This policy procedure sets out how AI systems are approved, assessed, used and monitored across the business, and points to the registers and forms that hold the detail.
This policy template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:
- Policy number and title
- Information-classification
- Version
- Page number / total pages
alphaZ documents - beautifully designed, tried and tested policy templates. No junk, jargon or unnecessary content. Simple and usable policy templates
developed over 25 years through practical use in the real world.
Further guidance on AI management:
Download this policy with your company name and logo already added!
Document Preparation available with all document toolkits.
To get access to this file please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. This policy is also included in the ISO 42001 Toolkit, so the toolkit route gives you this file plus everything else you need in one download.
If you'd like hands-on help putting your AI management system in place, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.
AI Policy Procedure Template
The Artificial Intelligence Policy Procedure is a Word template that sets out the arrangements for the responsible development, provision and use of AI systems. It covers the AI management system and its scope, AI roles, awareness and competence, AI risk and impact assessment, the AI system lifecycle, data and resources, the use of AI systems, AI suppliers, communication with interested parties, and reporting AI concerns and incidents.
It is written for an AI management system meeting ISO 42001:2023 and works alongside a publicly shareable AI policy. It has Title, File Location, Issue No, Issue Date, Controlled By and Approved By fields, an Amendment Record and a Business Use information classification in the footer.
What the Policy Covers
- Summary, scope and the AI management system - the purpose, scope and applicability, the documents that make up the AIMS, and the two rules for everyone: AI is used only for approved purposes, and concerns are reported
- AI roles and responsibilities - top management, the AI lead and the other principal roles, with every AI risk given a named responsible person
- AI awareness and competence - awareness at induction and annual review, AI awareness training for everyone who uses AI, and higher-risk roles whose competence is set for the specific AI system
- AI risk assessment and impact assessment - a periodic AI risk assessment rated on likelihood and consequence with a residual rating after controls, and an impact assessment for each AI system that needs one
- AI system lifecycle - the AI risks and controls register as the central record of AI systems, with lifecycle stages from requirements and design through verification, deployment and operation
- Data and resources for AI systems - the AI data matrix for data acquisition, quality, provenance and preparation, and the data, tooling, computing and human resources each system needs
- Use of AI systems - intended purpose and conditions of use on the register, activities that must be done by a person without AI, and approved and prohibited uses
- Third parties, communication and reporting - responsibilities allocated with AI suppliers and customers, AI supplier appraisal, internal and external communication, and how AI concerns and incidents are reported
Built for an ISO 42001 Management System
- Each AI system listed with its intended purpose, where it is used and its conditions of use or restrictions
- Human-only activities recorded with the reason and approval, so AI is not used for them
- Higher-risk AI roles that do not start work on the system until their competence has been confirmed
- An impact assessment for each AI system on the register, unless it is determined that one is not required
- Concerns can be raised by anyone, with no negative consequences for reporting in good faith
Who Needs an AI Policy Procedure?
Businesses implementing an AI management system, including those working towards ISO 42001, and the AI lead, managers and staff who approve, use and monitor AI systems.
Included in the ISO 42001 Toolkit
This policy is part of the ISO 42001 Toolkit.
How the Policy Fits Together
AI systems, their risks and controls are recorded on the ER42 AI Risks and Controls Register, with impact assessments on F-AI3 AI Impact Assessment, lifecycle records on F-AI1 AI System Life Cycle and data on F-AI2 AI Data Matrix. The decision on each Annex A control is recorded on F-IMS70 Statement of Applicability - AI, interested parties on F-IMS22 Interested Parties Register and issues on F-IMS23 Opportunities and Risks Register, with emerging AI risks reviewed by the F-AI4 AI Focus Committee.
Using the Policy
Edit the procedure to match your business, such as the AI lead and supporting roles, the higher-risk roles, the prohibited uses and the routes for reporting concerns. Name the person in the Controlled By field, give it top level approval and brief all workers.
Related Documents
The public statement sits in P-120 Artificial Intelligence Policy, and the company-wide communication arrangements in P-17 Communications Policy. RA-BR12 Use of Artificial Intelligence is a worked example of an AI risk assessment.
Would you rather we prepared it for you?
Our AI Policy and Risk Register service records your AI tools, the risks and controls against each, and what AI may not do, with your AI policy prepared to match.
AI Policy and Risk Register