Policies: a kind of record on Documents

A policy is what the organisation has decided once, for every system — as opposed to the per-system obligations. Policies do not have a page of their own: they are a Kind of record on Documents (under Do the work), and an old link to Policies opens Documents filtered to Kind: Policy.

What you will find there

Filter Documents by Kind → Policy, and by Source for the law or standard that asks for the record:

• EU AI Act — the AI governance policy, the AI acceptable use policy, the record-retention and documentation-control policy, the GPAI copyright compliance policy and the AI literacy programme.
• GDPR — the privacy governance policy.
• A standard you run — the ISO/IEC 27001 information-security policy, for example, or ISO/IEC 42001's responsible-use record. These are produced by a programme step and listed while that programme is active; the row opens the step, where the record is drafted, submitted and approved. See Steps: Aria drafts, a person approves, then it counts.

Each row names its Source, Kind and scope, and carries the register's record words — Owed · Drafted · Approved · Issued.

Documents you write in your own words

Several of the organisation's documents — among them the AI governance policy, the roles, responsibilities and RACI record, the record-retention and documentation-control policy, the GPAI copyright compliance policy, the authorised representative mandate and the value-chain written agreement — open as a policy editor: a clause outline, one rich-text field per clause, and a count of clauses written.

Two rules carry weight there. The suggested content beside each clause is guidance, never prefilled text — a policy somebody approved without writing is worse than an empty one. And an approved policy is not edited in place: approving it issues it into the Issued archive exactly as it stands, and a change reopens it as a new version, with the approved one staying readable. Approval needs the approver permission.

Aria checks its own drafts before anyone sees them. A clause that claims the organisation is already compliant, certified or audited, or that cites an Article that does not exist, never reaches the policy. In the drafts Aria prepares when you finish onboarding, that clause is left empty for a person to write. When you ask Aria for a draft in chat, it redrafts the clause before the draft reaches the editor. A suggestion asked for in the editor is not used, and you ask again.

The policy library

Beyond the documents the law and your programmes ask for, Documents → All types holds a library of policies you can choose to write: information-security policies (organisation of security, access control, acceptable use, assets, classification, cryptography, endpoints, networks, operations, secure development, suppliers, continuity, physical security, people, disposal, risk management, legal compliance and a code of conduct) and a data protection by design procedure. Each opens in the same policy editor with its clause outline and guidance, and Aria can draft any of them. Nothing in the library is owed: a policy you start joins your register as Drafted. The information-security policies show while the ISO/IEC 27001 programme is on, and the data protection by design procedure while the GDPR programme is.

Owner, review and acknowledgement

Below the editor, an admin or compliance manager names the policy's owner (a member of the organisation; saving clauses never changes it) and how often it is reviewed: every 6, 12 or 24 months from approval. The owner is told four weeks before the review date, and the policy shows on Documents once its review is within four weeks or overdue.

A policy can also ask every member to acknowledge it — the acceptable use policy does from the start. Once it is approved, each member presses Acknowledge on its page; the acknowledgement records the version and the sentence they saw in your acknowledgements log (each member sees their own under Settings → Acknowledgements). Approving a new version asks everyone again. Admins and compliance managers see who has acknowledged and who has not, and Documents reminds each member of a policy they still have to acknowledge.

Why policies matter

Per-system obligations answer "is this system in order?". Policies answer "does the organisation have a position?" — the thing an auditor reads first. A policy is written once; where a standard you run asks for the same thing, the row says it is counted there too.