Start with the ways your team actually uses AI
Before drafting a policy, identify how your company uses AI. Include the solutions it develops, the AI features offered by its suppliers and the tools people use in their work. Speak with sales, operations, technology and human resources: a software contract does not tell the whole story.
Record each use case with its purpose, owner, users, provider and types of data involved. Distinguish between help with drafting an email and a system that influences decisions about people. This inventory helps you agree on a useful scope for the management system.
Define who can make decisions and when they must intervene
Every use of AI needs someone accountable for its purpose and results. Define who approves new tools, who evaluates changes and who can stop a particular use. Human oversight needs a specific role, enough information and the authority to act.
Describe the boundaries of acceptable use with examples from your operations: which data people may enter, which results need review and which situations must be escalated. Your team needs access to these criteria where they work, and the criteria need reviewing whenever the context changes.
Assess risks and impacts using evidence
Examine what could go wrong and who could be affected. Depending on the use case, consider errors, misuse of information, reliance on suppliers and effects on people or organizations. Not every use needs the same controls: the assessment should guide your priorities and decisions.
Keep a record of the reasoning behind each decision, the agreed control and its owner. For a third-party service, request the information you need to assess its use and record any limitations in what you receive. An approval without supporting evidence becomes less useful when a review comes around.
Turn the inventory into a system you can maintain
ISO/IEC 42001:2023 sets requirements for an AI management system. Implementing it means connecting policies, responsibilities, risk and impact assessments, monitoring and improvement. The inventory is the starting point; you then need to check that agreed practices are followed and remain appropriate.
You can integrate these records into your existing tools and share processes with ISO 27001 and ISO 9001. If you seek certification, agree on the scope with your team and the independent certification body you choose. Certification of the management system does not replace technical assessments or the legal review of each use.
For your next meeting
Your preparation checklist.
- Collect AI use cases from every area within the scope.
- Assign an owner to each use case and each approval.
- Identify the data, suppliers and people who could be affected.
- Record risks, impacts, controls and decisions with supporting evidence.
- Define how you will review changes, incidents and system results.
This guide provides general orientation. The official standard and your company’s scope determine applicable requirements.
Consult the official ISO reference
