The documentation trap

Thesis

Small AI vendors often copy enterprise policy language that claims coverage they can’t evidence. A narrow, honestly scoped policy with documented exclusions is harder to fail an audit on than an impressive policy nobody can back up.

Reader

A startup that has just downloaded, or been sold, an enterprise-grade AI policy.

Opening failure

A policy commits to “considering societal and environmental impact”. Asked for the evidence, the team has none. That is not a scoping decision; it is a claim the organisation is failing to support.

Beats

1. Clause 4.3: determine the scope, taking 4.1 and 4.2 into account, and document why anything is excluded.
2. The Statement of Applicability works the same way. You can exclude an Annex A control with a stated reason. Example: “no regulator identified as an interested party at 4.2; the system serves internal staff only”.
3. Controlled documents (7.5.3). A report that looks produced for the audit, undated and unversioned, is discoverable.
4. Narrow and honest now, widened as the business grows, is a legitimate path.

Market angle

Scale-ups copying enterprise paper to win a tender; NfPs inheriting a funder’s template.

What you can do on Monday

Read your AI policy and underline every claim. Next to each, write the document that proves it. Cut or rescope whatever has no document.