AI Policy at Your Company and ISO/IEC 42001 - Governance That Doesn't Kill Innovation

The Article 4 "AI literacy" obligation has applied since February 2, 2025, but only on August 2, 2026 - a year and a half later - did national market surveillance authorities across the EU get formal powers to check compliance with it. The Digital Omnibus package, politically agreed on May 7, 2026 and in force since July 27, 2026, softened the provision - from a "duty to ensure" AI literacy to a "duty to support its development", i.e. from an obligation of result to an obligation of effort - but didn't remove it. In practice this means one thing: a company must demonstrate real, documented effort, not just good intentions. And that document - a written AI policy - is exactly what the vast majority of SMEs already using AI day-to-day don't have.

Six weeks ago, national market surveillance authorities across the EU got formal powers to check whether companies actually meet the Article 4 AI literacy obligation - and whether they have documents to prove it, not just good intentions. Most SMEs that have deployed AI are missing one thing: a written AI policy. Here's what such a policy must contain, how to build an AI systems register, when to reach for ISO/IEC 42001 instead of an internal document, and who at a small company should be the “AI owner” without a Chief AI Officer title.

This closes the third piece of a puzzle I've been building across earlier posts: Shadow AI diagnoses the problem - employees using AI without the company's knowledge. The AI Act and GDPR and AI describe the legal obligations you can't avoid. This post is the systemic fix: how to build a voluntary AI management system that organizes those obligations once, instead of putting out fires with every new tool.

Why "no policy" is the default state at most companies

I talk to dozens of companies deploying AI, and the pattern is identical: someone on the team starts using ChatGPT or Claude, it works well, so the tool "spreads on its own." A few months later the company has five different AI assistants deployed by five different people, zero shared data classification, and zero answer to "who's responsible if something goes wrong." This isn't a hypothetical risk - it's the default state described in Shadow AI for a company with no policy. The difference between a company with an AI policy and one without doesn't show up on a calm day - it shows up on the day of an incident, an inspection, or an enterprise client's audit asking about your AI management system.

What an AI policy must contain - six elements, not a hundred pages

An AI policy that actually works fits on 2-4 pages and answers six specific questions. Nobody reads a longer document - and an unenforced policy is worse than none, because it creates a false sense of security.

1. 1.An approved-tools list. Specific names: "ChatGPT Enterprise - yes, for general tasks and documents without PII" / "free ChatGPT in a browser - no, for anything work-related." Without this list, every employee decides for themselves what's safe - and usually lacks the expertise to do so.
2. 2.Data classification. Three simple categories: public data (no restrictions), internal data (tools with a DPA only), specially protected data - customer PII, financial data, trade secrets (Zero Data Retention or self-hosted environments only). I break down the full classification methodology and DPA requirements in GDPR and AI and AI data security.
3. 3.A human-in-the-loop threshold. A clear rule: which decisions AI can make on its own, and which require human approval before deployment - especially important for systems touching customers or employees (GDPR Article 22).
4. 4.An incident reporting procedure. One sentence: "if AI generated an incorrect, biased, or data-exposing response - report it to [whom] within [how many] hours." Without this path, incidents disappear silently until they blow up publicly.
5. 5.Roles and responsibility. Who is the "AI owner," who approves new tools, who updates the systems register - I expand on this in the AI owner section below.
6. 6.Training and review. A short onboarding for new employees plus an annual policy review. This is exactly the "documented effort" under AI Act Article 4 that inspectors are now looking for - I break down the AI Act obligations in detail here. Exactly how to design a role-based program and measure its effect is covered step by step in AI literacy and mandatory training.

An AI systems register - a spreadsheet is enough to start

An AI systems register doesn't need to be GRC software costing tens of thousands a year. For a company under 100 people, one spreadsheet with six columns is enough:

This same spreadsheet is your starting point for the risk classification from the AI Act guide and for assessing whether a given deployment needs the DPIA described in GDPR and AI. Updating the register with every new tool - not once a year - is the only way to keep it in touch with reality.

ISO/IEC 42001, the EU AI Act, and NIST AI RMF - when to use which

This question comes up in almost every consultation: "I've got the AI Act covered, isn't that enough?" Not quite - these are three different layers that complement, not replace, each other:

Implementing ISO/IEC 42001 covers a substantial share of the documentation required for high-risk AI Act systems in practice (risk management, a system register, human oversight, lifecycle documentation) - if you have to document it anyway, certification is often cheaper than it looks once you factor in avoided legal work. There's also more time than assumed back in spring: the Digital Omnibus pushed obligations for stand-alone Annex III high-risk systems (recruitment, credit scoring, education, among others) to December 2, 2027, and for AI embedded in Annex I regulated products to August 2, 2028. That's a deferral, not a cancellation - and the Article 50 transparency and Article 4 AI literacy obligations stay on their original schedule. For a typical SME not selling to large enterprises, the best starting point is an internal policy loosely modeled on the NIST AI RMF functions - no certification, no cost, full flexibility. ISO 42001 gets added only once a client or the market actually demands it.

The AI owner at an SME - who does this without a Chief AI Officer title

The biggest myth blocking AI policy adoption at small companies: that it needs a dedicated role. It doesn't. It needs one person with clearly assigned responsibility - usually 10-20% of their time, not a full position.

• Approves new tools before deployment - checking them against the approved-tools list and data classification.
• Maintains the AI systems register - updating it with every new deployment, not once a year.
• Is the first point of contact for an incident - gathering facts, escalating to the DPO or legal counsel if personal data is involved.
• Runs the annual policy review - and documents that review, because that's exactly the evidence of "supporting AI literacy development" that inspectors are looking for.

At companies under 20 people, this role is usually taken on by the owner, the COO, or the IT lead. What matters isn't the title - it's clarity: one named person, not a "team" or "everyone."

The most common mistakes when building an AI policy

A good AI policy doesn't slow deployments down - it lets you scale them safely and actually measure their return, instead of guessing the way you would in an AI automation ROI calculation. A bad one does the opposite: either it blocks every initiative with bureaucracy, or it exists only as a PDF nobody has read.

An AI policy template - how to start this week

You don't need to write a policy from scratch. The six-element structure above fits into a simple template: one page of rules, one systems-register tab, one incident procedure. I build these templates - tailored to a specific industry and company size - as the first step of every AI governance audit I run as part of AI consulting and AI training for teams. Reach out - I'll prepare a policy draft tailored to your company and help you implement it without hiring anyone new.

---

I run AI governance audits for SMEs - from zero to a finished policy, a systems register, and a clearly assigned AI owner role, without hiring anyone new. I do this as part of AI consulting and team training. Reach out - I'll start by reviewing what AI systems are already running at your company and what's actually missing from your documentation.

Worth reading next:

• Shadow AI - employees using AI without your knowledge
• The AI Act in practice - what your company must do in 2026
• GDPR and AI - personal data in prompts and DPIA
• AI data security at your company
• AI automation ROI - how to calculate returns