Organisation policies: write, approve, issue
The organisation-wide policies and procedures — the EU AI Act's own, an AI acceptable-use policy and three ISO/IEC 42001 procedures — as clause outlines you write into: guidance is never prefilled, approving issues a version, and an approved policy is never edited in place.
Some documents exist once for the organisation and are written, not composed: the policies. Veritome holds ten as policy documents — a clause outline per type, an editor that autosaves as you write, and an approval that issues a version.
The policies and procedures
| Policy | Anchor |
|---|---|
| AI governance policy | Art. 17(1)(a) — the strategy for regulatory compliance the quality management system starts from. |
| Roles, responsibilities and RACI | Art. 17(1)(m) — the accountability framework: who is responsible for what. |
| Record-retention and documentation-control policy | Art. 18 — what is kept, for how long, and who controls the documents. |
| GPAI copyright compliance policy | Art. 53(1)(c) — a GPAI model provider's policy for Union copyright law, including text-and-data-mining reservations. |
| Authorised representative mandate | Art. 22 / Art. 54 — the written mandate a non-EU provider gives its EU representative. |
| Value-chain written agreement | Art. 25(4) — the agreement with third parties supplying tools, services, components or processes for a high-risk system. |
| AI acceptable use policy | Art. 4 / Art. 26 — how staff may use AI systems and general-purpose AI tools at work. |
| AI system impact assessment procedure | ISO/IEC 42001 §6.1.4 and A.5.2 — how the organisation assesses AI systems' impacts on individuals, groups and society. |
| AI risk management procedure | ISO/IEC 42001 §6.1 — risk criteria, assessment, treatment and residual-risk acceptance for AI. |
| Nonconformity and corrective action procedure | ISO/IEC 42001 §10.1–10.2 — how nonconformities are corrected and logged. |
They appear in Documents under organisation-wide, and each opens at its own URL. The three procedures belong to ISO/IEC 42001 and are listed only while that programme is switched on. The Kind filter sorts them as Policy, Statement, Framework or Method; the old Policies link lands on the Policy filter.
Guidance is guidance, never text
Each clause carries the catalogue's suggested content beside an empty field. That suggestion is never copied into the policy. A policy somebody approved without writing is worse than an empty one, and prefilling our wording is exactly how that happens — the person clicks approve on words nobody in the organisation has thought about. You write every clause; the outline tells you what a clause is for.
Approval issues a version
A policy can be approved only when every clause carries the organisation's own words. Approval computes the hash of the clause text and appends the version to the Issued archive, where it stays readable under that hash. An approved policy is not edited in place: making a change reopens it as a new version, and the version already approved is still there in the archive, with its date, for anyone who relied on it.
Download as PDF or Word
Every policy can be downloaded as a PDF on the standard Veritome document template, and from Govern also as a Word document (.docx) on the Veritome policy template. Both carry the document-control table and the frameworks the policy addresses, the clauses as numbered sections in the order of the outline, the definitions, a framework crosswalk built from the policy's own references, the review-and-approval table and the version history from the Issued archive, with a running header and footer; the Word file adds a title page and a table of contents. Each carries exactly the clauses as written: a clause not yet written appears as a bracketed placeholder, never as the guidance, and a draft says so in its version line.
The PDF is on every plan that downloads documents, Starter and above; Word starts on Govern, and on Starter the Word link takes you to Billing & plan instead. The free public beta runs on Govern's capability, so a beta workspace has both. Either file's SHA-256 travels in the response header so a copy can be matched to the version it came from.
What this is not
Most programme records are not policies. The ISMS scope, the privacy governance policy and the other records a programme produces are steps in their programmes, written in the step drawer and approved there. The documents above have a home of their own because they are written clause by clause, and most have no programme step to point at. The one overlap is the AI governance policy, which the ISO/IEC 42001 step Leadership commitment and AI policy names as what it produces.
Still stuck? Open a support request in your workspace, and a person will answer there and by email.