ISO 42001 A.2: Policies related to AI
AI policy set and its governance
AIGE-OBL-ISO42001-A2. Drawn from chapter 08.
Text alternative
- Clause: ISO 42001, A.2.
- Duty holder: Not stated.
- Applies from: No date, Voluntary.
- Artefact: Policy-as-code library.
- Layer: Layer 01 Govern-as-Code.
- Evidence record: Policy card.
- Record schemas: Policy card .
- The same topic in 19 other frameworks; the crosswalk section below links each clause.
- Id
AIGE-OBL-ISO42001-A2- Instrument
- ISO/IEC 42001 standard
- Compared side by side
- ISO 42001 vs EU AI Act · NIST AI RMF vs ISO 42001
- Clause
- A.2
- Applies from
- No date Voluntary · Voluntary management-system standard (2023); no presumption of conformity
The artefact that evidences it
Policy-as-code library; versioned policy repository.
Patterns that build it
- Sanctioned AI Gateway (layer 4 and 2)
The same topic in other frameworks
From the topic crosswalk: the clauses filed under the same topics as this one. Mappings are illustrative, not a claim of conformity.
Governance and accountability
- EU AI Act Art. 17 Quality management system (core)
- ISO 42001 5.1 Leadership and commitment (core)
- ISO 42001 5.2 AI policy (core)
- ISO 42001 5.3 Roles, responsibilities and authorities (core)
- ISO 42001 A.3 Internal organization (core)
- NIST AI RMF GOVERN 1 GOVERN 1: Policies, processes, procedures, and practices across the organization related to the mapping, measuring, and managing of AI risks are in place, transparent, and implemented effectively (core)
- NIST AI RMF GOVERN 2 GOVERN 2: Accountability structures are in place so that the appropriate teams and individuals are empowered, responsible, and trained (core)
- TC260 Framework 3.0 TC260 4 Comprehensive governance measures (core)
- TC260 Framework 3.0 TC260 5.3.12 Traceable chain of responsibility (core)
- China GenAI Measures GenAI Art. 9 Provider responsibility as content producer (core)
- China Algo. Rec. AlgoRec Art. 7 Algorithm-security responsibility system (core)
- China Deep Synthesis DeepSyn Art. 7 Information-security responsibility system (core)
- GDPR Art. 5(2) Accountability (core)
- ISO 42001 9.3 Management review (core) (clause not verified)
- CSA AICM GRC-01 Governance Program Policy and Procedures (core)
- CSA AICM GRC-06 Governance Responsibility Model (core)
- UK ATRS ATRS 2.1 Owner and responsibility (core)
- Singapore GenAI GenAI 1 Accountability (core)
- Singapore Agentic Agentic 2.2.1 Clear allocation of responsibilities within and outside the organisation (core)
- OECD AI Principles OECD 1.5 Accountability (core)
- GAO AI Accountability 1.2 Roles and responsibilities: define clear roles, responsibilities, and delegation of authority for the AI system (core)
- EU AI Act Art. 4 AI literacy
- EU AI Act Art. 87 Reporting of infringements and protection of reporting persons
- ISO 42001 7.2 Competence (clause not verified)
- ISO 42001 9.2 Internal audit (clause not verified)
- ISO 42001 10.1 Continual improvement (clause not verified)
- NIST AI RMF GOVERN 4 GOVERN 4: Organizational teams are committed to a culture that considers and communicates AI risk
- NIST AI RMF GOVERN 5 GOVERN 5: Processes are in place for robust engagement with relevant AI actors
- GPAI Code Safety C8 Commitment 8: Systemic risk responsibility allocation
- Korea AI Act Art. 36 Domestic representative
- CoE Convention CoE Art. 9 Accountability and responsibility
- G7 Code G7 Action 5 Develop, implement and disclose AI governance and risk-management policies
- EN 18286 EN 18286 Quality management system for EU AI Act regulatory purposes
- GAO AI Accountability 1.1 Clear goals: define clear goals and objectives for the AI system
- GAO AI Accountability 1.3 Values: demonstrate a commitment to values and principles established by the entity
Source
Chapter 08, section ISO/IEC 42001, 42005 and 42006, checked against its sources on the review date above.
Machine-readable
- This obligation:
/api/v1/obligations/aige-obl-iso42001-a2.json - The register:
/api/v1/obligations.json· CSV - Schema and stability promise: open data and API
Cite this obligation
García Aibar, J. (2026). ISO 42001 A.2: Policies related to AI (AIGE-OBL-ISO42001-A2). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a2. CC BY 4.0
BibTeX
@misc{aige2026obligation,
author = {Jorge García Aibar},
title = {{ISO 42001 A.2: Policies related to AI (AIGE-OBL-ISO42001-A2)}},
howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
year = {2026},
version = {0.5.0},
doi = {10.5281/zenodo.22956197},
url = {https://aigovernanceengineer.com/obligations/aige-obl-iso42001-a2},
note = {Version 0.5.0}
}