AI Policy for Companies: Contents and Template

An AI policy is the management-approved, documented directive that governs how AI may be used in the company - and how it may not. It defines scope, permitted and prohibited use, data protection and confidentiality, approved tools, the labelling of AI content, responsibilities, training and the consequences of violations. Under ISO/IEC 42001:2023 it is a mandatory document via Clause 5.2 and Annex A control A.2.3, and it forms the framework for all measurable AI objectives.

• Mandatory, not optional: Without a documented, management-approved AI policy, ISO 42001 certification is not possible (Clause 5.2 / control A.2.3).
• Concrete instead of empty phrases: A generic policy (\"We use AI responsibly\") is, according to audit practice 2024-2026, one of the most common findings - it must be checkable and enforceable.
• Embedded, not isolated: It must be aligned with existing policies on information security, data protection, ethics and HR (control A.2.2).

Why an AI policy - and where it is anchored in ISO 42001

Clause 5.2 of ISO/IEC 42001 requires top management to establish a documented AI policy that is appropriate to the purpose of the organisation, provides a framework for AI objectives and contains a self-commitment to meeting applicable requirements as well as to continual improvement. Annex A control A.2.3 reinforces this and calls for a documented direction approved by management. A.2.2 requires alignment with other corporate policies, A.2.4 the regular review.

The logic behind this is a cascade: the policy (5.2) provides the framework for measurable AI objectives (6.2), which in turn are monitored via monitoring (9.1) and the management review (9.3). A policy without subsequent, measurable objectives remains ineffective - and will be flagged in the audit.

Mandatory contents of an AI policy

An AI policy that holds up in the DACH region covers the following building blocks according to ISO 42001 practice. They are directly suitable as a checkable outline.

Permitted and prohibited use

This is the centrepiece for everyday work. For AI agents, the policy should explicitly define the autonomy levels - read-only, advisory, acting with approval, acting autonomously - as well as tool-use limits, escalation and human-in-the-loop rules and the diversity of model providers. Prohibited use cases should be named explicitly, for example no autonomous legal advice or no autonomous personnel decision without human oversight (HITL). Control A.9.4 is decisive here: if an agent is used outside its intended purpose as declared by the provider, this may qualify as a material change under EU AI Act Art. 25 and trigger a new impact assessment.

Data protection and approved tools

The policy must govern which data may flow into prompts, retrieval systems or training data. Approved tools are listed together with their providers; via control A.10.3, documented due diligence on certifications (ISO 27001, SOC 2 Type II, ISO 42001), data protection posture, sub-processors and model deprecation policies is provided for. An outdated tool list or an unmaintained provider register are among the most frequently flagged points.

Labelling of AI content

Transparency is a core principle from Annex C.2. Control A.8.2 requires system documentation and information for users - model cards, instructions for use, statements on capabilities and limitations. This closely aligns with EU AI Act Art. 13 (transparency / information for users). The policy should govern when and how AI-generated or AI-assisted content is labelled.

Training and AI literacy

Clause 7.2 (competence) and 7.3 (awareness) require evidence that employees with active AI roles are trained. This ties in directly with EU AI Act Art. 4 (AI literacy). In agent deployments, this very evidence is a common weak point, because competence beyond the purely technical teams is often not demonstrated.

ISO 42001 and the EU AI Act - the bridge

ISO 42001 is not a harmonised standard and does not create a presumption of conformity with the EU AI Act. It is, however, regarded as the strongest organisational basis for AI Act preparation. Two articles in particular are relevant to the policy: Art. 4 (AI literacy) is mapped via Clauses 7.2/7.3, Art. 13 (transparency/information for users) via controls A.8.2 and A.8.5. The self-commitment to compliance with applicable regulations (GDPR, EU AI Act, sector-specific regulation) belongs explicitly in the text.

Note: This article serves as professional guidance and does not replace legal advice. Specific obligations, article references and deadlines must be reviewed legally on a case-by-case basis.

Template: a checkable outline of an AI policy

```
AI policy [Company] - Version x.y - Approval [Date/Management]

1. Purpose & scope

• AI systems/agents and areas covered
  
• Role: provider / deployer / both
  

2. Guiding principles (human oversight, transparency, fairness, data protection, security, robustness)
3. Roles & responsibilities (management, AI Officer/AIMS manager, control owners)
4. Permitted use

• autonomy levels per use case
  
• tool-use limits, escalation/HITL
  

5. Prohibited use (negative list, e.g. autonomous personnel/legal decision)
6. Data protection & confidentiality (permissible data in prompts/retrieval)
7. Approved tools & providers (+ provider due diligence A.10.3)
8. Labelling of AI content (transparency, model cards, instructions for use)
9. Risk & impact assessment (self-commitment)
10. Training & AI literacy (plan, cadence)
11. Violations & enforcement (consequences, reporting channel)
12. Self-commitment to law (GDPR, EU AI Act) & continual improvement
13. Review cadence, version control, approval signatures
    ```

Practical example: measurable objectives and training attestation

A policy only takes effect through measurable objectives under Clause 6.2. A mid-sized DACH company (Blueprint ISO-A, 500-2,000 employees) makes its policy concrete, for example, as follows:

• Competence (Clause 7.2 + AI Act Art. 4): \"All employees with an active AI role complete annual AI literacy training; 100% attestation.\"
• Transparency: \"100% of high-risk agents have an up-to-date model card and a user-facing instruction sheet by Q3.\"
• Coverage: \"100% of productive AI agents are registered in the AI inventory and assigned to a risk class within 14 days of go-live.\"

Such objectives make the policy audit-ready and close the gap between aspiration and evidence - precisely where generic policies fail.

For agencies and B2B

For marketing agencies, an AI policy is doubly relevant: internally as evidence of one's own competence under AI Act Art. 4, externally as a trust signal in pitches and tenders - DAX, SMI and ATX clients are increasingly asking about AI governance in RFPs. For B2B decision-makers, the policy is the first, cost-effective step of an ISO 42001 journey (total budget Blueprint ISO-A: EUR 50,000-150,000, 9-12 months, as of 2026): it can be created in the policy-stack phase within four to eight weeks and lays the foundation for risk, impact and lifecycle processes. We support the creation of a checkable, enforceable AI policy and its linkage to measurable objectives - without empty phrases, with a focus on audit-readiness.