Control A.2.2: AI policy
Document a policy governing how the organization develops or uses AI systems.
What control A.2.2 asks
Document a policy governing how the organization develops or uses AI systems.
Why it matters for privacy
A policy is the one page that tells a developer, a procurement officer and a call centre supervisor what the organization will and will not do with AI. If it does not mention personal data, privacy is left to individual judgement.
Where the draft lands: the policy is the first document it will test. The abstract applies to organizations that build AI systems or use them. The policy is where an organization states which of those it is and what it will do about privacy risk.
Basis for A.2.2: the ISO page 56582 and the ISO/IEC 42001:2023 control record. The overlay is our reading of the published abstract and the stage record, not the draft text. Scope, role and who answers.
Evidence for control A.2.2
This is the evidence an auditor or a privacy reviewer asks to see. For control A.2.2 the list is written for an AI system that touches personal data, so a system with no personal data will need a subset.
- AI policy Documented AI policy covering development and/or use of AI
- AI policy Evidence the policy reflects business strategy, values, risk appetite, legal and contractual requirements and impact on interested parties
- AI policy Policy principles and a process for deviations and exceptions
Where control A.2.2 commonly fails
- Generic IT policy relabelled as the AI policy
- No process for exceptions to the policy
What to do about control A.2.2 before the draft lands
Add a privacy clause to the AI policy: which personal data may enter a model, which may not, who approves an exception and how a subject request is handled when the data sits in a model or a prompt log.
The requirement for control A.2.2 is ISO/IEC 42001:2023, and a certificate is issued against that standard or ISO/IEC 27701. The privacy work extends the control to personal data in an AI system; it is not a new system and not a certification.
Read across from control A.2.2
- Control A.2.3, Alignment with other organizational policies
- Control A.3.2, AI roles and responsibilities
- Control A.4.6, Human resources
- Control A.10.2, Allocating responsibilities
← Control A.10.4 | Control A.2.3 →
Open the full index. The public record behind control A.2.2 shows the scope and the lifecycle.
Source for control A.2.2: ISO/IEC 42001:2023, Annex A, retrieved 22 October 2026, at the standards library. The overlay rests on the public 27091 record. Every source.