What an auditor, or Sekit's evidence engine, asks for.
AI policy
The written, leadership-approved document that sets out how the company develops, buys and uses artificial intelligence: principles, acceptable and prohibited uses, who is accountable, and how it connects to the company's other policies.
From the Sekit evidence catalog
In practice
Aligning the AI policy with the rest of the company means checking it does not contradict the privacy notice, the procurement checklist, or the HR handbook, for example by allowing a use the privacy policy forbids. An auditor compares the AI policy against the regulatory register and the other named policies, checks that cross-references exist and match, and asks how a new AI tool purchase gets checked against both. The typical finding is an AI policy written in isolation by one team, never reviewed against the privacy or procurement policy it needs to sit next to before anyone signs off.
Common gaps
The AI policy and the privacy policy were written by different teams months apart and now allow contradictory uses of customer data.
Procurement approves a new AI tool without checking the AI policy's restrictions, because the two processes are not linked.
The regulatory register lists data protection law but never cross-references the AI policy that is supposed to implement it.
Questions your auditor will ask
Does the AI policy contradict any other company policy?
The AI policy is cross-checked against the privacy, procurement and HR policies, with contradictions resolved before approval.
How does procurement know an AI tool complies with the AI policy?
Procurement checks new AI purchases against the AI policy and the regulatory register before a contract is signed.
Is the AI policy linked to the regulatory obligations it is meant to satisfy?
The regulatory register names each applicable law and links it to the AI policy clause that addresses it.
Where regulation demands it
NIS2 art. 2.1 (Risk management framework) expects the AI policy to fit inside that framework, not stand alone with no cross-check.