AI can draft a security policy, but a draft is not a control. Management still has to approve it, the company has to follow it, and you must be able to show that it does. Auditors test whether the policy matches what you really do, not how it was written.
What the frameworks care about
For ISO 27001, clause 5.2 says top management establishes the information security policy, aligned with the organization's purpose and including commitments to meet requirements and to improve. Clause 7.5 requires documented information to be identified, reviewed and approved. For SOC 2, the Journal of Accountancy article stresses that reports should fit the system and that template-like reports are a concern. The same logic applies to policies: a generic text that does not describe your company helps nobody.
A drafting tool does not change who is responsible. Management is.
Where AI helps
- A first structure for a policy, so you start from headings instead of a blank page.
- Plain language rewrites of dense text.
- Comparing your draft against a list of topics, to spot what is missing.
- Drafting quizzes or summaries for staff awareness.
Where AI misleads
- It writes commitments you do not meet, such as "all laptops are encrypted" or "access is reviewed monthly".
- It uses terms from another framework, or names controls that do not exist in yours.
- It produces confident but invented details, such as retention periods or tool names.
- It cannot know your actual systems, people or contracts.
A workflow that works
- Write a short fact sheet first: your tools, who owns what, how often tasks happen.
- Ask the AI to draft using only that fact sheet, and tell it to mark anything missing.
- Edit every sentence. Delete anything you cannot show evidence for.
- Have the process owner read their section and confirm it matches practice.
- Get management approval, with a date and a version number.
- Share with staff and keep acknowledgement records.
- Review on a fixed schedule and record the review.
The test: for each sentence, what is the evidence?
| Policy sentence | Evidence an auditor could ask for |
|---|---|
| Staff complete security training on joining | Training records with dates |
| Access is reviewed quarterly | Review records with reviewer and result |
| Changes are reviewed before release | Pull request approvals |
| Incidents are logged and reviewed | Incident tickets and review notes |
If you cannot fill the right column, change the sentence or build the control.
Keep it short
A short policy that is true beats a long one that is not. Many small teams do well with a handful of one to two page documents. For the set to start with, see the policy set that gets used.
Data handling when you use AI
Do not paste sensitive information into a tool you have not approved. Use the fact sheet, not customer data or secrets. If your company has an AI use policy, follow it.
Quick check
Will an auditor reject an AI drafted policy?
Not for that reason alone. They will test whether it is approved, communicated and followed. Edit and verify before using it.
Do we have to tell the auditor we used AI?
There is no rule we found that requires it. Be honest if asked, and make sure management owns the final text.
Safeguard's compliance and evidence automation can help show that the practices described in your policies are happening. The policies and their approval remain with your management.
Sources
- ISO 27001 clause 5, leadership
- ISO 27001 clause 7, support
- Journal of Accountancy, promises of fast and easy threaten SOC credibility
Last reviewed: 19 October 2026.
