I happen to be currently working on our ISO 27001 implementation and as one of the prerequisites I'm writing our internal AI policy.

I've included a link to this blog post, just for kicks.