The three Annex A controls that set management direction for AI: a documented AI policy, its alignment with other organizational policies, and its periodic review.
The documented AI policy for developing or using AI systems: what it should commit to, how it links to clause 5.2 and the business strategy, and the evidence an auditor expects, compared with the alignment and review controls beside it.
How the AI policy fits with existing quality, security, privacy and safety policies: finding where other policies affect or apply to AI objectives, and showing an auditor the cross-references.
Reviewing the AI policy at planned intervals and when circumstances change, so it stays suitable, adequate and effective: review triggers, records and the link to management review.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.