How to Write and Maintain Compliance Policies with AI
Policies are where most compliance programs stall: nobody wants to write them, and once written they go stale. AI removes the blank page and helps keep them alive.
This playbook covers drafting, approving, publishing, attesting, and reviewing policies with AI in the loop.
Step by step
- 1
Start from the control, not a blank page
For each required policy, prompt an AI assistant with the control text plus your context (your stack, size, industry). Ask for a draft policy that would satisfy the control. You get a solid 80 percent draft in minutes.
- 2
Tailor to reality
Edit the draft so it describes what you actually do, not an aspirational ideal. A policy you do not follow is worse than none, auditors test policy against practice.
- 3
Run an AI gap review
Paste your draft back and ask the AI to check it against the control requirement and flag anything missing or contradictory. Treat it as a reviewer, not the final word.
- 4
Get human approval
Route the policy to the accountable owner (often a manager or the CISO) for sign-off. Record who approved it, the version, and the date.
- 5
Publish and collect attestations
Publish to one place everyone can find, and collect acknowledgements from staff. Compliance platforms automate the attestation and chase non-responders.
- 6
Version and schedule reviews
Keep version history and set a review date (at least annually). When the date arrives, use AI to summarise what changed in your environment and propose policy updates.
Where AI helps
- Drafting: AI turns a control requirement plus your context into a first-draft policy in minutes.
- Gap review: AI checks a draft against the requirement and flags gaps and contradictions.
- Refresh: At review time, AI summarises environment changes and proposes edits.
- Attestation: Platforms publish policies and automatically collect and chase staff acknowledgements.
Tips
- ›Never ship an AI policy unedited. Make it match what you really do.
- ›Keep policies short and specific. Long, generic policies fail at audit because no one follows them.
Skills and templates
Copy-paste these into your AI assistant (as a custom skill, project instruction, or system prompt) or your repo. Replace the [bracketed] placeholders with your details.
Policy drafter skill
A reusable skill that drafts a policy from a control requirement plus your context, then runs its own gap check.
policy-drafter.SKILL.md--- name: policy-drafter description: Drafts a compliance policy from a control requirement and company context, then gap-checks the draft against the requirement. Use when a policy is missing or due for review. --- You are the policy drafter for [Company], a [size] [industry] company running on [stack]. When given a control requirement (for example ISO 27001 A.5.1 or PCI DSS 12.1): 1. Ask for anything essential that is missing: who approves policies, existing related policies, and any known practices. 2. Draft the policy with these sections: Purpose, Scope, Policy statements, Roles and responsibilities, Exceptions, Review cadence, Version history. 3. Keep it under 800 words. Write what the company actually does, not an ideal. Mark anything you assumed with [CONFIRM]. 4. Then switch roles and review your own draft against the control requirement. List any gaps or contradictions as "Gap check" bullets. 5. Output the final draft plus the gap check. Rules: - Plain English. No legalese unless the requirement demands specific wording. - Every policy statement must be testable by an auditor. - Never invent named systems or vendors; use placeholders in brackets.
Policy register template
One markdown table that tracks every policy, owner, and review date. The thing auditors ask for first.
policy-register.md# Policy register | Policy | Owner | Approved by | Version | Approved date | Next review | Maps to | Status | |---|---|---|---|---|---|---|---| | Information Security Policy | CISO | CEO | 2.1 | 2026-01-15 | 2027-01-15 | ISO A.5.1, PCI 12.1 | Current | | Access Control Policy | IT Lead | CISO | 1.3 | 2026-02-01 | 2027-02-01 | ISO A.5.15, PCI 7.1 | Current | | Acceptable Use Policy | IT Lead | CISO | 1.0 | 2025-11-20 | 2026-11-20 | ISO A.5.10, PCI 12.2 | Review due | | Incident Response Plan | Security Lead | CISO | 3.0 | 2026-03-10 | 2027-03-10 | ISO A.5.24, PCI 12.10 | Current | Notes: - Status is Current, Review due, or Draft. - Attestation tracking lives in the compliance platform; link each row to its evidence.
Run this with Claude
The thinking writer’s AI, long-form, nuanced, safe.
FAQ
- Is it safe to draft policies with AI?
- Yes, as a starting point. Always review and tailor to your real practices, and have an accountable human approve the final version.
- How often should policies be reviewed?
- At least annually, and after any significant change. AI makes the review faster by summarising what changed.