Most AI governance policy templates read like a statement of intent. An auditor reads the same document as a list of promises, picks three or four, and asks what proves them.
Certification attempts fail in that gap. A policy saying the organisation maintains an inventory of all AI systems is a commitment to produce that inventory on request, complete, on the day someone asks. Below is drafting language for an AI governance policy, clause by clause, with the instrument that compels each line and the record each line obliges you to hold. Thresholds and quorums are deliberately absent, because those belong in the committee terms of reference. Where a clause buys you nothing, that is said too.
Clause 5.2 makes top management the author of the AI policy, not its reviewer
AI policy content is prescribed by exactly one instrument. ISO/IEC 42001 Clause 5.2 places the duty on top management to establish the policy, and independent summaries of the clause agree on its elements: the policy must be appropriate to the organisation’s purpose, provide a framework for setting AI objectives, include a commitment to satisfy applicable requirements, include a commitment to continual improvement of the management system, exist as documented information, refer to other organisational policies where relevant, be communicated inside the organisation, and be available to interested parties where appropriate.
Nothing else prescribes that list. The NIST AI Risk Management Framework asks under GOVERN 1.2 that “the characteristics of trustworthy AI are integrated into organizational policies, processes, and procedures”, and the content items in its playbook are suggested actions rather than requirements. An AI policy written only against NIST has no clause to fail.
Two words in the Clause 5.2 list carry more weight than the rest. “Top management” means the policy is not a document the compliance team writes and the board notes. Establishing it is a leadership act, and an auditor will look for the signature, the date and the minute that records the decision.
Clause 5.2 sits behind a paywall, so any page quoting it word for word is either licensed or wrong. The published standard is the authority, and everything below treats clause content as paraphrase unless the source is an open instrument.
AI policy auditing is new enough that assessors have limited precedent to work from. The ISO42k public directory counted 223 publicly announced ISO/IEC 42001 certifications through 18 October 2026, up from 19 announcements in 2024 and 87 in 2025, with 116 announced in 2026 alone. United States organisations account for 146 of them, India 11 and the United Kingdom 9. The directory only sees organisations that announce, so the true number is higher, and the English-language bias overstates the American share.
Article 17 turns the policy into written instructions a conformity assessor reads
AI policy obligation arrives from a different direction in Europe, and on a later clock. Article 17(1) of the AI Act requires providers of high-risk AI systems to operate a quality management system “documented in a systematic and orderly manner in the form of written policies, procedures and instructions”, then lists thirteen aspects it must cover, from a regulatory compliance strategy at point (a) to an accountability framework at point (m).
Timing matters more than most coverage admits. Chapter III obligations, Article 17 among them, were postponed by the Digital Omnibus on AI: Annex III high-risk systems from 2 December 2027, and Annex I systems embedded in regulated products from 2 August 2028. Writing a policy against Article 17 today is preparation, not compliance, and dating the clause accordingly is honest.
Scale relief is built in, with a limit the amendment added. Article 17(2) still requires implementation “proportionate to the size of the provider’s organisation”, and now continues that providers “shall, in any event, respect the degree of rigour and the level of protection required” for their systems to comply. Proportionality reduces volume, not standard. Article 17(3) separately lets providers already under sectoral Union law fold these aspects into the quality management system that law requires, and the Commission’s own article text carries the current wording.
An AI governance policy does not satisfy Article 17 on its own, and saying so inside the document is worth a sentence. The policy is the apex document; points (b) through (l) are procedures that sit beneath it. Writing the policy as though it discharges Article 17 is the most expensive drafting error on this page, because it invites a conformity assessor to read one document against thirteen requirements. Teams working to the European regime will find the obligation-level detail in our guide to the GPAI obligations, and the records those duties generate sit alongside the rest of the AI governance evidence base.
A scope sentence commits you to an inventory that is actually complete
AI governance policy scope, drafted. “This policy applies to all AI systems developed, procured, deployed or materially modified by the organisation, including systems embedded in third-party software, and to all personnel who commission, build, operate or rely on them.”
What it costs. An AI governance policy with that scope needs a register listing those systems, maintained, with an owner per entry. The sentence is worth writing only if the register exists, because the first question after a scope clause is always a request to see what falls inside it. Our system of record for AI sets out the fields that survive examination.
The cheaper wording. An AI policy written by an organisation that cannot yet see its embedded AI should scope the policy to systems on the register and commit, with a date, to extending it. A dated and limited promise beats a total promise nobody can keep. The gap between what a policy claims and what an organisation runs has its own failure pattern, described in why policies stall before they reach practice.
Principles earn their place when a decision changed because of them
Principle, drafted. “The organisation will not deploy an AI system where the consequences of its errors fall disproportionately on people who had no part in choosing to use it.”
What it costs. One documented instance where the principle changed an outcome. Principles are the easiest part of an AI governance policy to write and the hardest to evidence, and a page of values with no decision attached to any of them reads as decoration.
The test before you keep a principle. Ask which proposal it would have stopped last year. A principle that would have stopped nothing is describing the organisation you already are, and costs nothing to keep, but proves nothing either.
Fairness, transparency, accountability and human oversight appear in most templates because they appear in the NIST framework quoted above and in the OECD text that preceded it. Borrowing the vocabulary is fine. Borrowing it without attaching a decision to each term is what produces a policy that no one inside the organisation can apply.
The approval promise belongs to the charter, and the policy should say so
Approval clause, drafted. “No AI system may enter production use without approval recorded under the AI Governance Committee Charter. The policy sets the requirement; the charter sets the threshold, the quorum and the record.”
Why the split matters, as a deduction. Clause 5.2 asks the AI policy to refer to other organisational policies where relevant, and the charter is the instrument that holds the thresholds. A policy that cross-refers therefore satisfies the clause, while a policy that absorbs the charter satisfies it no better and ages faster. An AI policy that carries the approval matrix becomes two documents in one, and changing a quorum then requires a board-level policy amendment. Keeping thresholds in a subordinate instrument means the operational detail can move at its own speed. Our committee terms of reference carry the risk tiers and the decision authority, and that page states the division plainly: a policy states principles and requirements, a charter operationalises them.
What it costs. A dated approval record per system, naming who approved, against which tier, on what evidence. Approvals that live in a messaging thread are not records. The workflow that produces them in a form an assessor accepts is the approval path these records come out of.
Risk language obliges a methodology somebody can hand over
Risk clause, drafted. “Each AI system is assessed for risk before approval and reassessed on material change, using the organisation’s documented AI risk assessment methodology.”
What it costs. AI policy risk language obliges two artefacts, not one. The methodology itself, and a completed assessment for every system on the register. The second is where audits turn uncomfortable, because partial coverage is visible the moment an assessor compares the register against the assessment folder.
Define “material change” or lose it. The phrase needs a definition somewhere, or every reassessment becomes a judgement call nobody recorded. Retraining, a new data source, a new population of users and a vendor’s silent model swap are the four triggers worth naming.
Naming ISO/IEC 23894 or the NIST functions in this clause is optional and has a cost of its own: citing a framework commits you to following it. Where several regimes have to be satisfied at once, the mapping belongs in a crosswalk between the three instruments rather than inside the policy text.
A monitoring cadence in the policy becomes a date an auditor checks
Monitoring clause, drafted. “Approved AI systems are monitored against their stated performance and fairness criteria, and reviewed at an interval proportionate to their risk tier.”
What it costs. An AI policy monitoring clause obliges monitoring output with dates on it. Writing “quarterly” creates four dates a year that either exist or do not, and an auditor samples the most recent one. “At an interval proportionate to their risk tier” is weaker language that survives better, provided the tier definitions live somewhere and the intervals are set.
The honest version. Most organisations monitor their highest-risk systems well and everything else not at all, and an AI governance policy should say what is true. A policy that promises uniform monitoring across the estate invites a finding. A policy that ties cadence to tier describes what actually happens.
The communication clause fails more audits than the content does
Clause 5.2 asks for three things after the AI policy is written: that it exist as documented information, that it be communicated within the organisation, and that it be available to interested parties as appropriate. Distribution requirements, all three, and the quiet reason policies fail examination. Follow the chain. Clause 5.2 requires the AI policy to be communicated within the organisation. Published audit findings report employees who cannot describe the policy or their responsibilities under it. An assessor testing communication therefore interviews staff rather than inspecting the document, which is a different exercise from the one most teams prepare for.
Published analysis of early certification attempts bears that out. A September 2026 review of common nonconformities puts inadequate control of documented information among the recurring findings, citing outdated procedures, inconsistent versions and staff who lack access to the approved document. Alongside it sits inadequate awareness, where employees cannot describe the policy or their responsibilities under it. The same review reports that initial audits typically produce around three to ten minor nonconformities, so the question is not whether findings appear but which ones.
Distribution clause, drafted. “The current version of this policy is published at a single internal location, is communicated to all personnel on joining and on each material revision, and a summary is made available externally.”
What it costs. An AI policy distribution clause obliges a version history, a distribution record and an acknowledgement trail. Three cheap artefacts that remove three common findings, and the reason a governed register beats a shared drive once the estate passes a handful of systems.
Four sentences worth deleting from most AI governance policy templates
Some AI governance policy clauses create exposure and return nothing.
“The organisation guarantees its AI systems are free from bias” is unprovable and converts an ordinary disparity into a breach of your own policy. “All AI outputs are reviewed by a human before use” is false in any organisation running a recommender or a spam filter, and a single counter-example undermines the document. “This policy complies with all applicable AI regulations” asserts a legal conclusion the organisation has not tested in every market it operates in. And “AI will never replace human judgement” is a sentence that will be read back during a redundancy consultation.
An AI policy should replace a guarantee with a method. “The organisation tests consequential AI systems for disparate outcomes using a documented method, and records what it found and what it changed” is defensible, and the records behind it are the ones described in what auditors actually ask to see.
Every promise, the instrument behind it, and the record that settles it
| Clause in the policy | Instrument behind it | Record it obliges | Common failure |
| Top management establishes the policy | ISO/IEC 42001 Clause 5.2 | Signed, dated approval and the minute | Policy issued by compliance, never adopted |
| Scope covers all AI systems | Clause 5.2 appropriateness | Complete system register with owners | Embedded third-party AI missing |
| Commitment to applicable requirements | Clause 5.2 | Register of obligations by jurisdiction | Named regimes the organisation never assessed |
| Written policies and procedures | AI Act Article 17(1) | Thirteen aspects documented beneath the policy | Policy presented as the whole system |
| Approval before production | Charter, not the policy | Dated approval per system and tier | Approval recorded in chat |
| Risk assessed before approval | Clause 5.2 framework for objectives | Methodology plus one assessment per system | Methodology with partial coverage |
| Monitoring cadence | Clause 5.2 continual improvement | Dated monitoring output per tier | Uniform promise, selective practice |
| Communicated and available | Clause 5.2 | Version history, distribution and acknowledgement | No single current version |
Govern365.ai is built for the third column. Each AI system sits once on a register with its owner, its tier, its approval record, its assessments and its monitoring history, so the question an assessor asks is answered by a query rather than by a search across three drives and a mailbox. The policy then describes something real, which is the only condition under which a policy survives being sampled.
How the register, the approvals and the evidence fit together is set out on the govern365.ai platform overview. Staff-facing rules belong in a separate document, and our acceptable use clauses graded by pedigree covers that one.
Frequently Asked Questions
What should an AI governance policy contain?
At minimum the elements ISO/IEC 42001 Clause 5.2 expects: a scope, a statement appropriate to the organisation’s purpose, a framework for setting AI objectives, a commitment to satisfy applicable requirements, a commitment to continual improvement, and provisions for documenting, communicating and making the policy available.
Is an AI governance policy the same as an acceptable use policy?
No. The governance policy states organisational requirements and commitments. An acceptable use policy governs how staff may use AI tools. The two are separate documents with different audiences and different enforcement routes.
How is a policy different from a committee charter?
A policy sets principles and requirements. A charter operationalises them by defining who decides what, at which risk tier, with what quorum and what record.
Who has to approve the AI policy?
Top management, under ISO/IEC 42001 Clause 5.2. An auditor looks for the signature, the date and the governance minute recording adoption.
Does the EU AI Act require an AI policy?
Article 17(1) requires providers of high-risk AI systems to document a quality management system in the form of written policies, procedures and instructions covering thirteen listed aspects. The duty applies from 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. A single governance policy does not discharge it on its own.
How long should an AI governance policy be?
Short enough that staff read it and long enough that each clause is evidenced. Detail that changes often belongs in subordinate procedures, which can be revised without a board-level amendment.
How often should the policy be reviewed?
At planned intervals and on material change. Annual review is the common cadence, and the review itself has to leave a dated record.
What is the most common AI policy audit finding?
Published reviews of early certifications point to control of documented information and staff awareness rather than policy content, which means version control, access and communication are where effort pays.
How many organisations hold ISO/IEC 42001 certification?
The ISO42k public directory recorded 223 publicly announced certifications through 18 October 2026. Announcements are voluntary, so the real figure is higher.
Should the policy name specific frameworks?
Only where the organisation intends to follow them. Citing a framework in a policy creates an expectation that an auditor can test against that framework’s own requirements.
Can a small organisation use a shorter policy?
Yes, within limits. Article 17(2) requires implementation proportionate to the size of the provider’s organisation while still demanding the degree of rigour needed for compliance, and the Digital Omnibus extended the simplified quality management route from microenterprises to all small and medium enterprises. ISO/IEC 42001 asks for appropriateness to purpose rather than volume.
What should never go in an AI governance policy?
Guarantees of unbiased outputs, blanket claims of human review, assertions of compliance with all applicable regulation, and promises about employment that will be quoted back during a restructuring.
