A.2.4 Policy on Use of AI Tools — ISO 42001

What this means

Your organization must create and enforce a documented policy that governs employee and contractor use of AI tools. The policy must specify which AI use cases are approved, which are explicitly forbidden, how sensitive data must be handled when submitted to AI systems, and who owns responsibility for outputs generated with AI assistance. This covers both enterprise-approved tools and shadow AI usage, establishing clear boundaries around data classification, output validation, and liability.

How to comply

1. 1.Inventory all AI tools currently in use across your organization, including ChatGPT, Claude, GitHub Copilot, and any internal or third-party systems
2. 2.Define permitted use cases by role and department—specify which teams can use which tools and for what purposes
3. 3.Establish prohibited use categories: PII handling, confidential business information, trade secrets, and customer data restrictions
4. 4.Create data handling rules: classify what data types can enter each AI tool, encryption requirements for data in transit, and retention policies
5. 5.Assign clear responsibility for AI-generated outputs—who reviews for accuracy, who validates for compliance, and who's liable for errors
6. 6.Document approval workflows for new AI tools before employees gain access
7. 7.Conduct workforce training on the policy with annual refresher cycles
8. 8.Implement monitoring where technically feasible to detect policy violations or shadow tool adoption
9. 9.Review and update the policy annually or when new AI capabilities emerge

Evidence auditors look for

• Signed AI Tools Usage Policy document distributed to all workforce members
• Policy approval record from management or board governance body
• Role-based AI tool access matrix showing permitted tools by department
• Data classification table linked to AI tool restrictions (e.g., no Personally Identifiable Information in external AI systems)
• Training attendance records and completion certifications for AI policy training
• Tool approval request forms and approval records for new AI system implementations
• Monitoring logs or reports showing policy compliance checks or violation detection
• Incident reports documenting AI tool misuse and corrective actions taken
• Annual policy review meeting minutes and version control history

Frequently asked questions

GRCWatch automates AI policy enforcement by tracking tool usage across your organization, logging data classifications in real-time, and flagging policy violations before they become audit findings—giving you continuous evidence of compliance without manual spreadsheets.

See how GRCWatch handles this control automatically