This aligns with ISO/IEC 42001 A.3 Internal organization and maps to NIST-GOVERN-2.1.
• Identification and documentation of resources for AI systems, including data, tooling, compute, human competence, and the specific model/tool components in use. This corresponds to ISO/IEC 42001 A.4 Resources for AI systems.
• Processes for assessing the impacts of AI systems on individuals, groups, and society throughout the AI system lifecycle. This is covered by ISO/IEC 42001 A.5 AI impact assessment and maps to NIST-MAP-5.1.
• Responsible design, development, deployment, operation, and retirement of AI systems, with controls implemented at each stage of the lifecycle. This is the core of ISO/IEC 42001 A.6 AI system lifecycle.
• Data governance for AI systems, encompassing the provenance, quality, preparation, and management of data across its lifecycle. This aligns with ISO/IEC 42001 A.7 Data for AI systems and cross-maps to OWASP LLM04 data poisoning.
• Availability of information about AI systems (capabilities, limitations, intended use) to relevant interested parties, supporting transparency and disclosure obligations. This is addressed by ISO/IEC 42001 A.8 Information for interested parties.
• Responsible-use controls and human oversight for the operation of AI systems. This aligns with ISO/IEC 42001 A.9 Use of AI systems and maps to NIST-GOVERN-3.2 and OWASP LLM06/LLM09.
• Controls for suppliers and third parties in the AI value chain, such as model providers, data providers, and tool/plugin vendors. This is covered by ISO/IEC 42001 A.10 Third-party relationships and maps to NIST-GOVERN-6.1 and OWASP LLM03 supply chain.