# PolicyDrafters: the full text > PolicyDrafters is a fixed-price policy and procedure drafting firm for regulated and scaling businesses, with every document drafted by our senior team, reviewed by our legal team and kept current under a maintenance plan. PolicyDrafters is a trade name of Drafters Collective LLC. PolicyDrafters drafts, reviews and maintains documents. It does not advise on your legal position. Prices in USD: a single policy is $350 to $500; a themed suite (a handbook, a pack or a set of related documents) is $1,200 to $2,500; a bespoke manual is $3,000 to $5,000. The maintenance plan is $29 to $99 a month. Every quote is fixed before we start and does not change. Your written quote arrives within 45 minutes of a complete intake during our working hours, Monday to Saturday, 9am to 5pm, Mountain Time. Contact: hello@policydrafters.com, +1 (505) 528-6595 (Monday to Saturday, 9am to 5pm, Mountain Time). The summary map of the site is https://policydrafters.com/llms.txt. --- # Employee handbook drafting, fixed price URL: https://policydrafters.com/services/employee-handbook A first employee handbook, or one that has outgrown a page of house rules, drafted from your intake and reviewed by our legal team, quoted at $1,200 to $2,500. - Price: $1,200 to $2,500, fixed before work starts. - First draft: 10 working days after a complete intake. - Drafted against: Employment law of the jurisdiction you name in the intake; Your existing contracts and policies, where you have them. - Deliverables: Employee handbook, in your brand or ours; Acknowledgement form for staff to sign; One round of revisions included. ## What it is An employee handbook is the document that sets out an employer's rules, benefits and procedures for its staff in one place, with an acknowledgement form that each person signs to record that they have read it. ## Who it is for A company hiring its first ten people, a scaling team that has outgrown a page of house rules, or a firm whose auditor or investor has asked to see the handbook. The request usually comes when the team grows past the point where the founder answers every question in person, or when a first manager is hired and needs the rules in writing to apply them. The document is drafted for the managers who will apply it, not for the legal team that reviews it, so each section can be read on its own and acted on without a call. ## What we need from you The intake asks where your staff are employed, how you hire, pay, review and let people go, what leave you offer and how it is requested, how you handle grievances and discipline, and which of your current documents still apply. Name anything you already use, and send the files once we reply. Where you have no answer, the intake offers the common options and you pick one. ## How it is drafted and reviewed We draft from the intake against the employment law of the jurisdiction you named, in plain sentences a new manager can follow. Our legal team reviews the draft before it reaches you, and the review is recorded in the revision block on the document. You then read it, mark what you want changed, and we revise once. The handbook arrives in Word and PDF with a document ID, a revision code and an acknowledgement form, and the final version is filed with us for the maintenance plan. ## What the sections cover | Section | What it settles | | --- | --- | | Employment basics | Status, probation, hours, pay dates, expenses | | Leave | Annual, sick, parental and other leave, how it is requested and recorded | | Conduct | Expected standards, conflicts of interest, use of equipment and data | | Performance and discipline | Reviews, warnings, the steps before dismissal | | Grievances | How a complaint is raised, who hears it, what is written down | | Leaving | Notice, handover, return of property, references | Most handbooks fall apart at the leave section. Ours has a leave section that works: each type of leave has a rule, a request route and a record. ## What maintenance covers When the rule changes, your document changes. Under the [maintenance plan](https://policydrafters.com/maintenance) we track the employment rules you were drafted against, issue a revised handbook with the changes marked, and keep the document ID and revision history current. Without the plan, the handbook is still yours to use and to edit; it simply stops being tracked. ## Questions ### Is the employee handbook drafted for the country my staff work in? The employee handbook is drafted against the employment rules of the jurisdiction where your staff are employed, which the intake asks you to name. A handbook for staff in more than one country is scoped in the intake and quoted before we start. ### Do you advise on how the employee handbook applies to us? PolicyDrafters does not advise on how the employee handbook applies to your organisation. The handbook is drafted from your intake and reviewed by our legal team before delivery, and adopting and applying it is your organisation's responsibility. ### How long does an employee handbook take to draft? The first draft of the employee handbook is delivered 10 working days after a complete intake. Your review and the one included revision round add whatever time you need. ### Can you draft from our existing employee handbook? An existing employee handbook can be the starting point: name it in the intake and send the file once we reply. The new draft keeps what works, rewrites what does not, and marks every change so your managers can see what moved. --- # Privacy policy pack: GDPR, CCPA, NDPR URL: https://policydrafters.com/services/privacy-policy-pack The privacy notice, cookie notice, data protection policy and request procedure a customer asks to see, drafted against GDPR, CCPA and NDPR, quoted at $1,200 to $2,500. - Price: $1,200 to $2,500, fixed before work starts. - First draft: 10 working days after a complete intake. - Drafted against: GDPR, Regulation (EU) 2016/679, Articles 13, 14 and 30; California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020, Civil Code sections 1798.100 to 1798.135; Nigeria Data Protection Act 2023, section 27; Nigeria Data Protection Commission General Application and Implementation Directive 2025, Article 27(3); under its Article 3(3) the NDPR 2019 no longer applies as an instrument. - Deliverables: External privacy notice; Cookie notice; Internal data protection policy; Data subject request procedure; Records of processing template; One round of revisions included. ## What it is A privacy policy pack is the set of public notices and internal documents that state what personal data an organisation collects, why, who receives it, how long it is kept and how people exercise their rights, drafted against each privacy law that applies, such as GDPR, the CCPA or the Nigeria Data Protection Act 2023. ## Who it is for A SaaS company with users in Europe and California, a Nigerian business registering with the data protection authority, or any firm whose customer has asked to see its privacy notice before signing. The pack covers both faces of privacy: the notice the public reads and the policy and procedure your staff follow when a request arrives. It is drafted so that a support lead can answer a deletion request from the procedure alone. ## What is the difference between the privacy notice, the cookie notice and a consent banner? The privacy notice and the cookie notice are documents; a consent banner is software. The privacy notice explains what personal data you collect, why, who receives it, how long you keep it and what rights people have. The cookie notice lists the cookies and trackers your site sets, in categories, and says how consent is given and withdrawn. The consent banner is the on-screen control that asks a visitor to accept or refuse cookies, records the choice and sets cookies according to it. The banner is configured in a consent tool or in your site's code, and running it is ongoing work: when the site adds a tracker, someone has to put it in the right category and check that the banner treats it that way. The pack covers the written half. It contains the privacy notice, and a cookie notice written as the text and the cookie categories that sit inside a consent banner. You or your developer configure the banner and keep it working; PolicyDrafters does not supply the banner software. The [guide to privacy notices and cookie consent](https://policydrafters.com/guides/privacy-notice-vs-cookie-consent) sets out where each piece sits. ## What we need from you The intake asks what personal data you collect, from whom and through which channels, where it is stored, which processors and sub-processors touch it, whether any of it crosses a border, how long you keep it, and which cookies and trackers your site sets. Name your current notice and any processor agreements, and send them once we reply. Where you do not know an answer, the intake offers the usual options. ## How it is drafted and reviewed We draft the external notice against the information duties in GDPR Articles 13 and 14, and the notice at collection, privacy policy and consumer rights in California Civil Code sections 1798.100 to 1798.135. For Nigeria, we draft against section 27 of the Nigeria Data Protection Act 2023 and Article 27(3) of the Nigeria Data Protection Commission's General Application and Implementation Directive 2025. The data subject rights in the Act are carried through to the request procedure. The regime is still known as the NDPR. Under Article 3(3) of that directive, issued on 20 March 2025, the Commission no longer applies the Nigeria Data Protection Regulation 2019 as a legal instrument. The notice therefore cites the Act and the directive, not the regulation. The records of processing template follows the fields in GDPR Article 30. Our legal team reviews the draft before it reaches you, and the review is recorded in the revision block. You mark what you want changed, we revise once, and the pack arrives in Word and PDF with a document ID on every page. Where a pack falls in the $1,200 to $2,500 band depends on the number of regimes and processing activities. See [pricing](https://policydrafters.com/pricing) and [how it works](https://policydrafters.com/how-it-works). ## What each document settles | Document | What it settles | | --- | --- | | External privacy notice | What you collect, why, on which lawful basis, who receives it, how long you keep it, and the rights a person can exercise | | Cookie notice | Which cookies and trackers you set, in which categories, and how consent is given and withdrawn | | Internal data protection policy | The rules staff follow for handling, sharing, retaining and securing personal data | | Data subject request procedure | How access, deletion, correction and opt-out requests are received, verified, answered and logged within the statutory deadlines | | Records of processing template | The register of processing activities a controller or processor keeps under GDPR Article 30 | Most privacy notices fall apart at the sharing paragraph. Ours lists every category of recipient, names the transfer mechanism where data leaves the jurisdiction, and matches the records of processing line for line. ## What maintenance covers When the rule changes, your document changes. Under the [maintenance plan](https://policydrafters.com/maintenance) we track the regimes you were drafted against, including the California Privacy Protection Agency's CCPA regulations and the rules the Nigeria Data Protection Commission issues under the Nigeria Data Protection Act 2023, and issue a revised pack with the changes marked. Without the plan, the pack is still yours to use and to edit; it simply stops being tracked. ## Questions ### Does a privacy policy pack have to cover GDPR, CCPA and NDPR? No, a privacy policy pack does not have to cover GDPR, the CCPA and the NDPR together. The intake asks where your users and customers are; the pack is drafted against only the regimes that apply. The regime is still known as the NDPR, but the pack cites the Nigeria Data Protection Act 2023 and the Nigeria Data Protection Commission's General Application and Implementation Directive 2025. Under the directive's Article 3(3), the NDPR 2019 no longer applies as an instrument. A one-regime pack is quoted at the lower end of the $1,200 to $2,500 band. ### Is the cookie notice in a privacy policy pack the same as a consent banner? No, the cookie notice in a privacy policy pack is the text and the cookie categories, written to sit inside a consent banner that you or your developer configure. PolicyDrafters does not supply the banner software. ### Does PolicyDrafters decide whether we are a controller or a processor in our privacy policy pack? No, PolicyDrafters does not decide whether you are a controller or a processor: it drafts the privacy policy pack, our legal team reviews the draft, and you receive a document. The intake asks whether you act as controller or processor for each processing activity, and the pack is written on that basis; the question of your legal position stays with you. ### How long does a privacy policy pack take? The first draft of a privacy policy pack is delivered ten working days after a complete intake. Your review and the one included revision round add whatever time you need. --- # Information security policy set URL: https://policydrafters.com/services/information-security-policies Six security documents drafted against ISO/IEC 27001:2022 Annex A and SOC 2 CC6 and CC7, for the questionnaire your customer sent, quoted at $1,200 to $2,500. - Price: $1,200 to $2,500, fixed before work starts. - First draft: 12 working days after a complete intake. - Drafted against: ISO/IEC 27001:2022 Annex A; AICPA 2017 Trust Services Criteria (revised points of focus, 2022), security; Your customer's security questionnaire, when you send it to us. - Deliverables: Information security policy; Access control policy; Acceptable use policy; Incident response procedure; Business continuity and backup policy; Vendor and third-party policy; One round of revisions included. ## What it is An information security policy set is the group of written policies and procedures that states how a company protects its systems and data: who may access what, how staff may use company devices, how incidents and outages are handled, which vendors may hold the data, and who owns each control. ISO/IEC 27001:2022 Annex A control 5.1 asks for these policies to be defined, approved by management, communicated to staff and reviewed at planned intervals, and SOC 2 criterion CC5.3 looks for control activities deployed through policies and the procedures that put them into action. ## Who it is for A SaaS or services company whose first enterprise customer has sent a security questionnaire, a team preparing for a SOC 2 Type 1 report or an ISO/IEC 27001 certification audit, or a firm whose insurer or investor has asked to see the written controls. The set is drafted for the engineer or operations lead who will answer the questionnaire from it, so each policy states a control, an owner and a record. Where you have no practice yet, the intake offers the common options and you pick one you will follow. A template is enough instead when the rule is generic, no auditor, regulator, customer or court will compare it to your practice, and you will edit it honestly; see [the guide on templates against drafted policies](https://policydrafters.com/guides/policy-template-vs-drafted). ## What happens when a customer sends a security questionnaire? A security questionnaire asks about controls, and the reviewer on the customer's side usually asks to see the written policy behind an answer. The set supplies that policy layer: the six documents listed under What you get, each with a control table. Name the questionnaire in the intake and send it once we reply, and the set is drafted so that each question has a clause to point at; the control table in each document then lists the questions that document answers. A questionnaire may follow a standard format. The Cloud Security Alliance publishes the CAIQ, yes or no questions documenting the security controls of IaaS, PaaS and SaaS services, now at version 4.1 ([Cloud Security Alliance, STAR Level 1: Security Questionnaire (CAIQ v4.1)](https://cloudsecurityalliance.org/artifacts/star-level-1-security-questionnaire-caiq-v4)). Google published its Vendor Security Assessment Questionnaire (VSAQ) as open-source code, with templates for web applications, security and privacy programmes, infrastructure, and physical and data centre security; the repository was archived in November 2022 and the templates remain public ([google/vsaq on GitHub, Vendor Security Assessment Questionnaire](https://github.com/google/vsaq)). A customer's own spreadsheet usually asks the same questions in its own order, and the control table finds a clause for each one. Two parts stay with you. We do not write your answers to the questionnaire, and we do not supply evidence that the controls operate. Each answer should describe the controls your organisation actually runs and the evidence it actually holds, such as the last access review or the last restore test; each policy names the record that shows its control is followed, and keeping that record is your operation. The [guide to which policies a SaaS startup needs first](https://policydrafters.com/guides/policies-saas-startup-needs) maps the questionnaire sections to the documents in more detail. ## What we need from you The intake asks what systems you run and where they are hosted, how staff and contractors get and lose access, which devices are allowed, how incidents are reported and who is on call, how backups are taken and tested, and which vendors hold your data. Name any existing policies, your last questionnaire and, if you have one, the auditor's control list, and send them once we reply. ## How it is drafted and reviewed We draft against the four themes of ISO/IEC 27001:2022 Annex A (A.5 organisational, A.6 people, A.7 physical, A.8 technological) and the security category of the AICPA 2017 Trust Services Criteria (revised points of focus, 2022) used in SOC 2 reports, principally CC6 on logical and physical access controls and CC7 on system operations. Each policy carries a control table in the sequence auditors expect. Our legal team reviews the draft before it reaches you and records the review in the revision block. You mark changes, we revise once, and the set arrives in Word and PDF with a document ID on every page. The quote within $1,200 to $2,500 depends on the number of systems and the depth of the vendor policy; see [pricing](https://policydrafters.com/pricing) and [how it works](https://policydrafters.com/how-it-works). ## Which controls each document answers | Document | ISO/IEC 27001:2022 Annex A | SOC 2 security criteria | CAIQ v4.1 domain | | --- | --- | --- | --- | | Information security policy | A.5.1 policies, A.5.2 roles, A.5.4 management responsibilities | CC2.2, CC5.3 | GRC, Governance, Risk Management and Compliance | | Access control policy | A.5.15 access control, A.5.16 identity, A.5.18 access rights, A.8.2 privileged access | CC6.1 to CC6.3 | IAM, Identity and Access Management | | Acceptable use policy | A.5.10 acceptable use, A.6.2 terms of employment, A.8.1 user endpoint devices | CC6.7, CC6.8 | HRS, Human Resources Security, and UEM, Universal Endpoint Management | | Incident response procedure | A.5.24 to A.5.28 incident management, A.6.8 event reporting | CC7.2 to CC7.5 | SEF, Security Incident Management, E-Discovery and Cloud Forensics | | Business continuity and backup policy | A.5.29 and A.5.30 continuity, A.8.13 backup, A.8.14 redundancy | CC7.5 | BCR, Business Continuity Management and Operational Resilience | | Vendor and third-party policy | A.5.19 to A.5.22 supplier relationships | CC9.2 | STA, Supply Chain Management, Transparency and Accountability | Most security policy sets fall apart at the incident response procedure. Ours names who declares an incident, who is told and by when, what is recorded, and who signs the post-incident review. ## What maintenance covers When the rule changes, your document changes. Under the [maintenance plan](https://policydrafters.com/maintenance) we track Annex A and the Trust Services Criteria you were drafted against, issue a revised set with the changes marked when either moves, and keep the control tables and revision history current. Without the plan, the set is still yours to use and to edit; it simply stops being tracked. ## Questions ### Will the information security policy set get us through a SOC 2 audit? The information security policy set is the written policy layer a SOC 2 auditor asks to see, structured the way auditors expect to read it. A SOC 2 examination also tests whether the controls those policies describe are in place and operating; that part is your operation, not the document. The set can answer customer security questionnaires before any audit is scheduled. ### Can technical standards, such as a password standard, be added to the information security policy set? The six documents in the information security policy set state each control, its owner and its record. A technical standard, such as a password or encryption standard, can be added: ask for it in the intake and it goes into the fixed quote. ### Can the information security policy set be mapped to our customer's questionnaire? The information security policy set can be mapped to your customer's security questionnaire. Name the questionnaire in the intake, send it once we reply, and the set is drafted so that each question has a clause to point at. The control table in each document lists the questions it answers. ### Does the information security policy set answer a CAIQ or VSAQ questionnaire? The information security policy set does not answer a CAIQ, a VSAQ or any other questionnaire for you. The answers are yours, and they describe the controls your organisation actually runs and the evidence it actually holds. What the set supplies is the written policy behind them: name the questionnaire in the intake, send it once we reply, and the set is drafted so that each question has a clause to point at, with the control table in each document listing the questions it answers. ### How long does an information security policy set take? The first draft of an information security policy set takes twelve working days from a complete intake. Your review and the one revision round included add whatever time you need. --- # AML/KYC policy and procedure manual URL: https://policydrafters.com/services/aml-kyc-manual An AML/KYC manual drafted against the FATF Recommendations, Directive (EU) 2015/849 and the Bank Secrecy Act, reviewed by our legal team, for $3,000 to $5,000. - Price: $3,000 to $5,000, fixed before work starts. - First draft: 15 working days after a complete intake. - Drafted against: FATF Recommendations 1, 10, 11, 12, 16, 18 and 20 (2012, as amended); Directive (EU) 2015/849 as amended; Bank Secrecy Act, 31 U.S.C. 5311 and following, with the FinCEN rules in 31 CFR Chapter X for your sector (31 CFR 1022.210 for a money services business; 31 CFR 1010.230 for a covered financial institution); The rulebook of the regulator you name in the intake. - Deliverables: AML/CTF policy; Customer due diligence and KYC procedure; Enhanced due diligence procedure; Transaction monitoring and suspicious activity reporting procedure; Record-keeping and training schedule; Risk assessment template; One round of revisions included. ## What it is An AML/KYC manual is the document that sets out how a firm assesses its money laundering and terrorist financing risk, identifies and verifies its customers, monitors their activity, reports suspicion and proves that all of it happened. AML stands for anti-money laundering and KYC for know your customer. ## Who it is for A money services business applying for a licence, a fintech whose banking partner has asked to see its AML programme, a payments or digital asset firm registering with FinCEN or a European supervisor, or an established firm whose manual was written for a rulebook that has since changed. The manual is drafted for the compliance officer who will run it and the examiner who will read it, so each procedure says who does what, when, and what gets recorded. ## What we need from you The intake asks which regulator supervises you, what products you offer and to whom, where your customers are, how you onboard them, which screening and monitoring tools you use, who your compliance officer reports to, and how suspicious activity has been escalated so far. Name your current manual and risk assessment if you have them, and send them once we reply. Where you have no answer, the intake offers the common options and you pick one. ## How it is drafted and reviewed We draft from the intake against the FATF Recommendations, Directive (EU) 2015/849 as amended, the Bank Secrecy Act and the FinCEN rules in 31 CFR Chapter X for your sector, and your regulator's rulebook, in the order an examiner expects: risk assessment, then policy, then the procedures that carry it out. Our legal team reviews the draft before delivery and records the review in the revision block. You mark changes and we revise once. The manual arrives in Word and PDF with a document ID and revision code. We keep the final version on file for the maintenance plan. ## What each document answers Each document in the manual is drafted against a named rule: a FATF Recommendation, an article of Directive (EU) 2015/849 and, where one applies, a US provision. | Document | Rule it is drafted against | | --- | --- | | AML/CTF policy | FATF Recommendation 18 (internal controls); Article 8(3) to (5) of Directive (EU) 2015/849; 31 U.S.C. 5318(h), and 31 CFR 1022.210 for a money services business | | Customer due diligence and KYC procedure | FATF Recommendation 10; Articles 11, 13 and 14 of Directive (EU) 2015/849; 31 CFR 1022.210(d)(1) for a money services business, 31 CFR 1010.230 (beneficial owners) for a covered financial institution | | Enhanced due diligence procedure | FATF Recommendation 12 (politically exposed persons); Articles 18 to 23 of Directive (EU) 2015/849 | | Transaction monitoring and suspicious activity reporting procedure | FATF Recommendations 10 (ongoing due diligence), 16 (payment transparency, where you send or receive wire transfers) and 20 (reporting); Articles 13(1)(d) and 33 of Directive (EU) 2015/849; 31 CFR 1022.320 for a money services business, otherwise the SAR rule in 31 CFR Chapter X for your sector | | Record-keeping and training schedule | FATF Recommendations 11 (record-keeping) and 18 (training); Articles 40 and 46(1) of Directive (EU) 2015/849; 31 CFR 1010.430(d), and 31 CFR 1022.210(d)(3) for training at a money services business | | Risk assessment template | FATF Recommendation 1 (risk-based approach); Article 8(1) and (2) of Directive (EU) 2015/849 | Most manuals fall apart at the escalation step: a transaction is flagged and nobody can say who decides, by when, or where the decision is written down. Ours names the person, the deadline and the record. ## What maintenance covers When the rule changes, your document changes. Under the [maintenance plan](https://policydrafters.com/maintenance) we track the FATF Recommendations, Directive (EU) 2015/849 and the FinCEN rules you were drafted against, issue a revised manual with the changes marked, and keep the document ID and revision history current. Directive (EU) 2024/1640 repeals Directive (EU) 2015/849 with effect from 10 July 2027, and from that date the duties on firms sit mainly in Regulation (EU) 2024/1624. Without the plan, the manual is still yours to use and to edit; it simply stops being tracked. ## Questions ### Which regulator is the AML/KYC manual written for? The AML/KYC manual is written for the regulator you name in the intake. The FATF Recommendations, Directive (EU) 2015/849 and the FinCEN rules in 31 CFR Chapter X give the manual its structure; your regulator's rulebook gives each procedure its thresholds, deadlines and forms. A firm with more than one regulator is scoped in the intake and quoted before drafting starts. ### Does the AML/KYC manual settle our AML obligations? No AML/KYC manual settles a firm's AML obligations on its own. The manual is drafted against the FATF Recommendations, Directive (EU) 2015/849 and the Bank Secrecy Act, and structured the way examiners expect to read it. Running it, training staff and filing reports is your firm's responsibility; the document is drafted from your intake and reviewed by our legal team before delivery. ### Can you draft from our existing AML/KYC manual? An existing AML/KYC manual can be the starting point: name it in the intake, with your last risk assessment, and send both once we reply. The new draft keeps what still matches the rule, rewrites what does not, and marks every change so your compliance officer can see what moved. ### How long does an AML/KYC manual take to draft? The first draft of the AML/KYC manual is delivered 15 working days after a complete intake. Your review and the one revision round add whatever time you need. --- # Standard operating procedures written to one template URL: https://policydrafters.com/services/sop-library When a customer or auditor asks for written procedures: five to twelve SOPs on one template, with a register and change control, quoted at $1,200 to $2,500. - Price: $1,200 to $2,500, fixed before work starts. - First draft: 12 working days after a complete intake. - Drafted against: Your own process, as captured in the intake; ISO 9001:2015 clause 7.5.2 (creating and updating documented information) for each SOP's header; ISO 9001:2015 clause 7.5.3 (control of documented information) for the register and change control. - Deliverables: SOP template; Five to twelve SOPs written to the template; SOP register; Change-control procedure for the library; One round of revisions included. ## What it is An SOP library is a set of standard operating procedures (SOPs) written to one template, listed in one register and changed under one change-control procedure. A standard operating procedure is a written, numbered set of steps for one process, naming for each step the role that performs it and the record it leaves. ## Who it is for A company whose processes live in the heads of three people, a firm whose auditor or customer has asked for written procedures, or an operations lead tired of five documents in five formats. The request usually comes when a process that lives in a few heads has to be shown to a customer or an auditor, or taught to a new hire, and turns out to exist nowhere on paper. Each procedure is written so that a trained person can carry out the task the same way each time and show that it was done. The library is drafted for the person doing the task, not the person signing it off. ## What we need from you The intake is where the process gets captured. For each procedure it asks what triggers the task, who performs it, what they need to start, the steps in order, where judgement is needed and who decides, what is recorded and where, and what counts as done. Name anything that already exists and send it once we reply: checklists, screenshots, old procedures, a recording of someone talking through the task. We agree the scope with you before quoting. ## How it is drafted and reviewed We write one SOP template first and agree it with you. Then we draft every procedure to it, so a reader who has learned one knows the layout of all. The template and the register are structured to ISO 9001:2015 clause 7.5 on documented information. Each SOP header carries a title, an identifier, an owner and an approval line. These give the identification and the review and approval that clause 7.5.2 asks for. The version number, the register and the change-control procedure control changes to the library, as clause 7.5.3 describes. Our legal team reviews the set before it reaches you, and the review is recorded in the revision block. You mark what you want changed, we revise once, and the library arrives in Word and PDF. An SOP library is $1,200 to $2,500, depending on the number of procedures and how many are already written down. The quote is fixed before we start and does not change. See [pricing](https://policydrafters.com/pricing) and [how it works](https://policydrafters.com/how-it-works). ## What one SOP contains | Part | What it settles | | --- | --- | | Header | Document ID, version, owner, approver, effective and review dates | | Purpose and scope | What the procedure is for and where it stops | | Roles | Who performs each step and who signs it off | | Inputs | What must be in hand before step one | | Steps | Numbered actions in the order they happen, one action per step | | Decision points | Where judgement is needed, the options, and who decides | | Records | What is written down, where it is kept and for how long | | Related documents | The policy it sits under and the forms it uses | Most procedures fall apart at the step where judgement is needed, written as if there were none. Ours names each decision point, the options and the person who decides. ## What maintenance covers When the process changes, your document changes. Under the [maintenance plan](https://policydrafters.com/maintenance) we hold the SOP register, run the change-control procedure when you tell us a step has moved, issue the revised SOP with the changes marked, and keep each review date moving. Without the plan, the library is still yours to use and to edit; it simply stops being tracked. ## Questions ### How many SOPs are in an SOP library? A PolicyDrafters SOP library is five to twelve standard operating procedures, with the number agreed with you before the quote. A library of more than twelve procedures is scoped in the intake and quoted before we start. ### Does PolicyDrafters write clinical SOPs? PolicyDrafters does not write clinical SOPs. It writes administrative and operational procedures; clinical procedures and clinical SOPs are out of scope. ### Can PolicyDrafters write SOPs to our existing template? PolicyDrafters writes SOPs to your existing template where the template already carries what ISO 9001:2015 clause 7.5.2 asks of documented information: identification, such as a title, date, author or reference number, and a record of review and approval. Where it does not, we add those fields and show you what changed. ### How long does an SOP library take? The first draft of an SOP library arrives twelve working days after a complete intake. Your review and the one included revision round add whatever time you need. --- # AI governance documentation suite URL: https://policydrafters.com/services/ai-governance-suite Seven AI governance documents drafted against the EU AI Act, the NIST AI RMF 1.0 and ISO/IEC 42001:2023, reviewed by our legal team, first draft in 20 working days. - Price: $3,000 to $5,000, fixed before work starts. - First draft: 20 working days after a complete intake. - Drafted against: EU AI Act, Regulation (EU) 2024/1689: Articles 4, 5, 9 to 14, 26, 50 and 73; Annex IV; NIST AI 100-1, AI Risk Management Framework (AI RMF 1.0), January 2023: Govern, Map, Measure, Manage; ISO/IEC 42001:2023 AI management system: clauses 5.2, 5.3, 6.1.2, 6.1.3, 7.5, 8.4 and 10.2; Annex A.2, A.3 and A.5 to A.9. - Deliverables: AI governance policy; AI risk management procedure; AI use and acceptable use policy; Model and system inventory template; Human oversight procedure; Incident and complaint procedure; Technical documentation template (EU AI Act Annex IV); One round of revisions included. ## What it is An AI governance documentation suite is the set of policies, procedures and record templates that sets out how an organisation approves, risk-assesses, oversees and monitors the AI systems it builds or uses, and keeps the evidence of each step in the form the EU AI Act, the NIST AI RMF and ISO/IEC 42001 describe. ## Who it is for A company deploying AI in hiring, credit, customer service or operations, asked by a customer, an investor or a regulator to show how those systems are governed; a vendor whose EU buyers send an AI Act questionnaire with the security questionnaire; a firm starting an ISO/IEC 42001 programme that needs the documents before the certification body arrives. The suite is drafted for the people who will run it: the owner of the system inventory, the person who signs off a new use, the one who answers a complaint. ## What we need from you The intake asks which AI systems you build, buy or deploy and what each one decides or produces, who is affected by its output, whether you are a provider or a deployer, what data trains or feeds it, who can override an output, what has gone wrong so far, and which of your existing policies the suite must sit beside. Once we reply, send your current AI policy, system list and any customer questionnaire you have received. ## How it is drafted and reviewed We draft from the intake against Regulation (EU) 2024/1689, the NIST AI Risk Management Framework 1.0 and ISO/IEC 42001:2023, so you keep one set of documents rather than three. The policy sets the rules, the procedures carry them out, and the templates capture the records each framework expects. Our legal team reviews the draft before it reaches you, and the review is recorded in the revision block. You then read it, mark what you want changed, and we revise once. The suite arrives in Word and PDF with a document ID and revision code, and the final version is filed with us for the maintenance plan. ## How the documents map to the three frameworks The three frameworks ask for much the same things in different words. The table shows, for each document, the EU AI Act article, the NIST AI RMF 1.0 function and the ISO/IEC 42001:2023 clause or Annex A control it is drafted against. | Document | EU AI Act (Regulation (EU) 2024/1689) | NIST AI RMF 1.0 | ISO/IEC 42001:2023 | | --- | --- | --- | --- | | AI governance policy | Article 4 AI literacy; Article 26 deployer obligations | Govern | Clause 5.2 AI policy; Clause 5.3 roles; Annex A.2 | | AI risk management procedure | Article 9 risk management system | Map, Measure, Manage | Clauses 6.1.2 and 6.1.3 risk assessment and treatment; Clause 8.4 impact assessment; Annex A.5 assessing impacts of AI systems | | AI use and acceptable use policy | Article 5 prohibited practices; Article 13 instructions for use and Article 26(1) use in line with them; Article 50 transparency obligations | Govern, Map | Annex A.2 policies for AI; Annex A.9 use of AI systems | | Model and system inventory template | Article 10 data governance; Article 12 record-keeping | Map | Clause 7.5 documented information; Annex A.7 data | | Human oversight procedure | Article 14 human oversight; Article 26(2) | Manage | Annex A.3 internal organisation; Annex A.9 | | Incident and complaint procedure | Article 26(5) monitoring; Article 73 serious incidents | Measure, Manage | Clause 10.2 nonconformity and corrective action; Annex A.8 | | Technical documentation template | Article 11 and Annex IV | Map, Measure | Clause 7.5; Annex A.6 AI system life cycle | The suite does not decide whether a system is high-risk under Annex III; it records the classification you make and the reasons for it. ## What maintenance covers When the rule changes, your document changes. Under the [maintenance plan](https://policydrafters.com/maintenance) we track the Act, the NIST framework and the standard your suite was drafted against, issue a revised suite with the changes marked, and keep the document ID and revision history current. Without the plan, the suite is still yours to use and to edit; it simply stops being tracked. ## Questions ### Are we a provider or a deployer under the EU AI Act? A company that develops an AI system, or has one developed, and puts it on the market or into service under its own name is a provider under Article 3(3) of the EU AI Act, Regulation (EU) 2024/1689. A company that uses an AI system under its own authority in its business is a deployer under Article 3(4). A deployer becomes a provider under Article 25(1) if it puts its own name on a high-risk system, substantially modifies it, or changes its purpose so that it becomes high-risk. The intake records the role you give for each system, the suite is drafted against the obligations of that role, and we do not advise on your legal position. ### Do we need all three frameworks for the AI governance suite? No, one AI governance suite serves whichever of the three frameworks you are asked about, because each document is mapped to all three: the EU AI Act, Regulation (EU) 2024/1689, through the articles for the role you record in the intake; the NIST AI RMF 1.0, a voluntary framework, through its Govern, Map, Measure and Manage functions; and ISO/IEC 42001:2023 through its clauses and Annex A controls, which matter if you plan certification. ### Does the AI governance suite cover ISO/IEC 42001 certification? The AI governance suite supplies documented information for the ISO/IEC 42001:2023 clauses it is mapped to: the AI policy (clause 5.2), roles (5.3), risk assessment and treatment (6.1.2 and 6.1.3), documented information (7.5), AI system impact assessment (8.4) and nonconformity and corrective action (10.2), with the matching Annex A controls. Certification is a separate audit by an accredited certification body that looks at how you run the management system, not only at the documents. The suite is structured the way auditors expect to read it. ### How long does the AI governance suite take to draft? The first draft of the AI governance suite arrives 20 working days after a complete intake. Your review and the one included revision round add whatever time you need. --- # Policy review and update URL: https://policydrafters.com/services/policy-review-and-update Policies written years ago, or inherited, read against the current text of the rules they name and returned marked up in five working days, $350 to $500 per document. - Price: $350 to $500 per document reviewed, fixed before work starts. - Returned: 5 working days after a complete intake. - Read against: The rules each document names, read against their current text and numbering; ISO 9001:2015 clauses 7.5.2 and 7.5.3 (documented information; the 2015 text, since replaced by ISO 9001:2026), for the identification, approval and version-control checks; Your house style and the brand's document conventions. - Deliverables: Marked-up copy of each document; Revised version with the changes tracked, a document ID and a revision block; Change note listing what moved and why; One round of revisions included. ## What it is Policy review and update is a check of an existing policy against the current text of the rules it names and the facts it states, returned as a marked-up copy, a revised version with every change tracked and a change note saying what moved and why. ## Who it is for A company with policies that were written once and never read again, a firm whose auditor has flagged a document that cites a rule by its old name, a team that inherited a folder of documents from a previous manager, or a business preparing for a certification visit and unsure which of its policies still describe what it does. The request usually comes when policies someone else wrote are about to be read by a customer or an auditor, and nobody is sure they still describe what the business does. The service is priced per document, so you can send one policy or the whole folder. ## What we need from you The intake asks which documents you want reviewed, which rules or standards each one is meant to answer, when it was last approved and by whom, what has changed in the business since, and whether you have a house style or template the revised version should follow. Send the documents once we reply, in Word where you have them; PDF is fine, and we rebuild the document in Word if there is no source. Where a document does not say which rule it answers, the intake asks you to name one. ## How each document is read and reviewed We read each document against the current text of the rules it names, against the other documents in the set so they do not contradict each other, and against your house style. Our legal team reviews the marked-up copy and the revised version before they reach you, and the review is recorded in the revision block we add to the document. You then read it, mark what you want changed, and we revise once. Each document comes back in Word and PDF with the changes tracked, a change note, a document ID and a revision block, and the final version is filed with us for the maintenance plan. ## What a review checks Each document is read against four questions, and every finding is marked on the document and explained in the change note. | Check | What we look for | | --- | --- | | Currency | Does the document cite the rule by its current name and number, and does each clause still say what the rule says today? | | Consistency | Does it contradict another document in the set, the handbook or the procedure it sits beside? | | Completeness | Does it have an owner, an approval date, a review date, a scope and the record each step should produce? | | Clarity | Can the person who has to follow it find the step that applies to them and act on it without asking? | The first check looks for a rule that has been renumbered, replaced or repealed while the document still cites the old version. Where it finds one, the change note names the current text and the clause that moved. ## What maintenance covers When the rule changes, your document changes. Under the [maintenance plan](https://policydrafters.com/maintenance) the reviewed document joins the set we track, we issue a revised version with the changes marked, and we keep the document ID and revision history current. Without the plan, the document is still yours to use and to edit; it simply stops being tracked, and a later review is quoted again per document. ## Questions ### Can PolicyDrafters review policies it did not write? Yes, policy review and update is built for policies someone else wrote, including ones written years ago. Each document is read against the current text of the rules it names, and the change note says what moved and why. ### What if a policy needs rewriting rather than revising? If a policy review finds that a document needs rewriting rather than revising, the change note says so and the rewrite is quoted as a new document before any more work is done. The review fee covers the review; you decide whether to go further. ### Does a policy review cover contracts? No, a policy review covers policies, procedures, handbooks, manuals and notices, not contracts. Contracts and terms are out of scope, and we tell you at intake if a document falls outside it. ### How long does a policy review take? A policy review takes five working days from a complete intake to the marked-up copy and the revised version. Larger folders are scheduled in batches, and the quote says when each batch arrives. ### How much does a policy review cost? A policy review is $350 to $500 per document reviewed, in the single policy band. The quote is fixed per document before we start and does not change, and one round of revisions is included. --- # Policies for SaaS and technology companies URL: https://policydrafters.com/industries/saas-technology Security and privacy policies for SaaS companies and startups, with AI governance, drafted the way enterprise buyers, auditors and investors read them, at a fixed price. - Documents: Information security policy set, for enterprise customers, SOC 2 and ISO 27001 auditors; Access control policy and acceptable use policy, within the information security policy set, for staff and the auditor who samples them; Incident response procedure and business continuity and backup policy, within the same set, for the customers who send security questionnaires; Privacy notice, cookie notice, data protection policy and data subject request procedure, within the privacy policy pack, for users, regulators and the data protection questions in procurement; AI governance suite, for customers and regulators where the product uses or offers AI. - Services: Information security policy set (https://policydrafters.com/services/information-security-policies); Privacy policy pack (https://policydrafters.com/services/privacy-policy-pack); AI governance suite (https://policydrafters.com/services/ai-governance-suite). - Drafted against: SOC 2 Trust Services Criteria for security: CC6 and CC7; ISO/IEC 27001:2022 Annex A; GDPR, Regulation (EU) 2016/679: Articles 13, 14 and 30; CCPA as amended by CPRA: California Civil Code sections 1798.100 to 1798.135; Nigeria Data Protection Act 2023: section 27; Nigeria Data Protection Commission General Application and Implementation Directive 2025: Article 27(3); EU AI Act, Regulation (EU) 2024/1689: Articles 9 to 14 and 26; NIST AI RMF 1.0: Govern, Map, Measure, Manage; ISO/IEC 42001:2023. ## What the documents have to do An information security policy set is the collection of policies and procedures that states how a company protects its systems and data: who may access what, how changes and incidents are handled, and who is responsible. Each reader looks for something specific. A procurement team checks that the policies answer the questions on its questionnaire, in the order the questionnaire asks them. An auditor checks that each policy names an owner, a review date and the control it supports, and that the procedure matches what the sampled evidence shows. A data protection authority or a user checks lawful bases, retention and rights. A customer deploying your AI feature checks risk management and human oversight. A generic template gives each of them nothing specific to check, because it names no owner, no tool and no control. | Reader | Document | What they look for | | --- | --- | --- | | Enterprise procurement | Information security policy set | Answers to the questionnaire, named owners, a review date | | SOC 2 or ISO 27001 auditor | Information security policy set, including the access control policy and incident response procedure | Controls mapped to ISO/IEC 27001:2022 Annex A and SOC 2 criteria CC6 and CC7, procedures that match the evidence | | Data protection authority or user | Privacy policy pack, drafted against GDPR Articles 13 and 14, CCPA sections 1798.100 to 1798.135 and Nigeria Data Protection Act 2023 section 27 as they apply | Lawful bases, retention, rights, transfers, named processors | | Customer deploying your AI feature | AI governance suite | Risk management (EU AI Act Article 9), data governance (Article 10), record-keeping (Article 12), human oversight (Article 14) | ## Who needs these documents, and when These documents are for a SaaS company whose first enterprise prospect has sent a security questionnaire, a team preparing for a SOC 2 Type 1 report or an ISO/IEC 27001 certification audit, a product that processes personal data from more than one jurisdiction, or a company that has added AI to its product and now has customers asking how it is governed. The readers are procurement teams, auditors, data protection authorities, users and the customers who deploy your AI, and the documents are drafted for them. ## What we draft for a SaaS company Each document and what it is drafted against: - [Information security policy set](https://policydrafters.com/services/information-security-policies): ISO/IEC 27001:2022 Annex A and the SOC 2 Trust Services Criteria for security, principally CC6 on logical and physical access controls and CC7 on system operations. It is set out in the structure a questionnaire follows. - [Privacy policy pack](https://policydrafters.com/services/privacy-policy-pack): whichever of GDPR (Regulation (EU) 2016/679, Articles 13 and 14), the CCPA as amended by the CPRA (California Civil Code sections 1798.100 to 1798.135) and the NDPR apply to your users, covered in one set. It holds a notice for each audience and the internal procedures behind it. - [AI governance suite](https://policydrafters.com/services/ai-governance-suite), where your product uses or offers AI: each system documented against the EU AI Act (Regulation (EU) 2024/1689, Articles 9 to 14 and 26), the NIST AI RMF 1.0 and ISO/IEC 42001:2023. The information security policy set and the privacy policy pack are each $1,200 to $2,500. The AI governance suite is $3,000 to $5,000. The quote is fixed before we start and does not change. Each document is drafted from your intake, reviewed by our legal team and delivered in Word and PDF. The order to write them in is set out in [the policies a SaaS startup needs first](https://policydrafters.com/guides/policies-saas-startup-needs). What each privacy notice has to contain is in [GDPR, CCPA and NDPR privacy notices: what each needs](https://policydrafters.com/guides/gdpr-ccpa-ndpr-privacy-notice-requirements), and what an AI deployer has to keep on file is in [EU AI Act: what a deployer has to document](https://policydrafters.com/guides/eu-ai-act-required-documents). Nigerian data protection law is still known as the NDPR, but the Nigeria Data Protection Regulation 2019 was retired as an instrument by the Nigeria Data Protection Commission's General Application and Implementation Directive 2025, so the privacy policy pack cites the Nigeria Data Protection Act 2023 (section 27) and the directive (Article 27(3)). ## What the intake asks about your tools and data The intake asks which tools you run and who administers them, where your customers and users are, what data the product stores and for how long, who is on call when something breaks, and which questionnaires or audit criteria you have been sent. Send the questionnaire once we reply, and the documents are drafted to answer it in its own order. ## Questions ### Will the information security policy set get a SaaS company through a SOC 2 audit? The information security policy set is structured the way SOC 2 auditors expect to read it and is drafted against the Trust Services Criteria for security, principally CC6 and CC7. The audit also tests whether you follow the policies, and that part is your operation, not the document. PolicyDrafters drafts the documents and, under the maintenance plan, keeps them current. ### We are an early-stage SaaS startup. Which document do we need first? The first document a SaaS startup needs is usually the information security policy set, because an enterprise security questionnaire opens by asking for it. The privacy policy pack follows as soon as the product processes personal data from the EU, California or Nigeria. ### Can the information security policy set name the tools we actually use? The information security policy set can name the tools you actually use. The intake asks which identity provider, cloud, ticketing and monitoring tools you run, and the procedures name them, so the set describes your company rather than a generic one. ### What happens when SOC 2, ISO 27001 or privacy law changes? Under the maintenance plan, PolicyDrafters tracks the rules each document names, such as ISO/IEC 27001 Annex A, the SOC 2 Trust Services Criteria and the privacy laws the privacy policy pack was drafted against. When one moves, you receive a revised document with the changes marked and a new revision code, reviewed by our legal team before it is sent. --- # Policies for financial services firms URL: https://policydrafters.com/industries/financial-services PolicyDrafters drafts the AML/KYC manual, security policies and privacy pack that a fintech or financial services firm shows its regulator and bank, at a fixed price. - Documents: AML/KYC policy and procedure manual, for the regulator, the bank that onboards you and your auditor; The manual's customer due diligence and transaction monitoring procedures, for the staff who run them; Information security policy set, for the bank or partner who sends a security questionnaire and for your auditor; Privacy policy pack, for customers and the data protection authority; The manual's record-keeping and reporting procedures, for the examiner who samples them. - Services: AML/KYC manual (https://policydrafters.com/services/aml-kyc-manual); Information security policy set (https://policydrafters.com/services/information-security-policies); Privacy policy pack (https://policydrafters.com/services/privacy-policy-pack). - Drafted against: FATF Recommendations 10, 12, 16 and 20; Directive (EU) 2015/849 as amended; US Bank Secrecy Act and the FinCEN customer due diligence rule, 31 CFR 1010.230; ISO/IEC 27001:2022 Annex A; GDPR, CCPA and NDPR; The rulebook of the regulator you name in the intake. ## What the documents have to do An AML/KYC manual is the document that sets out how a firm assesses money-laundering risk, identifies and verifies its customers, monitors their activity and reports suspicion. It has to describe what your firm does, in the order the examiner checks it: how risk is assessed, how customers are identified and verified, how ongoing monitoring works, when enhanced measures apply, how suspicious activity is escalated and reported, how records are kept and for how long, and who is responsible for each step. A manual that describes a different firm, or describes nothing in particular, helps neither the examiner nor the staff who have to follow it. The information security policy set states how the firm protects its systems and who is responsible. The privacy policy pack states what personal data the firm collects, how long it is kept and how people exercise their rights. A licence application or a partner's due diligence can ask for both alongside the manual. | Reader | Document | What they look for | | --- | --- | --- | | Regulator or licensing team | AML/KYC manual | Risk assessment, due diligence tiers, monitoring, reporting, named officer | | Onboarding bank or partner | AML/KYC manual, information security policy set | A manual that matches the business described in the application | | Examiner or auditor | AML/KYC manual procedures and record-keeping, information security policy set | Steps that match the records sampled, retention periods stated, an owner for each control | | Customers and the data protection authority | Privacy policy pack | Lawful bases, retention, rights, transfers, named processors | ## Who needs these documents, and when A fintech or payments firm applying for its first licence or registration, a lender or adviser whose bank or partner has asked to see the AML manual, a firm that has outgrown the policies it wrote at launch, or a group whose regulator has asked for its documentation to be brought onto one standard. The readers are the regulator, the examiner, the onboarding bank and the auditor, and each of them checks the manual against the rule it names. ## What we draft What each document is drafted against: - The [AML/KYC manual](https://policydrafters.com/services/aml-kyc-manual) is drafted against FATF Recommendations 10, 12, 16 and 20 ([The FATF Recommendations](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html)). It is also drafted against Directive (EU) 2015/849 as amended ([Directive (EU) 2015/849](https://eur-lex.europa.eu/eli/dir/2015/849/oj)) or the US Bank Secrecy Act with the customer due diligence rule in 31 CFR 1010.230 ([31 CFR 1010.230](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010/subpart-B/section-1010.230)), as they apply to you, and the rulebook of the regulator you name. - The [information security policy set](https://policydrafters.com/services/information-security-policies) is drafted against ISO/IEC 27001:2022 Annex A ([ISO/IEC 27001](https://www.iso.org/standard/27001)). It includes an incident response procedure, a business continuity and backup policy and a vendor and third-party policy. - The [privacy policy pack](https://policydrafters.com/services/privacy-policy-pack) covers GDPR, CCPA and NDPR. It is drafted against only the regimes that apply to your customers. Each is quoted within its price band before we start, and the quote does not change. Each is drafted from your intake, reviewed by our legal team and delivered in Word and PDF with a document ID and revision block. The guide [What goes in an AML/KYC manual for a small firm?](https://policydrafters.com/guides/aml-kyc-manual-contents) sets out the manual's ten sections in order, with the rule and record behind each, and [Policy vs procedure: what is the difference?](https://policydrafters.com/guides/policy-vs-procedure) explains why the manual holds the policy and its procedures in labelled parts. Nigerian data protection law is still known as the NDPR, but the Nigeria Data Protection Regulation 2019 was retired as an instrument by the Nigeria Data Protection Commission's General Application and Implementation Directive 2025, so the privacy policy pack cites the Nigeria Data Protection Act 2023 (section 27) and the directive (Article 27(3)). ## What the intake asks Which regulator and which licence or registration, which products you sell and to which customers, how customers are onboarded today and which tools do the checks, who the responsible officer is, how records are kept, which systems and vendors hold customer data, and which documents the regulator or the bank has already asked for. Send the request once we reply, and the documents are structured to answer it in order. ## Questions ### Which regulator is the AML/KYC manual written for? PolicyDrafters drafts the AML/KYC manual for the regulator you name in the intake. The manual follows the FATF Recommendations and the EU or US rules that apply to you, then that regulator's own rulebook. Firms with more than one regulator are scoped in the intake and quoted before we start. ### Our bank has asked for our AML manual before it will open an account. How quickly can we have one? PolicyDrafters delivers the first draft of an AML/KYC manual in 15 working days from a complete intake. The AML/KYC manual page states what the intake asks, so you can gather it before you start. ### Is an AML policy the same as an AML/KYC manual? An AML policy is not the whole AML/KYC manual: in the manual PolicyDrafters drafts, the AML/CTF policy is one document. The manual also carries the procedures that put the policy into practice (customer due diligence and KYC, enhanced due diligence, transaction monitoring and suspicious activity reporting), a record-keeping and training schedule and a risk assessment template. ### How much does an AML/KYC manual cost? An AML/KYC manual from PolicyDrafters is quoted at $3,000 to $5,000. The quote is fixed before we start and does not change. ### Does PolicyDrafters advise on whether a firm needs a licence? PolicyDrafters does not advise on whether a firm needs a licence. It drafts the documents a licence application or a regulator asks for, and our legal team reviews them before delivery. Whether and where a firm needs a licence is a decision for the firm and its adviser. ### What happens to an AML/KYC manual when the regulator changes a rule? Under the maintenance plan, PolicyDrafters tracks the rules named in the AML/KYC manual, the information security policy set and the privacy policy pack, and sends a revised document, with the changes marked, when one of them changes. Our legal team reviews the revision before it reaches you. --- # HR policies and handbooks for small businesses URL: https://policydrafters.com/industries/small-business-hr An employee handbook, the HR procedures behind it and a review of the policies a small business already has, drafted for the managers who apply them, at a fixed price. - Documents: Employee handbook, for staff, managers and the investor, buyer or insurer who asks to see it; Leave, grievance and disciplinary procedures, for the managers who run them; Onboarding and offboarding procedures, for hiring managers and the staff who collect equipment and close access; Existing policies, reviewed against the rules they name and returned with every change marked, for the person who maintains them and the staff who look them up. - Services: Employee handbook (https://policydrafters.com/services/employee-handbook); SOP library (https://policydrafters.com/services/sop-library); Policy review and update (https://policydrafters.com/services/policy-review-and-update). - Drafted against: Employment law of the jurisdiction you name in the intake; Your existing contracts and policies, where you have them; ISO 9001:2015 clause 7.5 (documented information) for the structure of procedures. ## What the documents have to do HR policies are the written rules a small business sets for its staff. HR procedures are the steps its managers follow when leave, absence, a grievance or an exit comes up. An employee handbook is the document that sets them out in one place. The handbook has to answer the questions staff actually ask, in sentences a new manager can read aloud: how leave is requested and approved, what the working hours and expenses rules are, how a grievance is raised and what happens next, how performance and conduct are handled, and what the organisation expects on confidentiality, equipment and data. The procedures behind it have to be followable: numbered steps, an owner for each, and the record it leaves. Policies written at different times have to read as one set: each citing the current rules, none contradicting another, and each with an owner and a revision block. | Reader | Document | What they look for | | --- | --- | --- | | New starter | Employee handbook | Leave, hours, expenses, conduct, who to ask | | Manager | SOP library: leave, grievance, discipline, onboarding and offboarding | The steps for a grievance, a disciplinary, an absence, an exit | | Investor, buyer or insurer | Employee handbook, with the policy set | Documents that exist, are current and are acknowledged by staff | | The person who maintains them | Policy review and update | The current rule cited, no contradictions, an owner and a revision block | ## Who it is for A small business taking on its first employees, a team that has grown past the point where every manager answers the same question differently, a company whose investor, buyer or insurer has asked to see its HR policies, or a firm with a folder of policies written at different times by different people. The readers are staff and managers first, and the handbook is drafted so that they can act on it without a call. ## What we draft What we draft for the HR set: - The [employee handbook](https://policydrafters.com/services/employee-handbook) is drafted against the employment law of the jurisdiction you name, with an acknowledgement form, a document ID and a revision block. - The [SOP library](https://policydrafters.com/services/sop-library) turns the procedures behind it into numbered, owned steps on one template. - Where you already have policies, [policy review and update](https://policydrafters.com/services/policy-review-and-update) checks each against the current text of the rules it names and your house style. It returns a marked-up copy, a tracked revision and a change note. The employee handbook and the SOP library are each $1,200 to $2,500. Policy review and update is $350 to $500 per document reviewed. The quote is fixed before we start and does not change. Every document is reviewed by our legal team and delivered in Word and PDF. The guides on [what an employee handbook costs](https://policydrafters.com/guides/employee-handbook-cost), [the difference between a policy and a procedure](https://policydrafters.com/guides/policy-vs-procedure) and [how often to review policies](https://policydrafters.com/guides/how-often-review-policies) go further. ## What the intake asks Where your staff are employed comes first, because the handbook is drafted against that jurisdiction's employment law. For each procedure, the intake asks what starts it, who carries out each step, where a manager has to decide and what is written down. Name the policies you already use, with the rules each one answers and when it was last approved, and send them once we reply. Where you have no answer, the intake offers the common options and you pick one. ## Questions ### We have twelve staff. Is an employee handbook worth it at our size? An employee handbook is worth writing once more than one person answers staff questions. It holds the answers managers get asked for: leave, expenses, working hours, what happens when something goes wrong. With a handful of staff those answers can live in the founder's head; once managers start giving different answers, the handbook is where the one answer is written down. ### Our staff are in two countries. Can one employee handbook cover both? One employee handbook can cover staff in two countries, as a scoped job. A handbook is drafted against the employment law of the jurisdiction you name, so the intake asks where each group of staff is employed. Multi-country handbooks are scoped in the intake and quoted before we start. ### Can you work from the HR policies we already have? Existing HR policies can be named in the intake and sent once we reply, and the policy review and update service works from them. It checks each one against the current text of the rules it names and returns a revised copy with every change tracked, with a change note that says what moved and why. ### Which HR documents does PolicyDrafters draft for a small business? PolicyDrafters drafts three sets of HR documents for a small business: the employee handbook, the procedures behind it (leave, grievance, discipline, onboarding and offboarding) as an SOP library, and a review of the policies you already have. Each is reviewed by our legal team before delivery. --- # Administrative and compliance documentation for healthcare organisations URL: https://policydrafters.com/industries/healthcare-administration Administrative SOPs, privacy notices and security policies drafted against the HIPAA administrative safeguards, for healthcare clinics, practices and health tech firms. - Documents: Administrative SOP library (scheduling, records requests, billing, onboarding, vendor management), for the staff who run the front and back office; Privacy policy pack, for patients and the regulator; Information security policy set, drafted against the HIPAA administrative safeguards, for the compliance officer and the auditor; Incident response procedure and acceptable use policy, within the information security policy set, for managers and the compliance officer. - Services: SOP library (https://policydrafters.com/services/sop-library); Privacy policy pack (https://policydrafters.com/services/privacy-policy-pack); Information security policy set (https://policydrafters.com/services/information-security-policies). - Drafted against: HIPAA Privacy Rule, 45 CFR Part 164 Subpart E; HIPAA Security Rule administrative safeguards, 45 CFR 164.308, and documentation, 45 CFR 164.316; ISO/IEC 27001:2022 Annex A; CCPA as amended by CPRA, for California residents; GDPR (Regulation (EU) 2016/679), for patients in the EU; NDPR and the Nigeria Data Protection Act 2023, for patients in Nigeria; Your own administrative process, as captured in the intake. - Clinical procedures and clinical SOPs are out of scope: we draft the administrative and compliance documents around the care, never the care itself. ## What healthcare administrative documentation is Healthcare administrative and compliance documentation is the set of written policies and procedures that describe how a healthcare organisation runs its office, protects patient information and trains its workforce, as distinct from the clinical protocols that describe care. ## What the documents have to do The HIPAA Security Rule, made under the Health Insurance Portability and Accountability Act of 1996, names its administrative safeguards at 45 CFR 164.308. It requires them to be documented at 45 CFR 164.316. The HIPAA Privacy Rule, at 45 CFR Part 164 Subpart E, asks for a notice of privacy practices and for procedures that give patients their rights. An auditor reads the documents against the Security Rule's own list of standards: security management process, assigned security responsibility, workforce security, information access management, security awareness and training, security incident procedures, contingency plan, evaluation, and business associate contracts. Staff read the administrative SOPs to run the day: how an appointment is booked, how a records request is handled and logged, how a bill is raised and followed up, and how a new hire gets access and how a leaver loses it. Both sets have to say what your organisation actually does, with an owner and a record for each step. | Reader | Document | What they look for | | --- | --- | --- | | Front and back office staff | Administrative SOP library | Numbered steps, who does them, the record each leaves | | Compliance officer and auditor | Information security policy set | Policies mapped to the administrative safeguards, review dates, named owners | | Patient | Privacy policy pack | What is collected, who sees it, how to exercise rights | | Manager | Information security policy set: incident response and acceptable use | What to do and whom to tell when something goes wrong, and the rules staff follow | ## Who needs these documents, and when These documents are for a clinic or practice whose compliance officer has inherited a binder of policies nobody has read, a health technology company whose customers ask for its HIPAA policies before signing, a practice group bringing several sites onto one set of procedures, or an organisation that has been asked by an auditor or a payer to show how its administrative processes are documented. The readers are front and back office staff, managers, the compliance officer, the auditor and the patient. ## What we draft for a healthcare organisation The [SOP library](https://policydrafters.com/services/sop-library) documents your administrative processes as numbered, owned procedures on one template. The [privacy policy pack](https://policydrafters.com/services/privacy-policy-pack) carries the privacy notice and the request procedure behind patients' rights, drafted against whichever of the CCPA for California residents, GDPR for patients in the EU and the Nigeria Data Protection Act 2023 for patients in Nigeria apply, as the intake shows. The [information security policy set](https://policydrafters.com/services/information-security-policies) is drafted against the HIPAA administrative safeguards and ISO/IEC 27001:2022 Annex A, with each policy's control table in the sequence auditors expect to read it. The SOP library, the privacy policy pack and the information security policy set are each $1,200 to $2,500. The quote is fixed before we start and does not change. Each document is drafted from your intake, reviewed by our legal team and delivered in Word and PDF with a document ID and revision block. How to write procedures the front and back office will follow is set out in [how to write an SOP people actually follow](https://policydrafters.com/guides/how-to-write-an-sop), and what each privacy notice has to contain is in [GDPR, CCPA and NDPR privacy notices: what each needs](https://policydrafters.com/guides/gdpr-ccpa-ndpr-privacy-notice-requirements). Nigerian data protection law is still known as the NDPR, but the Nigeria Data Protection Regulation 2019 was retired as an instrument by the Nigeria Data Protection Commission's General Application and Implementation Directive 2025, so the privacy policy pack cites the Nigeria Data Protection Act 2023 (section 27) and the directive (Article 27(3)). ## What the intake asks about your organisation and patients The intake asks what kind of organisation you are and where your patients are, which systems hold records and who administers them, how the front and back office processes run today, who the privacy and security officers are, what training is given, and which documents an auditor, a payer or a customer has already asked for. Send the request once we reply, and we draft the documents to follow its order. ## Questions ### Does PolicyDrafters write clinical protocols or care pathways? No, PolicyDrafters drafts the administrative and compliance documents of a healthcare organisation: scheduling, records, billing, onboarding, privacy and security procedures. Clinical protocols and care pathways stay with your clinical leads. ### Which HIPAA documents do the rules actually ask for? The HIPAA Security Rule names its administrative safeguards at 45 CFR 164.308 (security management process, assigned security responsibility, workforce security, information access management, security awareness and training, security incident procedures, contingency plan, evaluation, and business associate contracts) and requires them to be written down at 45 CFR 164.316. The HIPAA Privacy Rule, at 45 CFR Part 164 Subpart E, calls for a notice of privacy practices and procedures for patients' rights. PolicyDrafters drafts the information security policy set against those administrative safeguards, and the privacy policy pack carries the privacy notice and the request procedure behind patients' rights. ### Does the privacy policy pack cover patients in more than one country? Yes, the privacy policy pack can cover patients in more than one country. The intake asks where patients are, and the pack is drafted against the regimes that apply to them, which can include the CCPA for California residents, GDPR for patients in the EU and the Nigeria Data Protection Act 2023 for patients in Nigeria. A pack covering one regime is quoted at the lower end of the $1,200 to $2,500 band. ### What happens to the healthcare documents when a rule changes? Under the maintenance plan, PolicyDrafters tracks the sections each document names and sends a revised document, with the changes marked, when one of them moves. Each revision is reviewed by our legal team before it reaches you. --- # How much does an employee handbook cost? URL: https://policydrafters.com/guides/employee-handbook-cost Question: How much does it cost to have an employee handbook written? Published: 2026-10-04. Updated: 2026-11-08. Written by PolicyDrafters. An employee handbook costs least as a downloaded template and most from a legal practice. A fixed-price drafting firm quotes one figure before work starts; ours lands in the $1,200 to $2,500 band, with review by our legal team included. Four things set the price: jurisdictions, headcount, your existing documents and policies beyond the core sections. ## What are you paying for when you buy a handbook? The cost of an employee handbook tracks four questions: who writes it, who reviews it, how much of it is written for your business rather than for every business, and whether anyone keeps it current after delivery. Each route answers them differently. - A downloaded template is the cheapest route. It leaves the fitting, the review and every later update with whoever in your business has the time. - A freelance HR writer drafts to your brief for a fee agreed by the hour or for the job. An independent legal review is a separate cost. - A legal practice usually costs the most, billed by the hour or under an engagement letter. It is the right place to go when you need advice on a live situation rather than a document. - PolicyDrafters, a fixed-price drafting firm, quotes one figure before work starts. It has the draft reviewed by our legal team and keeps it current under a maintenance plan. An employee handbook is the document that sets out an employer's rules, benefits and procedures for its staff in one place, with an acknowledgement each employee signs to record that they have read it. That definition matters for the price, because the second half of it, the record that each person has read the rules, is where a cheap handbook becomes expensive. A document nobody can rely on in a grievance or a dismissal is not a saving. In Great Britain the handbook also does statutory work. Section 1 of the Employment Rights Act 1996 requires an employer to give every worker a written statement of particulars no later than the first day of employment ([Employment Rights Act 1996, section 1](https://www.legislation.gov.uk/ukpga/1996/18/section/1)). Section 3 requires that statement to include a note of the disciplinary rules and the disciplinary and dismissal procedure, or a reference to a reasonably accessible document that sets them out. It must also say who the worker can take a grievance to ([Employment Rights Act 1996, section 3](https://www.legislation.gov.uk/ukpga/1996/18/section/3)). That document is often the handbook. The Acas Code of Practice on disciplinary and grievance procedures, in force since 11 March 2015, asks in paragraph 2 for those rules and procedures to be set down in writing and to be specific and clear, and employment tribunals take the Code into account ([Acas Code of Practice on disciplinary and grievance procedures (2015), paragraph 2](https://www.acas.org.uk/acas-code-of-practice-on-disciplinary-and-grievance-procedures/html)). ## What does a downloaded template cost you? A template is a finished-looking document written for every employer in a broad market, with placeholders for your name and a drop-down for your country or state. You get the structure of a handbook, usually the right headings in the right order, and a price you know at checkout. That is a real benefit when you have nothing at all. What you do not get is a reader. Nobody has asked how you hire, pay, review or let people go, so the leave section describes a leave scheme you may not run, the discipline section assumes a management structure you may not have, and the jurisdiction is often the seller's rather than yours. Nobody reviews the result for you. The review is your job, or it is skipped. When the law changes, the seller may update the master file, but your copy is a copy, and it stays as it was on the day you downloaded it unless you notice the change yourself and make it. The template is the cheapest line on the invoice and the most hours of your own time, and the hours are spent by whoever in your business is least equipped to spend them. ## What does a freelance HR writer give you for the fee? A freelance HR writer gives you a document written to your brief, for a fee agreed by the hour or for the job. The quality tracks two things: the writer, and the brief. A good writer with a good brief produces a usable handbook. A good writer with a thin brief produces a tidier template. The brief is where small employers struggle, because a brief lists the policies you know you need, and the policies you do not know you need are the ones that cause trouble later. A legal review is not part of the arrangement unless you pay for a separate one. And when the rule changes, there is no standing arrangement: you find the writer again, or a new one, and brief them again. ## What does a legal practice charge for? An employment lawyer's practice gives you a document drafted by someone qualified in the relevant jurisdiction and, if you ask for it, advice on how it applies to your situation. That advice is something a drafting firm does not provide, and when your real need is a view on a dispute or a restructuring rather than a document, the practice is the right place to go. The price is usually by the hour, or a fixed fee agreed in an engagement letter with a scope attached, and work outside the scope is billed on top. What you do not get, unless you negotiate it, is a figure that is fixed before the work begins and does not move. Maintenance is a new instruction each time, prompted by a client alert if the practice sends them. For a handbook that will be read by managers rather than litigated, the cost tends to sit well above what the document needs. ## What does a fixed-price drafting firm charge? PolicyDrafters drafts the handbook from an intake, has it reviewed by our legal team, delivers it in Word and PDF and keeps it current under a subscription. The intake is the part that replaces the brief: it asks where your staff are employed, how you hire, pay, review and let people go, what leave you offer, how grievances and discipline are handled, and which of your current documents still apply. Where you have no answer, it offers the common options and you choose one. Our [employee handbook](https://policydrafters.com/services/employee-handbook) is $1,200 to $2,500. The quote fixes one figure in that band before we start and does not change. The first draft arrives ten working days after a complete intake, one round of revisions is included, and the handbook comes with an acknowledgement form, a document ID and a revision block that records the legal team's review. The [maintenance plan](https://policydrafters.com/maintenance) is $29 to $99 a month, depending on how many documents are tracked. The full tariff is on the [pricing page](https://policydrafters.com/pricing). What PolicyDrafters does not do is advise on your legal position. We draft, our legal team reviews the draft, and you receive a document. Whether to adopt it, and how it applies to a particular person on a particular day, is a decision for you and for any adviser you choose. ## How does a template compare with a drafted handbook? Table: What a template gives you and what a drafted handbook gives you | Aspect | Template | Drafted | | --- | --- | --- | | Written for | Every employer in the seller's market | Your business, from an intake about how you work | | Jurisdiction | One, usually the seller's; you check the fit | The jurisdictions you name, drafted against their rules | | Who reviews it | You, or nobody | A legal team, recorded in the revision block | | Where the gaps show | At the first grievance or dismissal | At intake, before drafting starts | | Price | Known at checkout | Fixed before work starts and unchanged | | Revisions | Your own edits | One round included, with changes marked | | When the law changes | Your copy stays as downloaded | A revised handbook with the changes marked, under the maintenance plan | | Format | PDF or Word with placeholders | Word and PDF with a document ID and an acknowledgement form | ## What moves the price within the band? Four facts move a handbook from the bottom of the band to the top. The intake asks for all four, so the quote can be fixed before any drafting begins. The first is the number of jurisdictions. A handbook for staff employed in one country or one state is drafted against one set of rules. Staff in two places means two leave sections, two sets of statutory references and two notice regimes, and some sections have to be written twice rather than once. In Great Britain, for instance, section 86 of the Employment Rights Act 1996 sets the employer's minimum notice at one week for an employee with at least one month's but less than two years' continuous employment, one week for each year of continuous employment from two to twelve years, and twelve weeks from twelve years ([Employment Rights Act 1996, section 86](https://www.legislation.gov.uk/ukpga/1996/18/section/86)). A multi-country handbook is scoped in the intake and quoted as one figure. The second is headcount. A company of ten has fewer roles, fewer managers applying the document and fewer of the obligations that employment law attaches to larger employers. As headcount grows, more rules apply and more sections are needed to carry them, so the headcount band you give at intake sets part of the quote. In the United States, for example, the Family and Medical Leave Act covers a private employer with 50 or more employees for each working day during each of 20 or more calendar workweeks in the current or preceding calendar year ([29 CFR 825.104(a)](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-C/part-825/subpart-A/section-825.104)). A covered employer with any eligible employee must then give the FMLA general notice through its handbook or other written guidance on benefits or leave, where such materials exist, or hand a copy to each new employee on hiring ([29 CFR 825.300(a)(3)](https://www.ecfr.gov/current/title-29/subtitle-B/chapter-V/subchapter-C/part-825/subpart-C/section-825.300)). The third is what you already have. Contracts, offer letters, a page of house rules, a previous handbook: name them in the intake and send them once we reply. We keep what still matches the rule, rewrite what does not and mark every change. Reconciling that material against the current rules is work in its own right, so a handbook that carries forward existing documents sits higher in its band than one drafted from a clean start. The review by our legal team takes the same care either way. The fourth is the number of policies. Every handbook carries the core sections: employment basics, leave, conduct, performance and discipline, grievances and leaving. Beyond those, each additional policy, such as remote working, expenses, whistleblowing, staff data protection or drug and alcohol use, adds pages to draft and to review. You name the extras at intake, and the quote covers them. Nothing about the quote changes after it is issued. If the intake turns out to have missed something, we tell you before drafting, not after, and you decide whether the scope grows. ## What happens to the cost when the law changes? This is the part of the price that most comparisons leave out. A handbook is accurate on the day it is delivered and then starts to age, because leave entitlements, minimum notice periods and the rules on monitoring and flexible working move. They move on the legislature's schedule rather than yours. Flexible working in Great Britain is a recent example. Two changes took effect on 6 April 2024. - The Flexible Working (Amendment) Regulations 2023 removed the 26 weeks of continuous employment an employee needed before making a request. The right now applies from the first day of employment ([The Flexible Working (Amendment) Regulations 2023 (SI 2023/1328)](https://www.legislation.gov.uk/uksi/2023/1328/made)). - The Employment Relations (Flexible Working) Act 2023 amended section 80F of the Employment Rights Act 1996 to allow two requests to the same employer in any 12 months ([Employment Rights Act 1996, section 80F, as amended by the Employment Relations (Flexible Working) Act 2023](https://www.legislation.gov.uk/ukpga/1996/18/section/80F)). A handbook written before 6 April 2024 and never revised still describes the old rule. With a template, nothing happens unless you are watching. With a freelancer or a legal practice, each change is a new engagement with a new fee. Under the maintenance plan, when the rule changes, your document changes: we track the employment rules you were drafted against, issue a revised handbook with the changes marked, and keep the document ID and revision history current. That is what the subscription is for, and it is why the monthly figure belongs in any honest comparison of what a handbook costs over three years rather than on day one. If you already have a handbook and the question is whether it still describes the law and your business, a [policy review](https://policydrafters.com/services/policy-review-and-update) reads it against the rules it names as they stand today and returns a marked-up copy, a tracked revision and a change note. It is priced per document, so one handbook is one review. Where the change note says the document needs rewriting rather than revising, we quote the rewrite before any more work is done. ## Which route fits which business? A template fits a business that needs a placeholder this week and accepts that it will replace it. A freelancer fits a business with an experienced HR lead who can write the brief and check the result. A legal practice fits a business that needs advice on a live situation, not only a document. PolicyDrafters, a fixed-price drafting firm, fits the business in between: one that needs a handbook its managers can apply, reviewed by our legal team, at a figure it knows before it commits, and kept current without a new engagement every time the law moves. For a [small business setting up its HR documents](https://policydrafters.com/industries/small-business-hr), the handbook is usually the first document on the list, and the procedures and the review of older policies follow from it. ## Questions ### Is a free or cheap handbook template good enough? A free or cheap handbook template is a starting point, not a finished document. A template is written for every employer in a market, so the leave, discipline and grievance sections are generic and the jurisdiction is usually the seller's. Nobody has read it against your business, and nobody updates your copy when the rule changes. ### What makes one handbook cost more than another? Four things move the price of a drafted handbook: the number of jurisdictions your staff are employed in, the size of your headcount, whether you already have contracts and policies to work from, and how many policies you want beyond the core sections. All four are asked at intake, and the quote is fixed before we start. ### Does the handbook price include review by a lawyer? Review by our legal team is included in the fixed handbook quote, not charged as an extra. Every handbook PolicyDrafters drafts is reviewed by our legal team before it reaches you, and the review is recorded in the revision block on the document. ### What happens to the handbook when employment law changes? Under the PolicyDrafters maintenance plan, the employment rules the handbook was drafted against are tracked, and when one changes a revised version is issued with the changes marked. Without the plan the handbook is still yours to use and edit; it simply stops being tracked. ### I already have a handbook. Do I need a new one? An existing handbook often needs a review rather than a replacement. A policy review reads your handbook against the rules it names as they stand today and returns a marked-up copy, a tracked revision and a change note. If the document needs rewriting rather than revising, the change note says so and the rewrite is quoted before any more work is done. --- # Policy vs procedure: what is the difference? URL: https://policydrafters.com/guides/policy-vs-procedure Question: What is the difference between a policy and a procedure? Published: 2026-10-04. Updated: 2026-11-08. Written by PolicyDrafters. A policy states what the organisation requires and is approved by leadership; a procedure states the numbered steps that carry it out, each with an owner and a record. The policy changes rarely; the procedure changes with the tool or team. ISO/IEC 27001:2022 sets them apart: the policy in clause 5.2, operating procedures in Annex A 5.37. ## What is a policy, and what is a procedure? A policy is a written rule that an organisation commits to. It states what is required, who it applies to, who owns it and who may grant an exception. It is approved by the people who carry the risk, usually leadership or a board. It changes rarely, because the rule does not move when the tools do. A procedure is the written method that carries a policy out. It states the steps in order, the owner of each step, the system or form each step uses, and the record each step leaves behind. It is owned by whoever runs the process. It changes whenever the process does: a new tool, a new team, a new regulator's question. Read together, the policy proves the commitment exists and the procedure proves it is kept. That is why auditors and regulators ask to see both. ## How do you tell a policy from a procedure? Read the sentence and ask one question: does it say what must be true, or how to make it true? "All staff complete security awareness training within thirty days of starting" says what must be true, so it is a policy statement. "Send the new starter the training link on day one, record the completion date in the HR system, and chase after twenty-one days" says how to make it true, so it is a procedure. The first sentence survives a change of training provider; the second does not. That is the whole difference, and it decides who approves the document, how often it changes, and what an auditor will do with it. ## Why do auditors, regulators and staff read them differently? Three readers care about the split, and each reads the two documents for a different reason. The auditor and the regulator read them as evidence; the member of staff reads them as instructions. An auditor reads the policy to confirm the rule exists and is approved. Then the auditor reads the procedure to confirm the rule is followed, and then samples the records the procedure says it produces. If the policy and the procedure are one undifferentiated document, the auditor cannot tell which sentences are commitments and which are instructions. The auditor will ask for both to be separated before the audit continues. ISO/IEC 27001:2022 makes the distinction explicit. It asks for a documented information security policy in clause 5.2 and for documented operating procedures in Annex A control 5.37 ([ISO/IEC 27001:2022, clause 5.2 and Annex A 5.37](https://www.iso.org/standard/27001)). A regulator reads the policy as a statement of what the firm has committed to, and the procedure as evidence of how that commitment is kept. The FATF Recommendations ask firms to ([FATF Recommendations 1, 10 and 18 and their interpretive notes](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html)): - have policies, controls and procedures approved by senior management (the interpretive note to Recommendation 1) - implement programmes against money laundering (Recommendation 18) - apply customer due diligence measures step by step, as a separate requirement (Recommendation 10) A firm that hands over one document called a policy that is really a procedure, or the reverse, will be asked for the other one. A member of staff reads the procedure to do the job and the policy to understand why. A new starter does not need the rationale for a leave policy; they need the steps for requesting leave. A manager handling a grievance needs both: the policy that says what the organisation promises, and the procedure that says what to do on day one, day five and day ten. ## A worked example: data retention as policy and as procedure Take data retention. The policy says: - Personal data is kept no longer than the purpose requires. - The retention schedule in appendix A sets the period for each category. - The data protection lead owns the schedule and approves exceptions. - This policy is reviewed annually and when the law changes. Four sentences, approved by leadership, unchanged for years at a time. The procedure says: 1. On the first working day of each quarter, the operations lead exports from the CRM the list of customer records older than the retention period. 2. The operations lead checks the list against open contracts and legal holds. 3. The operations lead deletes the records with no hold using the bulk-delete tool. 4. The operations lead exports the deletion log. 5. The operations lead files the log under the quarter's folder. 6. The data protection lead signs the log. Six steps, each with an owner, a tool and a record. When the CRM changes, the procedure changes and the policy does not. Now take the common failure. One document, titled "Data retention policy", contains both the rule and the quarterly steps. The CRM changes. Nobody wants to take a procedural change to the board, so the document is not updated. Six months later the auditor reads that deletions are run in a tool that no longer exists. The finding is not "your procedure is out of date" but "your policy is not followed". That is a worse finding, against a document that was never meant to carry those steps. ## How do a policy and a procedure compare? Table: What belongs in a policy and what belongs in a procedure | Aspect | Policy | Procedure | | --- | --- | --- | | States | The rule: what must be true | The method: how it is made true | | Applies to | Everyone in scope, named by role | The people who perform each step | | Approved by | Leadership or the board | The process owner | | Changes when | The rule or the law changes | The tool, team or regulator's question changes | | Contains | Purpose, scope, rule, roles, exceptions, review cycle | Numbered steps, owner per step, system or form, record produced | | Proves | The commitment exists | The commitment is kept | | Length | One to three pages | As long as the steps need, often with a checklist | ## What sections should a policy and a procedure have? Every policy we draft has the same seven parts, in this order: 1. Purpose. 2. Scope. 3. The policy statements themselves. 4. Roles and responsibilities. 5. Exceptions and who approves them. 6. Related documents. 7. The revision block. Every procedure has six parts: - Purpose and scope, in one paragraph. - The roles involved. - The numbered steps, with an owner and a record for each. - The forms and systems used. - What to do when a step fails. - The revision block. The two templates look alike on the page, because they share the document ID convention and the revision block. They read differently on purpose, because a reader should know within a sentence which kind of document is in front of them. ISO 9001:2015 calls both "documented information" (clause 7.5). It asks only that documented information be identified, formatted, reviewed and approved (clause 7.5.2) and controlled (clause 7.5.3) ([ISO 9001:2015, clauses 7.5.2 and 7.5.3](https://www.iso.org/standard/62085.html)). The distinction between the two kinds is the drafter's discipline, not the standard's requirement. ISO has since withdrawn the 2015 edition and replaced it with ISO 9001:2026. The clauses cited here are from the 2015 text. ## How do you split a document that is doing both jobs? Start with the verbs. Sentences with "must", "will" and "is required to" are candidates for the policy. Sentences with "then", "open", "send", "record" and "file" are procedure. Move the second group into a new document, give each step a number and an owner, and name the record it produces. What is left in the first document is usually close to a policy already. Add the scope, the exception route and the review cycle if they are missing. Then give each document its own approver and its own revision block, and link them to each other. The policy's related-documents section names the procedure; the procedure's purpose paragraph names the policy it serves. The order matters when you have many documents to split. Start with the ones an auditor or regulator has asked for, because those will be read soonest. Start too with the ones that change most often, because those are the ones the single-document format has been silently breaking. ## When is one document enough? A small organisation with one process owner can keep a policy and its procedure in one file, if the file has two clearly separated sections. Those sections need separate approvers and separate revision histories. The test is whether the procedure section can change without the policy section being re-approved. If it can, the file is two documents sharing a cover. If it cannot, it is one document doing two jobs, and the first tool change will show it. An [employee handbook](https://policydrafters.com/services/employee-handbook) is the common case. It is mostly policy, with the procedures for leave, grievances and discipline either in appendices or in a separate [SOP library](https://policydrafters.com/services/sop-library) that the handbook refers to. An [AML/KYC manual](https://policydrafters.com/services/aml-kyc-manual) is the other common case. There the regulator expects both the policy commitments and the step-by-step procedures in one manual, in clearly labelled parts. Small businesses setting up their [HR documents](https://policydrafters.com/industries/small-business-hr) and [financial services firms](https://policydrafters.com/industries/financial-services) writing their first manual meet this question first. ## Questions ### Do I need both a policy and a procedure? Most organisations need both a policy and a procedure for any rule an auditor or regulator will ask about. The policy shows that the rule exists and who approved it; the procedure shows how it is followed and which records show it was done. ### What is an SOP? A standard operating procedure (SOP) is a procedure written to a fixed template, so every process in the organisation reads the same way. It sits under a policy and sets out the steps, owners and records for one process. ### Can a policy and its procedure live in one file? A policy and its procedure can live in one file, as long as they are separate sections with separate approvers and revision histories. The policy section is approved by leadership and changes rarely; the procedure section is owned by the person who runs the process and changes when the process does. One file with one approver for both is where the trouble starts. ### Who should write a policy, and who should write a procedure? The policy is drafted for the people who have to apply it and approved by whoever carries the risk. The procedure is drafted with the person who does the work, because they know the steps and the records. PolicyDrafters drafts both from an intake that asks those people the questions, and our legal team reviews the result. --- # What goes in an AML/KYC manual for a small firm? URL: https://policydrafters.com/guides/aml-kyc-manual-contents Question: What goes in an AML/KYC manual for a small financial services firm? Published: 2026-10-04. Updated: 2026-11-08. Written by PolicyDrafters. An AML/KYC manual has ten sections, in this order: business-wide risk assessment, governance and the compliance officer, customer due diligence in three tiers, politically exposed persons, beneficial ownership, ongoing monitoring, suspicious activity reporting, record keeping, training and independent review. The sections apply FATF Recommendations 1, 10, 11, 12, 18 and 20, and each names its rule, owner and record. ## What is an AML/KYC manual? An AML/KYC manual is the document that sets out how a firm assesses its money laundering and terrorist financing risk, identifies and verifies its customers, monitors their activity, reports suspicion and proves that all of it happened. AML stands for anti-money laundering and KYC for know your customer, the identification and verification work at the centre of the manual. An examiner reads it in a fixed order, because each section depends on the one before: the risk assessment explains why the due diligence tiers are set where they are, the tiers explain what monitoring looks for, and monitoring explains what gets escalated. The international structure comes from the FATF Recommendations ([The FATF Recommendations and their interpretive notes](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html)), the EU structure from Directive (EU) 2015/849 as amended ([Directive (EU) 2015/849](https://eur-lex.europa.eu/eli/dir/2015/849/oj)), and the US structure from the Bank Secrecy Act, 31 U.S.C. 5311 and following ([31 U.S.C. 5311 (Bank Secrecy Act)](https://www.govinfo.gov/content/pkg/USCODE-2024-title31/html/USCODE-2024-title31-subtitleIV-chap53-subchapII-sec5311.htm)), and the FinCEN rules in 31 CFR Chapter X ([31 CFR Chapter X](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X)). The specifics, meaning thresholds, deadlines and forms, come from the firm's own regulator. Our [AML/KYC manual](https://policydrafters.com/services/aml-kyc-manual) is drafted against the rulebook named in the intake, with the three frameworks giving the skeleton. The ten sections below are that skeleton. ## The business-wide risk assessment comes first The business-wide risk assessment is the first section of an AML/KYC manual. It states how the firm assesses its own exposure to money laundering and terrorist financing. It sets out: - the risk factors the firm considers, usually its customers, the countries it deals with, its products and services and its delivery channels - the method for scoring them: inherent risk, the controls in place, and the residual risk that remains - who approved the assessment, when it is refreshed and what triggers an early refresh FATF Recommendation 1 asks firms to identify, assess and understand their risks and to apply resources in proportion to them. Article 8(2) of Directive (EU) 2015/849 asks for the assessment to be documented, kept up to date and made available to the supervisor ([Directive (EU) 2015/849, Article 8](https://eur-lex.europa.eu/eli/dir/2015/849/oj)). The record this section produces is the assessment itself, dated, scored and signed, with the previous version kept. ## Governance names the responsible officer The governance section says who is accountable for the programme. It names the compliance officer or money laundering reporting officer, the level at which they sit, who they report to and what they report. It states that senior management approved the policy and when. The interpretive note to FATF Recommendation 18 asks for internal programmes that include compliance management arrangements and the appointment of a compliance officer at management level ([FATF Recommendation 18 and its interpretive note](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html)). Article 8(4)(a) of the directive asks for a compliance officer at management level where the size and nature of the business make it appropriate. Article 8(5) asks for the policies, controls and procedures to be approved by senior management. The records are the appointment letter or board minute, the approval of the policy, and the compliance officer's periodic report to management. ## Customer due diligence runs in three tiers The customer due diligence section is the longest in the manual. It states when due diligence is carried out: before a business relationship is established, before an occasional transaction above the regulator's threshold, whenever suspicion arises, and whenever doubts arise about earlier information. Article 11 of the directive lists those triggers, and FATF Recommendation 10 and Article 13(1) of the directive set the measures in the same four parts: identify and verify the customer, identify the beneficial owner, understand the purpose of the relationship, and monitor it ([FATF Recommendation 10](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html)). Simplified due diligence applies where the risk assessment shows lower risk and the regulator permits it, as Article 15 of the directive allows, and the section says what may be reduced and what may never be. Standard due diligence is the default: identify the customer, verify identity from reliable independent sources, identify the beneficial owner, and understand the purpose and intended nature of the relationship. Enhanced due diligence applies to the higher-risk cases in Article 18 of the directive and the ones the regulator lists, and adds source of funds, source of wealth, senior approval and more frequent review. Each tier names the documents accepted, the person who signs off and the point at which the firm declines to proceed. The record is the customer file with its risk rating and the evidence of verification. ## Politically exposed persons get enhanced measures The politically exposed persons section says how the firm finds out whether a customer or beneficial owner is a politically exposed person (PEP), a family member or a close associate. It says what the firm does when the answer is yes, and how long the treatment continues after the person leaves office. It names the screening method, the approver and the enhanced measures that follow: source of wealth and source of funds, senior management approval and closer ongoing monitoring. FATF Recommendation 12 sets the measures for foreign and domestic PEPs ([FATF Recommendation 12](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html)). Articles 20 to 23 of the directive carry them into EU law. Article 22 keeps the measures in place for at least 12 months after the person leaves office. The record is the PEP determination on the customer file, the approval, and the source of wealth note. ## Beneficial ownership looks through the legal entity The beneficial ownership section says how the firm looks through a legal entity to the natural persons behind it. It states the ownership threshold the regulator uses, what counts as control where nobody meets the threshold, which documents the firm accepts as evidence, and what it does when the chain cannot be traced. Article 13(1)(b) of the directive asks for the beneficial owner to be identified, for reasonable measures to be taken to verify identity and for the ownership and control structure to be understood. The national registers set up under Article 30 are a source the section can name. In the US, the customer due diligence rule at 31 CFR 1010.230(d) defines the beneficial owners of a legal entity customer as each individual who owns 25 per cent or more of its equity interests and a single individual with significant responsibility to control, manage or direct it ([31 CFR 1010.230](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010/subpart-B/section-1010.230)). Paragraph (b) of 31 CFR 1010.230 lets a covered financial institution collect the beneficial owners through the certification in appendix A to the section, given by the person opening the account, and then requires it to verify each one's identity ([31 CFR 1010.230](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010/subpart-B/section-1010.230)). The record is the beneficial ownership record or certification on file, dated, with the evidence behind it. ## Ongoing monitoring continues after onboarding The ongoing monitoring section says what the firm watches after onboarding. It describes: - the scenarios or rules that raise an alert, and the thresholds behind them - who reviews an alert and by when - how an alert is closed or escalated - how often each customer's information and risk rating are reviewed - which trigger events bring a review forward FATF Recommendation 10 and Article 13(1)(d) of the directive both make ongoing monitoring part of due diligence rather than a separate duty, so the section links back to the tiers. Higher-risk customers are reviewed more often, and their alerts are reviewed by a more senior person. The records are the alert log with its decisions and the periodic review log. ## Suspicious activity is escalated, then reported The suspicious activity section is where most manuals fall apart, so it is the one to write most carefully. It states how a member of staff raises a concern internally, the form they use, the deadline for the compliance officer to decide, and where the decision and its reasons are written down. It then states how a report is made to the financial intelligence unit (FIU), in the form and within the time the regulator sets. It also states what the firm does with the relationship while the report is pending, and the prohibition on tipping off. FATF Recommendation 20 requires a firm that suspects, or has reasonable grounds to suspect, that funds are the proceeds of crime to report promptly to the FIU. Recommendation 21 prohibits tipping off. Article 33 of the directive carries the same reporting duty, including the duty to respond promptly to the FIU's requests for information. Article 39 forbids telling the customer or anyone else that a report has been or will be made ([Directive (EU) 2015/849, Articles 33 and 39](https://eur-lex.europa.eu/eli/dir/2015/849/oj)). In the US the reporting rule for each sector sits in 31 CFR Chapter X. For a money services business, 31 CFR 1022.320(b)(3) sets a deadline of 30 calendar days from initial detection ([31 CFR 1022.320](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/subpart-C/section-1022.320)). The records are the internal report, the decision log and the filed report with its acknowledgement. ## Records are kept for at least five years The record keeping section says what is kept, where, for how long and who can retrieve it. It covers: - customer identification records - transaction records - the alert and decision logs - internal and filed reports - training records - the risk assessment itself FATF Recommendation 11 asks for transaction and due diligence records to be kept for at least five years. Article 40 of the directive sets five years after the end of the business relationship or the date of an occasional transaction, with the conditions for keeping records longer. In the US, 31 CFR 1010.430(d) sets five years for every record the chapter requires ([31 CFR 1010.430](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010/subpart-D/section-1010.430)). The section also says how records are produced for the regulator or the FIU on request and within what time. The record is the retention schedule and the evidence that it is applied. ## Training is logged and tested The training section says who is trained, on what, how often and how it is tested. New staff are trained before they handle customers. All relevant staff are refreshed at the interval the regulator expects, usually annually. The compliance officer and senior management receive training suited to their roles. FATF Recommendation 18 includes an ongoing employee training programme among the internal controls. Article 46(1) of the directive asks for staff to be made aware of the law and to take part in ongoing training programmes. For a US money services business, 31 CFR 1022.210(d)(3) asks for training that includes detecting suspicious transactions. The record is the training log with dates, attendees, content and any test result. ## Independent review tests the whole manual The independent review section says how the firm checks that the manual is followed. It names who carries out the review, how independent they are of the compliance function, how often the review happens, what it covers and how findings are tracked to closure. FATF Recommendation 18 includes an independent audit function to test the system. Article 8(4)(b) of the directive asks for one where the size and nature of the business make it appropriate. In the US, independent testing is one of the pillars of the programme rule for each sector in 31 CFR Chapter X. For a money services business, 31 CFR 1022.210(d)(4) asks for an independent review whose scope and frequency match the risk of the services provided ([31 CFR 1022.210](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1022/subpart-B/section-1022.210)). A small firm without an internal audit function names an external reviewer or a senior person outside day-to-day compliance. The record is the review report and the action tracker showing each finding, its owner and its closing date. ## What must each of the ten sections say and record? | Section | What it must say | The record it produces | | --- | --- | --- | | Business-wide risk assessment | The risk factors, the scoring method, the approver and the refresh cycle | The dated, signed assessment with prior versions | | Governance and responsible officer | Who the compliance officer is, their reporting line, senior management approval | Appointment minute, policy approval, periodic report | | Customer due diligence tiers | When due diligence applies, what each tier requires, what is accepted, who signs off, when to decline | Customer file with risk rating and verification evidence | | Politically exposed persons | How PEPs are found, who approves, what enhanced measures follow | PEP determination, approval, source of wealth note | | Beneficial ownership | The ownership threshold, the control test, accepted evidence, what to do when the chain breaks | Beneficial ownership record or certification | | Ongoing monitoring | Scenarios, thresholds, alert handling, periodic review by risk tier | Alert log, periodic review log | | Suspicious activity escalation and reporting | Internal reporting route, decision deadline, filing route, tipping off | Internal report, decision log, filed report | | Record keeping and retention | What is kept, where, for how long, how it is produced | Retention schedule and retrieval evidence | | Training | Who, what, how often, how tested | Training log | | Independent review | Who reviews, how independent, how often, how findings close | Review report and action tracker | ## What changes in the EU on 10 July 2027? Article 77 of the sixth anti-money-laundering directive, Directive (EU) 2024/1640, repeals Directive (EU) 2015/849 with effect from 10 July 2027 ([Directive (EU) 2024/1640, Article 77](https://eur-lex.europa.eu/eli/dir/2024/1640/oj)). From the same date the duties on firms sit mainly in the anti-money-laundering regulation, Regulation (EU) 2024/1624, which Article 90 applies from 10 July 2027 and which binds firms directly ([Regulation (EU) 2024/1624, Article 90](https://eur-lex.europa.eu/eli/reg/2024/1624/oj)). A manual drafted against the 2015 directive today names a rule that changes within its first review cycle. That is the case for a revision block and a [maintenance plan](https://policydrafters.com/maintenance), not for waiting. ## Which rulebook sets the specifics? The three frameworks agree on the sections and disagree on the details, and the firm's own regulator decides the details. Each of these comes from the rulebook the firm is supervised under: - the occasional transaction threshold - the deadline for an escalation decision - the form and time limit for a report - the ownership percentage - the retention period - the training interval That rulebook may be a state money transmitter regulator, FinCEN, a European national supervisor or a licensing authority elsewhere. A manual that quotes the FATF text and stops there reads as generic to an examiner, who wants to see their own rule's number next to each step. That is why the intake asks which regulator supervises you, and why the manual is drafted against that rulebook with the FATF, EU and US sources behind it. ## How do we draft an AML/KYC manual? We draft the manual from a structured intake, in the order above: risk assessment first, then the policy that states the commitments, then the procedures that carry them out. Each procedure names the person, the deadline and the record. Each procedure can be written to the firm's [SOP library](https://policydrafters.com/services/sop-library) template so the AML steps read the same way as every other process. Our legal team reviews the draft before it reaches you, and the review is recorded in the revision block. The manual is quoted in the bespoke manual band, $3,000 to $5,000, fixed before we start. Firms in [financial services](https://policydrafters.com/industries/financial-services) often meet this document when a licensing authority or a banking partner asks for it. The sections above are what that reader is looking for, in the order they will look. ## Questions ### Which regulator is an AML/KYC manual written for? An AML/KYC manual is written for the regulator the firm names in the intake. The FATF Recommendations, Directive (EU) 2015/849 and the FinCEN rules in 31 CFR Chapter X give the manual its structure; the regulator's own rulebook gives each procedure its thresholds, deadlines and forms. A firm with more than one regulator is scoped and quoted before drafting starts. ### Does a small firm need all ten sections of an AML/KYC manual? A small firm needs all ten sections of an AML/KYC manual, though each one is shorter. An examiner reads for the presence of each section and for whether it matches the business. A two-person firm has a two-page risk assessment and a one-paragraph governance section, not a missing one. ### What is the difference between the policy and the procedures in an AML/KYC manual? In an AML/KYC manual, the policy states what the firm commits to and who approves it; the procedures state the steps, the owner of each step and the record it produces. The manual holds both in clearly labelled parts so the examiner can read the commitment and then test whether it is kept. ### How long must AML records be kept? AML records are kept for at least five years. FATF Recommendation 11 sets that minimum, Article 40 of Directive (EU) 2015/849 counts the five years from the end of the business relationship or the date of an occasional transaction, and 31 CFR 1010.430(d) sets five years for the records the US rules require. The firm's own regulator can set a longer period. ### How long does an AML/KYC manual take to draft? The first draft of a PolicyDrafters AML/KYC manual takes fifteen working days from a complete intake. The manual is drafted against the FATF Recommendations, the EU directive, the FinCEN rules and the regulator you name, reviewed by our legal team, and revised once on your comments. --- # Policy templates vs drafted policies URL: https://policydrafters.com/guides/policy-template-vs-drafted Question: Policy templates vs drafted policies: when is a template enough? Published: 2026-10-04. Updated: 2026-11-08. Written by PolicyDrafters. A template is enough when the rule is generic, no auditor, regulator, customer or court will compare it to your practice, and you will edit it honestly. It stops being enough when such a reader appears, when several jurisdictions apply, as GDPR Article 3(2) and the CCPA can to a company based elsewhere, or when the named rule changes. ## What is a policy template, and what is a drafted policy? A policy template is a document written once for every organisation and edited by each one. It carries a generic rule, blanks for the name and the dates, and sometimes a note on what to change. The trade it offers is a fair one: a low price and a document today, in exchange for the work of making it true, which stays with you. Most template vendors say as much, and the question for a buyer is not whether templates are good or bad but whether the work that stays with you is work you can do, and whether anyone will check that you did it. A drafted policy is a document written from the facts of one organisation, against the current text of the rule those facts bring into scope, and checked before delivery by someone whose job is to read rules. The trade is a higher cost and a wait of days or weeks, in exchange for a document that already says what you do. ## Which three conditions make a template enough? A template is enough when three conditions hold, and all three have to. The first is that the rule is generic: some policies say the same thing in every organisation, because the rule leaves little room. A policy that staff must not share passwords, that expenses need a receipt, that visitors sign in at reception: the sentences barely change from one company to the next, and a template captures them well. The further a policy is from this, the less a template captures. The second is that nobody will audit the document. If the policy exists to tell staff what to do and no outside reader will ever compare it to practice, a template that is roughly right is better than no policy at all, and the cost of a small inaccuracy is small. The moment an outside reader appears, the cost changes, because the reader will hold the organisation to what the document says rather than to what it meant. The third is that the organisation will edit it honestly. A template is a draft, and it becomes a policy when someone reads each sentence, asks whether it is true here, and changes it where it is not. That takes an hour for a short policy and a day for a handbook, and it needs the person who knows the facts. The common failure is not that the template was wrong; it is that it was adopted unread, with the vendor's assumptions still in it. A template that is filled in, signed and filed in one sitting is a template that has not been edited. A [small business](https://policydrafters.com/industries/small-business-hr) with a handful of staff, no auditor and an owner who will sit down with the document on a quiet afternoon often meets all three conditions, and a template serves it well. Its visitor, expenses and password policies are the usual examples. ## When does a template stop being enough? The conditions fail in three ways, and each one arrives as a reader. The first reader compares the document to practice. An auditor sampling records, a regulator inspecting a programme, an enterprise customer running a vendor questionnaire, a court reading a handbook in a dispute: each reads the policy as a statement of what the organisation does, then looks for the evidence. A template that names a step the organisation does not take, or a role it does not have, is now a document the organisation is not following, and that is a worse finding than having no policy on the point. [SaaS companies](https://policydrafters.com/industries/saas-technology) meet this reader first in the security questionnaire, where the customer asks for the policy and then asks for the proof. A SOC 2 examination reads policies the same way: criterion CC5.3 of the AICPA Trust Services Criteria looks for control activities deployed through policies that set out what is expected and procedures that put those policies into action ([AICPA, 2017 Trust Services Criteria (revised points of focus, 2022), CC5.3](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)). ISO/IEC 27001:2022 Annex A 5.1 asks for policies that are approved by management and reviewed at planned intervals and when significant changes occur ([ISO/IEC 27001:2022, clauses 7.5.2 and 7.5.3, Annex A 5.1](https://www.iso.org/standard/27001)). The second failure comes when more than one jurisdiction applies. A template is written for one rule, and usually for one country. An employer with staff in two states or two countries, a service with users in the EU and California, a firm supervised by two regulators: each has a document to write that reconciles the rules, and a template cannot do that, because the reconciling is the drafting. The EU and California pairing catches companies based in neither place, because both laws reach past their borders. GDPR Article 3(2) applies to a controller outside the EU that offers goods or services to people in the EU ([Regulation (EU) 2016/679, Article 3(2)](https://eur-lex.europa.eu/eli/reg/2016/679/oj#art_3)), and the CCPA applies to a business that does business in California and meets one of the thresholds in Civil Code section 1798.140(d) ([California Civil Code section 1798.140(d)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.140&lawCode=CIV)). The [privacy policy pack](https://policydrafters.com/services/privacy-policy-pack) is drafted against GDPR, the CCPA and Nigeria's Data Protection Act 2023 together for this reason; the intake asks where the users are and the notice is written for the regimes that answer. The third failure comes when the document names a rule that changes. A template is current on the day it is sold. A policy drafted against a regulation, a standard or a rulebook has to move when the rule moves, and someone has to notice. The template vendor has sold the document and has no reason to tell you the rule has changed; the organisation has the document and nobody watching the rule. The result is a policy that cites a regulation by its old name, which is the first thing an auditor finds. Privacy notices for Nigerian users were drafted for years against the Nigeria Data Protection Regulation 2019, the NDPR. The Nigeria Data Protection Act 2023 then set the duties out in statute ([Nigeria Data Protection Act 2023 (Act No. 37 of 2023)](https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf)). On 20 March 2025 the Nigeria Data Protection Commission's General Application and Implementation Directive, Article 3(3), said the Commission would cease to apply the NDPR as a legal instrument ([NDPC, General Application and Implementation Directive 2025, Article 3(3)](https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf)). A template sold before then and never revisited still cites a retired rule. ## What happens to a template in a customer security review? A customer's security review is the clearest case of the first reader. The questionnaire asks what you do, control by control, and the reviewer asks for the policy behind each answer. An answer that access is reviewed quarterly is checked against the policy saying how and by whom, and both against the last review's record. A template carries the vendor's version of each control, so wherever your practice differs, the policy does not support the answer. Answers should describe the controls you run and the evidence you hold; the policy must match. The [security questionnaire guide](https://policydrafters.com/guides/security-questionnaire-what-to-do) covers the response. ## What does a drafted policy add? A drafted policy adds five things, each of which is work that the template leaves to you. A template you already hold can be read the same way: a [policy review and update](https://policydrafters.com/services/policy-review-and-update) checks it against the current text of the rules it names and returns a revised version with every change marked. An intake that captures the facts. Before anything is drafted, a structured set of questions asks where staff are employed, which systems hold data, who approves exceptions, how leave is requested, which regulator supervises the firm. The answers become the document. Where you have no answer, the intake offers the common options and you choose. The intake is the hour that the template buyer spends editing, moved to the front and done with a form that knows what to ask. Drafting against the current text of the named rule. The drafter reads the rule as it stands on the day of drafting and writes the clauses against it, naming the article or section each clause answers. The document can then say which version of the rule it was drafted against, which is what makes maintenance possible later. Review by our legal team. Every document we draft is reviewed by our legal team before it reaches you, and the review is recorded in the revision block. The review reads the document against the rule: a check that the document says what the rule says, in the facts the intake gave. It is not an opinion on your legal position, which stays with you. A document ID and revision block. Each document carries an identifier, a revision code, the owner, the approver, the dates and a line for each change. ISO/IEC 27001:2022 asks for the same things in clauses 7.5.2 and 7.5.3: identification such as a title, date, author or reference number, review and approval, and control of changes ([ISO/IEC 27001:2022, clauses 7.5.2 and 7.5.3, Annex A 5.1](https://www.iso.org/standard/27001)). This is the part of the document an auditor reads first, and the part a template rarely has. Maintenance when the rule changes. Under the [maintenance plan](https://policydrafters.com/maintenance) the rules each document names are tracked, and when one changes a revised version arrives with the changes marked and a new revision code. This is the answer to the third failure above: someone is watching the rule. ## How do a template and a drafted policy compare? Table: What a template and a drafted policy each provide | Aspect | Template | Drafted | | --- | --- | --- | | Starts from | A generic rule written for every organisation | Your facts, captured in an intake | | Written against | The rule as it stood when the template was written | The current text of the rule your facts bring into scope | | Jurisdictions | One, usually the vendor's | The ones you name, reconciled in the drafting | | Who makes it true | You, by editing each sentence | The drafter, from the intake; you review once | | Review | None, unless you arrange it | A legal team, recorded in the revision block | | Document ID and revision block | Rarely | On every document | | When the rule changes | Nobody is watching | A revised version under the maintenance plan | | Time to a document | Today | Five to twenty working days from a complete intake, as each service page states | | Cost | Low, paid once | Fixed, quoted before work starts | | Best for | Generic rules, no outside reader, an honest edit | Documents a reader will compare to practice | ## What does each cost? A template is cheap, and that is the point of it; we do not quote other vendors' prices here, and they vary. A drafted single policy is $350 to $500. A themed suite, which is a set of related documents such as an [employee handbook](https://policydrafters.com/services/employee-handbook) or a privacy policy pack, is $1,200 to $2,500. A bespoke manual, where a regulator expects the policy and the procedures in one controlled document, is $3,000 to $5,000. Each quote is fixed before we start and does not change, and the [pricing page](https://policydrafters.com/pricing) sets out what sits in each band. The comparison that matters is not template price against drafted price. It is template price plus the hours of editing, plus the cost of the first finding when a reader compares the document to practice, against the drafted price. For a visitor sign-in policy the template wins. For the handbook that a dismissed employee's representative will read, or the privacy notice that an enterprise customer's procurement team will read, the sum usually comes out the other way. ## How do you decide which policies to draft? Ask three questions of each policy, in order. Who will read it, and will they compare it to what the organisation does? Does more than one rule or jurisdiction apply? Does it name a rule that will change? Three noes mean a template edited honestly is enough: buy one and spend an afternoon on it. One yes makes the policy a candidate for drafting, and three make it the policy to draft first, because it is the one a reader will test. Many organisations end up with both: the visitor policy and the expenses policy come from a template and are edited once, while the handbook, the privacy notice and the procedures the auditor reads, often kept as an [SOP library](https://policydrafters.com/services/sop-library), are drafted, reviewed and kept current. That mix is not a compromise; it is a sensible allocation of a limited budget to the documents that carry the risk. ## Questions ### Can a template be made into a drafted policy later? A template-based policy can be brought up to the drafted standard later through a policy review and update. The review reads the document against the current text of the rules it names and your facts, returns a marked-up copy with the changes tracked, and adds a document ID and revision block. From there the document can join the maintenance plan. ### Do auditors reject policy templates? Auditors do not reject a policy for being a template. They test whether the document matches what the organisation does and whether it has been approved and reviewed, which ISO/IEC 27001:2022 Annex A 5.1 asks of every information security policy. A template that has been edited honestly and carries a revision block can meet those tests; one adopted unread usually cannot. ### Does a drafted policy tell us whether we are meeting the rule? A drafted policy does not tell you whether your organisation is meeting the rule. A policy PolicyDrafters drafts is drafted from your intake against the named rule and reviewed by our legal team; whether your practice matches it is what an auditor or regulator tests. ### How long does a drafted policy take? A drafted policy takes five to twenty working days from a complete intake to the first draft, depending on the document: each service page states its turnaround, and the quote states the one for yours. Your review and one round of revisions then add whatever time you need. --- # GDPR, CCPA and NDPR privacy notices: what each needs URL: https://policydrafters.com/guides/gdpr-ccpa-ndpr-privacy-notice-requirements Question: GDPR, CCPA and NDPR privacy notices: what has to be in each? Published: 2026-10-04. Updated: 2026-11-08. Written by PolicyDrafters. Privacy notices under the GDPR, CCPA and Nigeria's Data Protection Act 2023 share a core: identity, data collected, purposes, recipients, retention and rights. GDPR Articles 13 and 14 add lawful basis and transfers; the CCPA adds sale or sharing and a Do Not Sell or Share link; Nigeria's Act adds lawful basis and a complaint route to its Commission. ## What is a privacy notice? A privacy notice is the public statement by which an organisation tells the people whose personal data it processes who it is, what it collects, why, who receives it, how long it is kept and what rights those people have. Each of the three regimes gives it a different name and a slightly different list, but the lists overlap far more than they diverge. That overlap is what makes one well-structured notice workable for a company with users in Europe, California and Nigeria at once. The sections below take each regime in turn and then put them side by side. ## What does the GDPR require in a privacy notice? The General Data Protection Regulation sets the contents in two articles. Article 13 applies where the data is collected from the person, and the information is given at the time the data is obtained. Article 14 applies where it was obtained from somewhere else. Under Article 13(1) the notice states the following ([Regulation (EU) 2016/679 (GDPR), Articles 6, 12, 13, 14 and 30](https://eur-lex.europa.eu/eli/reg/2016/679/oj)): - the identity and contact details of the controller and, where there is one, its representative and its data protection officer - the purposes of the processing and the legal basis for each - the legitimate interests pursued, where that is the basis - the recipients or categories of recipient - whether the data is transferred to a third country, with the safeguard relied on and where to find a copy of it Article 13(2) adds: - the retention period or the criteria for setting it - the rights of access, rectification, erasure, restriction, objection and portability - the right to withdraw consent, where consent is the basis - the right to lodge a complaint with a supervisory authority - whether providing the data is a statutory or contractual requirement, and what happens if it is not provided - the existence of automated decision-making, including profiling, with meaningful information about the logic and the consequences Article 12(1) governs the form: concise, transparent, intelligible and easily accessible, in clear and plain language. Article 14 repeats the list for data obtained indirectly, except whether providing the data is required. It adds two items: the categories of personal data concerned (Article 14(1)(d)) and the source, including whether it came from a publicly accessible source (Article 14(2)(f)). Article 14(3) sets the timing ([Regulation (EU) 2016/679 (GDPR), Article 14](https://eur-lex.europa.eu/eli/reg/2016/679/oj)): - within a reasonable period, and at the latest within one month - at the latest at the first communication, where the data is used to contact the person - at the latest at the first disclosure, where disclosure to another recipient is envisaged The lawful basis is the item most notices under-state. Article 6(1) lists six bases, and the notice has to say which one applies to which purpose, not list all six and hope. ## What does the CCPA require in a privacy notice? The California Consumer Privacy Act, as amended by the California Privacy Rights Act, works with two documents that often sit in one. The first is the notice at collection under Civil Code section 1798.100(a). At or before the point of collection, the business tells the consumer the following ([California Civil Code section 1798.100(a) (CCPA)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.100&lawCode=CIV)): - the categories of personal information and of sensitive personal information it collects - the purposes for which each category is used - whether each category is sold or shared - how long it intends to retain each category, or the criteria used to decide The second is the privacy policy under section 1798.130(a)(5), which the business updates at least once every twelve months. It covers the following ([California Civil Code section 1798.130(a)(5) (CCPA)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.130&lawCode=CIV)): - the consumer's rights and two or more designated methods for submitting requests - the categories of personal information collected in the preceding twelve months, with the categories of sources and the purposes for collecting them - the categories sold or shared and the categories disclosed for a business purpose, with the categories of third parties involved The rights the policy describes are: - the right to know (sections 1798.110 and 1798.115) - the right to delete (1798.105) - the right to correct (1798.106) - the right to opt out of sale or sharing (1798.120) - the right to limit the use of sensitive personal information (1798.121) - the right not to be discriminated against for exercising any of them (1798.125) Section 1798.135(a) adds the mechanics. A business that sells or shares personal information provides a clear and conspicuous link titled "Do Not Sell or Share My Personal Information" on its homepage. Where that applies, a link titled "Limit the Use of My Sensitive Personal Information" sits there too. Neither is required if the business honours an opt-out preference signal under section 1798.135(b) and says so in the policy ([California Civil Code section 1798.135 (CCPA)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.135&lawCode=CIV)). The California scheme has no lawful basis concept and no transfer rules. Its weight falls on categories, sale or sharing and the opt-out. That is why a notice written only for Europe reads as incomplete to a Californian reader, even when the facts are all there. Automated decision-making technology is dealt with in the CCPA regulations rather than in the statute's notice list. The California Privacy Protection Agency revised those regulations in a package completed in September 2025 ([California Privacy Protection Agency, CCPA regulations](https://cppa.ca.gov/regulations/)). ## What does Nigeria require after the NDPR? The Nigeria Data Protection Act 2023 established the Nigeria Data Protection Commission and set out the duties of controllers and processors in statute ([Nigeria Data Protection Act 2023, sections 25 to 27, 35 and Part VIII](https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf)). The Nigeria Data Protection Regulation 2019 that preceded it is no longer the instrument to draft against. The Commission issued its General Application and Implementation Directive 2025 on 20 March 2025. Article 3(3) of the directive states that the Commission ceases to apply the NDPR as a legal instrument, without affecting anything done under it before ([NDPC, General Application and Implementation Directive 2025, Articles 3(3), 16 and 27](https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf)). A notice that still cites the NDPR by regulation number names a retired rule. That is the failure this site's [guide on templates](https://policydrafters.com/guides/policy-template-vs-drafted) warns about. Section 27(1) of the Nigeria Data Protection Act 2023 requires a controller, before it collects personal data directly from the data subject, to give: - the identity, place of business and contact details of the controller and its representatives - the specific lawful basis and the purposes of the processing - the recipients or categories of recipient - the rights the data subject has under Part VI of the Act - the retention period - the right to lodge a complaint with the Commission - the existence of automated decision-making, including profiling, with its significance, its consequences and the right to object to it Section 27(2) applies the same list where the data comes from another source. The exception is where the person already has the information, or providing it is impossible or disproportionate. Section 27(3) requires the information to sit in a privacy policy in clear, concise, transparent, intelligible and easily accessible form. The right to withdraw consent is a separate duty. Section 26(4) requires the data subject to be told of it before consent is given, and section 35 lets the data subject withdraw it at any time. Cross-border transfers are governed by Part VIII of the Act rather than by the notice list. A notice that states them follows good drafting practice, not a line of the statute. Article 27(3) of the directive then lists what the information to data subjects includes: - the name of the controller or processor - the lawful basis - the types of personal data collected - the purpose - the means of processing - access to the data by authorised third parties, and the purpose of that access - the data subject's rights - a contact for prompt internal remediation - the right to complain to the Commission Article 27(4) adds that this information is not itself a request for consent. The lawful bases in section 25 of the Act, restated in Article 16 of the directive, are consent, contract, legal obligation, vital interests, public interest and legitimate interests. A notice drafted for Europe therefore already carries the structure the Act expects. Two items on the directive's list, the means of processing and the internal remediation contact, do not appear in either of the other regimes. A notice intended for Nigerian users should carry them in their own paragraph. The Commission also runs a registration and compliance audit filing regime for controllers and processors of major importance (Articles 9 and 10 of the directive). The notice does not cover it, but the internal data protection policy should. ## How do the three sets of requirements compare? The table puts the three lists side by side, with the article or section that sets each item, so a drafter can see which rows are shared and which belong to one regime. Where a cell says practice, the item is not in that statute's list, but a well-drafted notice carries it anyway. | Requirement | GDPR | CCPA/CPRA | NDPA 2023 and GAID 2025 | | --- | --- | --- | --- | | Identity and contact details | Controller, representative, data protection officer (Art. 13(1)(a) and (b)) | Two or more designated methods for submitting requests (s. 1798.130(a)(1) and (a)(5)(A)) | Identity, place of business and contact details (NDPA s. 27(1)(a); GAID Art. 27(3)(a)) | | Categories of data | Required where data is obtained indirectly (Art. 14(1)(d)) | Required, including sensitive personal information (s. 1798.100(a)) | Types of personal data collected (GAID Art. 27(3)(c)) | | Source of the data | Source, and whether publicly accessible, for indirect collection (Art. 14(2)(f)) | Categories of sources (s. 1798.130(a)(5)(B)) | Not in the s. 27 list; practice | | Purposes | Each purpose stated (Art. 13(1)(c)) | Purpose for each category (s. 1798.100(a)) | Each purpose stated (NDPA s. 27(1)(b); GAID Art. 27(3)(d)) | | Lawful basis | Basis for each purpose; legitimate interests named (Art. 13(1)(c) and (d)) | No lawful basis concept | Specific basis for each purpose (NDPA s. 25 and s. 27(1)(b); GAID Art. 16) | | Recipients and sharing | Recipients or categories of recipient (Art. 13(1)(e)) | Categories disclosed, sold or shared, and the categories of third parties (s. 1798.130(a)(5)(B) and (C)) | Recipients (NDPA s. 27(1)(c)); authorised third-party access and its purpose (GAID Art. 27(3)(f) and (g)) | | Sale or sharing and opt-out | Not a concept; objection right applies | Whether sold or shared; Do Not Sell or Share link (s. 1798.135(a)) | Not a concept; withdrawal of consent applies (NDPA s. 35) | | International transfers | Transfers and safeguards (Art. 13(1)(f)) | Not required | Not in the s. 27 list; Part VIII of the Act governs transfers, and stating them is practice | | Retention | Period or criteria (Art. 13(2)(a)) | Period or criteria per category (s. 1798.100(a)) | Retention period (NDPA s. 27(1)(e)) | | Rights | Access, rectification, erasure, restriction, objection, portability (Art. 13(2)(b)) | Know, delete, correct, opt out, limit, non-discrimination (ss. 1798.105 to 1798.125) | The rights in Part VI of the Act (NDPA s. 27(1)(d); GAID Art. 27(3)(h)) | | Withdrawal of consent | Required where consent is the basis (Art. 13(2)(c)) | Not framed as consent; opt-out instead | Told before consent is given (NDPA s. 26(4)); information is not itself a request for consent (GAID Art. 27(4)) | | Complaint route | Supervisory authority (Art. 13(2)(d)) | Not in the statute's list; the Attorney General and the California Privacy Protection Agency enforce the Act | The Commission (NDPA s. 27(1)(f); GAID Art. 27(3)(j)); internal remediation contact (GAID Art. 27(3)(i)) | | Means of processing | Not in the Article 13 list | Not in the statute's list | Means of processing (GAID Art. 27(3)(e)) | | Whether provision is required | Statutory or contractual, and consequences (Art. 13(2)(e)) | Not required | Not in the s. 27 list; practice | | Automated decision-making | Existence, logic and consequences (Art. 13(2)(f)) | Covered by the CCPA regulations rather than the statute's notice list | Existence, significance and consequences, and the right to object (NDPA s. 27(1)(g)) | | Timing and placement | At collection (Art. 13(1)), or within one month at the latest for indirect collection (Art. 14(3)) | At or before collection (s. 1798.100(a)); policy updated at least every twelve months (s. 1798.130(a)(5)) | Before collection (NDPA s. 27(1) and (2)); in a privacy policy (s. 27(3)) | ## Why can one notice serve three audiences? The temptation is to write three notices, one per law. That produces three documents that drift apart as each is edited on its own, and three places to update when a processor changes. The alternative is one notice structured by section, where each heading matches a row in the table above. The identity section is written once. The data section lists categories, because California needs categories, and names the sources, because the GDPR needs the source for indirect collection and California asks for the categories of sources. The purposes section is a table with a column for the lawful basis, which Europe and Nigeria read and California ignores. The sharing section lists each category of recipient and states whether anything is sold or shared, which answers all three. The transfers section names the mechanism for each destination. The rights section is split by regime under sub-headings, because the rights differ and the reader should find theirs without reading the others. The complaint section names the three routes. The California-specific items, the Do Not Sell or Share link and the twelve-month category lists, sit in a section headed for California residents. The Nigeria-specific items, the means of processing and the internal remediation contact, sit in one headed for Nigerian users. Structured this way, the notice reads as one document to the person and carries each regime's full list for the regulator who reads it, and the facts live in one place. Each purpose row in the notice matches a line in the record of processing activities kept under GDPR Article 30, so when the record changes the drafter knows which row of the notice changes with it. ## Where do privacy notices usually go wrong? Three failures account for most of the gaps a reviewer finds in a privacy notice. The first is the sharing paragraph that says "we may share your data with trusted partners" and stops. Every regime wants the categories of recipient. California wants to know whether it is a sale or a share. The GDPR wants the transfer mechanism where the recipient is abroad. The second is the lawful basis listed as a block of all six bases rather than matched to each purpose. That fails the GDPR test and the Nigerian one. The third is retention stated as "as long as necessary" with no period and no criteria, where all three regimes ask for one or the other. A notice drafted from the records of processing avoids all three, because the register already holds the recipients, the basis and the retention period for each activity. ## How do we draft a privacy notice for the regimes that apply? The [privacy policy pack](https://policydrafters.com/services/privacy-policy-pack) is drafted against the regimes that apply to your users and quoted at $1,200 to $2,500. It contains: - the external notice, structured as above - a cookie notice - the internal data protection policy - a data subject request procedure - a records of processing template Our legal team reviews the draft before it reaches you, and the review is recorded in the revision block. A [SaaS or technology company](https://policydrafters.com/industries/saas-technology) with users in more than one of the three jurisdictions is the usual buyer. A [healthcare organisation](https://policydrafters.com/industries/healthcare-administration) buys the same pack for its administrative data, meaning appointments, billing, staff and supplier records. Clinical procedures and clinical SOPs are out of scope. Under the [maintenance plan](https://policydrafters.com/maintenance) the notice is reissued with the changes marked when any of the three regimes moves. The CPRA regulations and the rules under the Nigeria Data Protection Act have both moved since the laws were passed. ## Questions ### Can one privacy notice cover GDPR, CCPA and the NDPR? One privacy notice can cover the GDPR, the CCPA and Nigeria's rules, which today are the Nigeria Data Protection Act 2023 and the Commission's 2025 directive, if it is structured by section rather than by law. The shared sections carry the common content once, and the regime-specific sections, such as the lawful basis table for Europe and Nigeria or the categories and opt-out link for California, sit under their own headings so each reader finds their part. ### Is a privacy notice the same as a privacy policy? In practice, privacy notice and privacy policy are two names for the same public document. The CCPA calls it a privacy policy in Civil Code section 1798.130(a)(5); the GDPR calls the duty information to be provided, in Articles 13 and 14; Nigeria's Act calls it a privacy policy in section 27(3). PolicyDrafters drafts an external notice for the public and a separate internal data protection policy for staff, because the two have different readers. ### Does the CCPA apply to a company outside California? The CCPA can apply to a company outside California. Under Civil Code section 1798.140(d), it applies to a for-profit business that does business in California and meets one of three thresholds, wherever it is based: annual gross revenue above the inflation-adjusted statutory figure, buying, selling or sharing the personal information of 100,000 or more consumers or households a year, or deriving 50 percent or more of annual revenue from selling or sharing personal information. The PolicyDrafters intake asks where your users are and what you collect, and the notice is drafted against the regimes that follow from your answers. ### What does the privacy notice cover for a healthcare organisation? For a healthcare organisation, the privacy notice PolicyDrafters drafts covers administrative data: appointments, billing, staff and supplier records. Clinical procedures and clinical SOPs are out of scope, and a notice that covers clinical records is drafted against the health privacy rules that apply to the organisation, which the intake identifies. --- # How often should company policies be reviewed? URL: https://policydrafters.com/guides/how-often-review-policies Question: How often should company policies be reviewed, and by whom? Published: 2026-10-04. Updated: 2026-11-08. Written by PolicyDrafters. Review each policy at least yearly and whenever a trigger fires: a rule or fact it relies on changes, or an incident or audit exposes a gap. ISO/IEC 27001:2022 Annex A 5.1 asks for review at planned intervals and after significant changes. The owner reviews and the approver re-approves. On the PolicyDrafters maintenance plan, our legal team reads rule changes. ## Which two clocks does a policy run on? A policy review is a dated reading of a policy by the owner it names, against the current text of the rule it cites and the facts it states, recorded in its revision block with the reviewer's name and the outcome. Every policy needs that reading on two clocks. The first is the calendar: a fixed interval at which someone opens the document, reads it, and signs to say it still holds. The second has no fixed interval at all: it starts when something the document depends on changes, and it runs until the document is read again. Annually is the convention for the first clock, and for most documents it is a convention rather than a law; the standards that ask for review ask for planned intervals and leave the interval to you. A review schedule that has only the first clock will be right on the anniversary and wrong for the eleven months after the rule moved. The honest answer to the question, then, is both. Review on a cycle so that no document goes unread for more than a year, and review on a trigger so that a document is read within weeks of the thing it describes changing. The cycle catches slow drift: the office that moved, the approver who left, the tool that was replaced without anyone thinking of the policy. The trigger catches the changes that matter most and arrive without warning. Table: How a cycle review and a trigger review differ | Aspect | Cycle review | Trigger review | | --- | --- | --- | | Starts when | The review date in the document comes round, usually once a year | The rule or a fact changes, or an incident, an audit finding or a regulator's request arrives | | What is read | The whole document | The clause the trigger points at, and anything that depends on it | | Who reads it | The owner named in the document | The owner, with whoever made or handled the change, and a legal reviewer where a rule moved (our legal team, for documents on our plan) | | What it catches | Slow drift: a moved office, a departed approver, a replaced tool | The changes that matter most and arrive without warning | | What it records | A revision block row, even when nothing changed | A revision block row naming the trigger and the clauses changed | ## What starts a trigger review? A trigger is any event that makes a sentence in the document untrue or incomplete. Five recur, and each changes a different part of the document. | Trigger | Who acts | What changes | | --- | --- | --- | | The rule the document names changes: a regulation is amended, a standard is revised, a regulator issues new guidance | The document owner opens the review; a legal reviewer reads the affected clauses against the new text (our legal team, for documents on our plan) | The clauses drafted against the rule, the citation in the revision block, the review date | | A fact the document states changes: a new tool, a new office, a new product, a new processor, a new reporting line | The document owner, with the person who made the change | The description of the system, the named role, the scope, the record each step leaves | | An incident: a breach, a complaint, a near miss, a failed step | The owner and whoever handled the incident | The step that failed, the escalation route, what to do when the step fails again | | An audit or certification finding | The owner, the approver and the person who answered the auditor | The clause the finding names, often the record it asks for and the evidence that it exists | | A regulator's request or a customer's questionnaire | The owner, with the compliance lead | Whatever the request shows is missing, dated and approved so it can be sent | The common thread is that the trigger names the part of the document that has to be read, which is why a trigger review is usually quicker than a cycle review. The cycle review reads the whole document. The trigger review reads the clause the trigger points at, checks that nothing else depends on it, and records the change. ## Who reviews a policy, and who approves it? Three people have a role in a policy review, and a document that names only one of them tends to be reviewed by nobody. The owner, named by role, reads the document on the cycle and when a trigger fires: the person closest to the process, such as the HR lead for a leave policy or the compliance officer for an AML policy. The approver, usually the director, board or committee that carries the risk, re-approves any review that changes the rule. A review that changes only a fact, such as the name of a tool, can be approved by the owner alone if the document says so. A legal reviewer reads where the document is drafted against a rule: a handbook against employment law, a privacy notice against the GDPR or the CCPA, an AML manual against the FATF Recommendations. For a document on the PolicyDrafters maintenance plan, that is our legal team. The owner knows the process, the legal reviewer reads the new rule, and the revision block records both readings. ## What do the standards and the law ask for? The question is not only one of good housekeeping, because the standards and rules businesses are measured against each ask for review in their own words. ISO/IEC 27001:2022 asks top management to establish an information security policy and keep it available as documented information in clause 5.2, and to review the management system at planned intervals in clause 9.3; Annex A control 5.1 adds that the policies themselves are reviewed at planned intervals and when significant changes occur ([ISO/IEC 27001:2022, clauses 5.2 and 9.3, Annex A 5.1](https://www.iso.org/standard/27001)). That second condition is the trigger clock written into the standard. ISO 9001:2015 is broader, because it governs all documented information rather than security policy alone. Clause 7.5.2 asks that documented information be reviewed and approved for suitability and adequacy when it is created and when it is updated, and clause 7.5.3 asks that it be controlled so that the current version is the one in use ([ISO 9001:2015, clauses 7.5.2 and 7.5.3](https://www.iso.org/standard/62085.html)). ISO has since withdrawn the 2015 edition and replaced it with ISO 9001:2026; the clauses cited here are from the 2015 text. An auditor working to either standard will ask for the date of the last review and the name of the reviewer before asking anything about the content. Data protection law runs both clocks. Article 24(1) of the GDPR requires a controller's technical and organisational measures to be reviewed and updated where necessary, and Article 24(2) says those measures include appropriate data protection policies where that is proportionate ([Regulation (EU) 2016/679 (GDPR), Article 24](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). California fixes the calendar outright: Civil Code section 1798.130(a)(5), part of the CCPA, requires a business to update the information in its online privacy policy at least once every 12 months ([California Civil Code section 1798.130(a)(5) (CCPA)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.130&lawCode=CIV)). For that document, an annual review is a requirement of the statute rather than a convention. For firms under anti-money-laundering rules, the FATF Recommendations ask for policies, controls and procedures approved by senior management (paragraph 13 of the interpretive note to Recommendation 1), and for internal programmes with an independent audit function to test them (paragraph 1 of the note to Recommendation 18): cycle review by another name ([FATF Recommendations 1, 15 and 18 and their interpretive notes, updated June 2026](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html)). Paragraph 12 of the note to Recommendation 1 asks firms to keep risk assessments current. Recommendation 15 asks for one before a new product, business practice or technology launches. [Financial services firms](https://policydrafters.com/industries/financial-services) face the question most sharply: the examiner reads the revision history before the policy. ## Where is a review recorded? A review that leaves no record did not happen, as far as any reader can tell. The record is the revision block: a short table on the front or back page of the document carrying the document ID, the revision code, the date, the name and role of the reviewer, the name and role of the approver, and one line saying what changed and why. Each review adds a row. A reader who opens the document a year from now can see when it was last read, who read it, and whether the change was a cycle review that found nothing or a trigger review that rewrote clause six. The document ID matters for the same reason. A policy saved as "Leave policy v3 final (2)" cannot be told apart from its predecessors, and an auditor who finds two versions in circulation has found a finding. A document ID in the form the organisation uses for every document, with the revision code beside it, makes it possible to say which version was in force on a given date, which is the question an auditor, a regulator or a court will eventually ask. Where the document is drafted against a rule, the revision block also names the rule and the version of it the document was last checked against. That line is what makes a trigger review possible, because it tells the owner what to watch. ## How does the trigger clock keep running? The cycle clock is easy to run: a date in a calendar, an owner with a reminder. The trigger clock is harder, because it needs someone to be watching the rule, and most owners have a job that is not watching regulations. This is what the [maintenance plan](https://policydrafters.com/maintenance) is for. Each document on the plan lists the rules it was drafted against in its revision block, and the firm tracks those rules. When one changes we revise the affected sections, our legal team reviews the revision, and a new version arrives in Word and PDF with every change marked and a new revision code. Changes to the facts that you tell us about, a new tool or a new office, produce a revised document the same way. The plan is $29 to $99 a month, billed monthly, depending on how many documents we track, and the figure is in the quote. Documents we did not draft come onto the plan after a [policy review and update](https://policydrafters.com/services/policy-review-and-update), which reads each document against the current text of the rules it names, returns a marked-up copy with the changes tracked and a change note, and adds the document ID and revision block that make tracking possible. A [small business](https://policydrafters.com/industries/small-business-hr) with a handbook written three years ago by someone who has since left usually starts here. ## When should the cycle be shorter than a year? Annually is the convention, not the ceiling. Some documents want a shorter cycle because the facts in them change faster than the rules. A procedure that names a tool changes when the tool does, which can be quarterly, and a privacy notice that lists processors changes when a processor is added. An AML risk assessment is read again before a new product or delivery channel launches, as Recommendation 15 asks, rather than waiting for its anniversary. The right cycle is the one that is shorter than the usual interval between triggers for that document. If triggers arrive every few months, an annual cycle is a formality and the trigger clock is doing the real work. The reverse is also true. A policy that states a rule and names no tools, a code of conduct or a conflicts policy, can run on an annual cycle with little risk, because almost nothing in it changes between reviews. The point of naming the cycle in the document is that the reader knows which kind of document it is, and the owner knows when it is due. ## Questions ### Is an annual policy review a legal requirement? For most policies, an annual review is a convention rather than a legal requirement. ISO/IEC 27001:2022 asks for policy review at planned intervals and when significant changes occur, and leaves the interval to the organisation. A few rules do fix a cycle: California Civil Code section 1798.130(a)(5) requires the information in a business's online privacy policy to be updated at least once every 12 months. ### Who signs off a policy review? The owner named in the policy records the review in its revision block. A change to the rule goes back to the approver, usually leadership or the board. A change to a fact, such as the name of a tool, can usually be approved by the owner alone if the policy says so. ### What if nothing has changed at a policy review? A policy review that finds nothing to change is still recorded. A revision block row dated on the day of the review, with the reviewer's name and a note that the policy was reviewed with no change, is the evidence an auditor asks for. A policy with no such row is treated as unreviewed. ### How does the maintenance plan know when a rule changes? Each document on the PolicyDrafters maintenance plan lists the rules it was drafted against in its revision block. PolicyDrafters tracks those rules and, when one of them changes, sends a revised version with the changes marked, reviewed by our legal team. --- # How to write an SOP people actually follow URL: https://policydrafters.com/guides/how-to-write-an-sop Question: What is an SOP, and how do you write one people actually follow? Published: 2026-10-04. Updated: 2026-11-08. Written by PolicyDrafters. A standard operating procedure (SOP) is a numbered set of steps for one process, naming each step's owner, system and record. To write one people follow, walk the process with whoever does it, write one action per step, say what happens if a step fails, test it on a newcomer, and control it as ISO 9001:2015 clause 7.5 describes. ## What is an SOP? A standard operating procedure (SOP) is a written, numbered set of steps for carrying out one process. Each step names the role that performs it, the system or form it uses and the record it leaves. It lets a trained person do the task the same way each time and show that it was done. An SOP sits between two other documents. The policy above it says what must be true. The SOP says how that is made true. A work instruction below it details a single step, such as how to complete a form. A typical SOP carries these parts: - a header with the document ID, version, owner, approver, effective date and review date - the purpose and scope - the roles - the numbered steps - the decision points - the records - a revision block An SOP library is every such procedure in an organisation written to one template, so that a reader who has learned one knows the layout of all. The word "standard" carries two meanings and both matter. The procedure is the standard way of doing the task, so that two people doing it on different days produce the same result and the same record. And the document is written to a standard template, so that the header, the numbering and the revision block are in the same place on every procedure. Procedures that are followed tend to have both. Procedures that are ignored usually have neither. The [policy and procedure guide](https://policydrafters.com/guides/policy-vs-procedure) draws the line between the two kinds of document in more detail. ## Why are most SOPs not followed? An SOP is ignored for one of four reasons, and none of them is that staff are careless: - It was written by someone who does not do the task, so it describes the process as management imagines it rather than as it runs. - It has no owner per step, so when a step is skipped nobody is the person who skipped it. - It says nothing about what to do when a step fails, so the first exception sends the reader back to asking a colleague, and the document is never opened again. - It was written once, the tool changed, and the document now describes a screen that no longer exists. Each of those failures has a fix that is part of writing the document, not part of enforcing it. The method below is those fixes in order. ## Pick one process with one owner Start with one process, bounded at both ends: a trigger that starts it and a result that ends it. Onboarding a new starter begins when the offer is accepted and ends when the person has access, equipment and a signed acknowledgement. Handling a records request begins when the request arrives and ends when the response is sent and logged. A process with no clear end is two processes, and a procedure that tries to cover both will be followed for neither. Give the process one owner, named by role. The owner is the person who runs the process most days, not the most senior person in the department. The owner walks the process with you, approves the draft and opens the review when something changes. If two people claim ownership, the procedure will be reviewed by neither. ## Walk it with the person who does it Sit with the person who does the task and watch them do it, or have them talk through it with the screens open. Write down what they actually do, in the order they do it, including the step they describe as just checking the spreadsheet, because that step is a step. Ask at each point what they need to have in hand before they can start, where they have to decide something, and who they ask when they are unsure. The answers to the last question are the decision points and the escalation route, and they are the part of the procedure most often missing. This walk is the intake, one per process, and it is where the document gets its accuracy. A procedure written from a meeting about the process rather than from the process itself reads like management's view and is treated as such. ## Number the steps and name the owner, the system and the record Write one action per step, numbered, in the order the actions happen. Each step names the role that performs it, the system or form it uses and the record it leaves. "Create the user account in the identity system and record the account name on the onboarding checklist" is one step with one owner, one system and one record. "Set up the new starter" is a heading, not a step. The record is the part people leave out and the part an auditor reads. A step that leaves no record cannot be shown to have happened. A step that leaves a record in a named place can be sampled. If a step genuinely leaves no record, say so, and ask whether it should. Decision points get their own line. Where the person doing the task has to choose, the procedure names the options, the criterion, and who decides if the criterion does not settle it. Most procedures fall apart at the step where judgement is needed, written as if there were none. ## Write what happens when a step fails Every step can fail: the system is down, the approver is away, the document the step needs has not arrived. For each step that can fail in a way that stops the process, say what the person should do: wait and retry, use the named alternative, or escalate to the named role. This is the section that keeps the document open after the first exception. Without it the reader learns that the procedure covers the easy case only, and stops consulting it. ## Keep it on one template with a document ID and revision block Every procedure in the organisation goes on the same template: - a header with the document ID, the version, the owner, the approver, the effective date and the review date - a purpose and scope paragraph - the roles - the inputs - the numbered steps - the decision points - the records and where they are kept - the related documents - the revision block that records each change A reader who has used one procedure then knows where to look in all of them. A register of procedures can be kept because every document carries the same fields. ISO 9001:2015 is a useful reference here even for an organisation that is not certified to it, because its clause 7.5 says what a controlled document looks like. The requirements sit in clauses 7.5.2 and 7.5.3 ([ISO 9001:2015, clauses 7.5.2 and 7.5.3](https://www.iso.org/standard/62085.html)). Clause 7.5.2 asks that documented information be: - identified and described, by a title, date, author or reference number - in a suitable format and medium - reviewed and approved for suitability and adequacy when it is created and when it is updated Clause 7.5.3 asks that it be available where and when it is needed, adequately protected, and changed under control, with version control as the example the standard gives. ISO has since withdrawn the 2015 edition and replaced it with ISO 9001:2026. The clauses cited here are from the 2015 text. A template that carries those fields is structured the way auditors expect to read a controlled document, whichever standard they work to. ## Test it with someone who has never done the process Give the draft to a person who has never done the task and ask them to do it, or to walk through it, using only the document. Every point at which they stop and ask a question is a gap in the procedure, and most gaps are a missing input, an unnamed system or an undescribed decision. Fix the gap in the document rather than in the explanation, then test again. A procedure that a newcomer can follow is a procedure that the experienced person will also follow, because it matches what they do. ## Review it when the tool or the team changes A procedure describes tools and people, and both change faster than rules do. Set a review date on the header, a year out by convention. Open a review earlier whenever: - the tool changes - the team is reorganised - a step fails in a way the document did not cover - an auditor asks a question the document cannot answer Each review adds a row to the revision block: the date, the reviewer, what changed. A library needs a change-control procedure of its own, so that a change to one procedure is proposed, approved and issued the same way every time, and the register shows which version is current. The review cycles that the main standards and rules expect are set out in the [policy review guide](https://policydrafters.com/guides/how-often-review-policies). ## What do the steps of an SOP look like? The table shows the numbered steps of an SOP for onboarding a new starter, not the whole procedure. A full version adds the inputs, the decision points and the failure route for each step. | Step | Owner | System or form | Record | | --- | --- | --- | --- | | 1. Confirm the start date and role with the hiring manager | HR lead | Offer letter | Start date entered in the HR system | | 2. Create the personnel file and request identity documents | HR lead | HR system, right-to-work checklist | Checklist filed, documents stored in the personnel file | | 3. Order equipment | Office manager | Equipment request form | Request number on the onboarding checklist | | 4. Create accounts and assign access by role | IT administrator | Identity system, access matrix | Account names and access level on the onboarding checklist | | 5. Send the handbook and collect the acknowledgement | HR lead | Handbook, acknowledgement form | Signed acknowledgement in the personnel file | | 6. Book the training due in the first thirty days | Line manager | Training calendar | Training dates on the onboarding checklist | | 7. Review the checklist and sign it off | HR lead | Onboarding checklist | Signed checklist filed, start of probation recorded | Step four's failure route reads: if the access matrix has no entry for the role, the IT administrator asks the line manager to confirm the nearest listed role and records the decision on the checklist. Step five's reads: if the acknowledgement is not returned within five working days, the HR lead reminds the line manager and records the date. Two sentences, and the procedure survives its first two exceptions. ## Which rules require written procedures? Some sectors do not leave it to convention. In healthcare administration, the HIPAA Security Rule at 45 CFR 164.316 requires covered entities and business associates to keep the policies and procedures that implement the rule in written form, which may be electronic. Paragraph (b)(2) of the section then sets three requirements for that documentation ([45 CFR 164.316, HIPAA Security Rule documentation requirements](https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/subpart-C/section-164.316)): - retain it for six years from the date it was created or the date it was last in effect, whichever is later - make it available to the people responsible for carrying out the procedures - review it periodically, updating it in response to environmental or operational changes that affect the security of electronic protected health information That is a description of a controlled SOP library, written as a rule. [Healthcare organisations](https://policydrafters.com/industries/healthcare-administration) write procedures for access requests, workforce access, incident handling and records retention to this requirement. Clinical procedures and clinical SOPs are a different discipline and are out of scope for this guide and for our work. Financial services has the same kind of rule. In the United States, FinCEN's customer due diligence rule at 31 CFR 1010.230(a) requires covered financial institutions to establish and maintain written procedures reasonably designed to identify and verify the beneficial owners of legal entity customers, and to include those procedures in their anti-money-laundering programme ([31 CFR 1010.230(a), FinCEN customer due diligence rule](https://www.ecfr.gov/current/title-31/subtitle-B/chapter-X/part-1010/subpart-B/section-1010.230)). Procedures of that kind are the operational half of an [AML/KYC manual](https://policydrafters.com/services/aml-kyc-manual): customer due diligence, enhanced due diligence, monitoring and reporting. Each is written step by step with the record it leaves, because the examiner samples the records. Where no rule names the procedures, the business decides which to write first. A [small business](https://policydrafters.com/industries/small-business-hr) usually starts with the HR procedures that sit under its handbook, such as leave requests, grievances and onboarding, because those are the ones a new manager asks for first. ## How do you turn processes nobody has written down into an SOP library? In a growing organisation many processes are held only in the heads of the people who run them. They are unavailable whenever those people are. Getting them on paper follows the method above, run across the whole organisation. First list the processes, each with its trigger, its result and its owner. Keep that list as the register: the document that shows every procedure, its ID, its current version and its next review date. Then walk each process with its owner, because the steps that matter most are the ones the owner no longer notices doing, and a walk at the screen catches them where an interview does not. Write each procedure on the one template and test it on someone new. Issue it through change control, so that the next change to it is proposed, approved and recorded in the register the same way as the first. Order the list by who is waiting. A process a customer or auditor has asked to see goes first, then the ones only one person can do, then the rest. Our [SOP library](https://policydrafters.com/services/sop-library) is that project done for you, five to twelve procedures at a time. ## What changes when you write a library rather than one procedure? One procedure can be written in an afternoon by its owner, following the method above. A library of five to twelve is a project, because the template has to be agreed first, the register and change control set up, and every procedure walked with its owner. That is the shape of our [SOP library](https://policydrafters.com/services/sop-library) service: - one template agreed with you - each procedure drafted from an intake with the person who runs it - a register and a change-control procedure - review of the set by our legal team - the review dates kept moving under the maintenance plan Whether you draft the library yourself or have it drafted, the test is the same. Hand a procedure to someone who has never done the task and see whether they can. ## Questions ### How long should an SOP be? An SOP should be as long as its steps need and no longer. Most administrative procedures run two to four pages: a header, a paragraph of purpose and scope, the roles, the numbered steps with an owner and a record for each, the decision points, the records and the revision block. ### Who should write an SOP? An SOP should be written by the person who does the task, or by someone who has walked the task with them, and approved by the process owner. A procedure written from a meeting rather than from the process tends to describe what management imagines, and staff treat it accordingly. ### What is the difference between an SOP and a work instruction? An SOP covers one process end to end with its owners, decisions and records. A work instruction covers one step of it in detail, such as how to complete a form. Most organisations need SOPs first and add work instructions where a step is hard to do. ### How often should an SOP be reviewed? An SOP should carry a review date on its header, a year out by convention, and be reviewed earlier whenever the tool, the team or the process changes, a step fails in a way the document did not cover, or an auditor asks a question it cannot answer. Each review adds a row to the revision block with the date, the reviewer and what changed. ### Does PolicyDrafters write clinical SOPs? PolicyDrafters does not write clinical SOPs. It writes administrative and operational procedures, including the ones healthcare organisations keep for access requests, incidents and records; clinical procedures and clinical SOPs are out of scope. --- # The policies a SaaS startup needs first URL: https://policydrafters.com/guides/policies-saas-startup-needs Question: Which policies does a SaaS startup need before its first enterprise deal? Published: 2026-10-04. Updated: 2026-11-08. Written by PolicyDrafters. A SaaS startup needs eight policies before its first enterprise deal: information security, access control, acceptable use, incident response, business continuity and backup, vendor management, data retention and a privacy notice. Each answers a section of the buyer's security questionnaire and maps to ISO/IEC 27001:2022 Annex A and SOC 2. Where the product uses AI, add AI governance. ## Why does the order matter? The first enterprise deal arrives with a document attached. It is a security questionnaire, sent by the buyer's procurement or security team. An enterprise security questionnaire is a buyer's list of the controls a vendor must show before its product is allowed to hold the buyer's data. The questionnaire asks much the same questions whoever sends it, because most questionnaires cover the same ground as two sources: ISO/IEC 27001:2022 Annex A ([ISO/IEC 27001:2022, Information security management systems](https://www.iso.org/standard/27001)) and the AICPA's SOC 2 Trust Services Criteria ([AICPA, 2017 Trust Services Criteria (with revised points of focus, 2022)](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)). The order below is the order a typical questionnaire follows. A SOC 2 or ISO 27001 auditor later asks for the same documents, so a startup that writes them in this sequence meets each question with a document already written. Each policy below does the same three jobs. It states the rule, it names the owner, and it says which record proves the rule is kept. A questionnaire reviewer reads for the first two and an auditor samples the third; a policy with only the first is a statement of intent, and reviewers can tell within a paragraph. ## Why does the information security policy come first? The questionnaire opens by asking whether you have an information security policy, who approved it, and when it was last reviewed. ISO/IEC 27001:2022 asks for exactly this in clause 5.2 and again in Annex A control 5.1, which calls for a set of topic-specific policies approved by management, published, and reviewed at planned intervals ([ISO/IEC 27001:2022, clause 5.2 and Annex A 5.1](https://www.iso.org/standard/27001)). SOC 2 reaches the same document through its common criteria on communication, CC2.2 and CC2.3, which expect internal and external communication of security objectives and responsibilities. An information security policy is the short, management-approved document that states the organisation's commitment to protecting information and from which every other security policy derives. It sets out the scope of systems and data it covers, the roles that own security and the review cycle. It is the parent of the rest of the set, and it is usually signed by the chief executive so that the commitment visibly comes from the top. ## What does the access control policy say? The second block of questions is about who can reach what. How is access requested and approved, how are privileges separated, is multi-factor authentication enforced, and how quickly is access removed when someone leaves? Annex A controls 5.15 to 5.18 cover access control, identity management, authentication information and access rights, and 8.2 covers privileged access rights. SOC 2 puts the same questions under CC6.1 to CC6.3, which are the criteria a startup most often has to write from scratch, because they describe a joiner, mover and leaver process that has been running informally in a chat channel ([AICPA Trust Services Criteria, CC6.1 to CC6.3](https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022)). The access control policy states who grants access, on what basis, how privileged accounts are separated and reviewed, and the deadline for revoking access at offboarding. The record it names is the access review: a periodic list of accounts, checked and signed. Reviewers ask for the last one. ## Who is the acceptable use policy written for? The questionnaire then asks what staff are allowed to do with company systems and customer data: which devices, which cloud tools, what may be shared, what must be encrypted. Annex A 5.10 calls for rules on acceptable use of information and other associated assets, 6.2 ties the rules to terms and conditions of employment, and 8.1 covers user endpoint devices. SOC 2 touches the same ground in CC6.7 and CC6.8 on restricting the movement of data and preventing unauthorised software. The acceptable use policy is the one document every member of staff signs, so it is written for them rather than for the auditor: what they may install, what they may not, where customer data may be stored, and what happens on loss of a laptop. Its record is the signed acknowledgement, and the reviewer will ask what proportion of staff have signed it. ## What does the incident response procedure set? Every questionnaire has an incident section, and enterprise buyers read it closely because their own contracts pass notification deadlines down to vendors. The questions are concrete: who declares an incident, who is told and by when, what is recorded, how customers are notified. Annex A 5.24 to 5.28 cover incident management planning, assessment, response, learning and evidence, and 6.8 covers event reporting by staff. SOC 2 asks under CC7.2 to CC7.5, which run from detection through containment to post-incident review. The incident response procedure is the first document in the set that is a procedure rather than a policy, because what the reviewer wants is the steps. It names the roles, the severity levels, the notification clock for each, the evidence to preserve, and who signs the post-incident review. Most security policy sets fall apart here, because the procedure was written for a team of three and nobody has updated the names. ## What does the business continuity and backup policy set? The next block asks how the service survives an outage: backup frequency, restore testing, recovery time and recovery point objectives, redundancy across regions. Annex A 5.29 and 5.30 cover information security during disruption and ICT readiness for business continuity, 8.13 covers information backup and 8.14 redundancy. SOC 2's availability criteria A1.2 and A1.3 ask for recovery infrastructure, backups and the testing of recovery plans, and CC7.5 asks how incidents are recovered from. The business continuity and backup policy states what is backed up, how often, where, how restores are tested, and the recovery targets the organisation commits to. The record is the restore test log. A buyer who is relying on your product will want to see that a restore has been run, not only that backups are taken. ## What does the vendor management policy cover? Enterprise buyers know that their data will sit in your sub-processors, so the questionnaire asks for the list, how each vendor was assessed, and what the contracts say. Annex A 5.19 to 5.22 cover supplier relationships, from the policy through the agreements to monitoring and change. SOC 2 asks under CC9.2, which expects risks from vendors and business partners to be assessed and managed. The vendor management policy sets the tiers of vendor, the due diligence each tier gets, the contract terms required, and the review cycle. Its record is the vendor register, with the assessment date against each name. For a SaaS startup the register doubles as the sub-processor list the privacy notice refers to. ## What does the data retention policy contain? The questionnaire's data section asks how long customer data is kept, how it is deleted on termination, and how deletion is proved. Annex A 5.33 covers protection of records, 5.34 covers privacy and protection of personal data, and 8.10 covers information deletion. SOC 2's confidentiality criteria C1.1 and C1.2 ask how confidential information is identified, retained and disposed of. For personal data, Article 5(1)(e) of the GDPR, Regulation (EU) 2016/679, states the storage limitation principle directly: personal data is kept no longer than the purpose requires ([Regulation (EU) 2016/679, Article 5(1)(e)](https://eur-lex.europa.eu/eli/reg/2016/679/oj#art_5)). The data retention policy carries a schedule: each category of data, the period it is kept, the trigger that starts the clock and the method of deletion. The record is the deletion log. Reviewers compare the schedule with the privacy notice and the contract's termination clause, and look for the three to agree. ## Who asks to see the privacy notice? A SaaS startup's privacy notice is the public document the buyer's legal team asks to see. That team usually brings its own questions: - where personal data is processed - under what lawful basis - which transfers leave the jurisdiction - whether the records of processing exist The notice is drafted against the information duties in GDPR Articles 13 and 14 ([Regulation (EU) 2016/679, Articles 13 and 14](https://eur-lex.europa.eu/eli/reg/2016/679/oj#art_13)). For Californian users, it is also drafted against the notice at collection that the CCPA requires in California Civil Code section 1798.100(a) ([California Civil Code section 1798.100(a)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=1798.100&lawCode=CIV)). Behind it sits the register that GDPR Article 30 requires each controller and processor to keep. It lists the purposes of processing, the categories of data and recipients, transfers and retention periods ([Regulation (EU) 2016/679, Article 30](https://eur-lex.europa.eu/eli/reg/2016/679/oj#art_30)). Article 30(5) exempts organisations employing fewer than 250 persons. The exemption does not apply where the processing is likely to result in a risk, is not occasional, or includes special categories of data or Article 10 data on criminal convictions and offences. A SaaS product processing customer data every day rarely fits the exemption. A [privacy policy pack](https://policydrafters.com/services/privacy-policy-pack) covers both faces of the question. It contains the notice the public reads, and the internal data protection policy and request procedure that staff follow when a deletion or access request arrives, with the Article 30 register as a template. ## When is AI governance the ninth policy? Many questionnaires now carry an AI section, and it is asked whenever the product uses a model to generate, rank, recommend or decide something a user sees, or whenever staff use AI tools on customer data. The questions are: do you have an AI policy, which systems are in scope, who is responsible, how is human oversight arranged, and is the system high-risk under Article 6 of the EU AI Act, Regulation (EU) 2024/1689 ([Regulation (EU) 2024/1689, Article 6](https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_6)). ISO/IEC 42001:2023 supplies the management system structure most buyers expect ([ISO/IEC 42001:2023, AI management systems](https://www.iso.org/standard/42001)), and the NIST AI Risk Management Framework (AI RMF 1.0, released in January 2023) supplies the vocabulary US buyers use ([NIST AI Risk Management Framework (AI RMF 1.0)](https://www.nist.gov/itl/ai-risk-management-framework)). An [AI governance suite](https://policydrafters.com/services/ai-governance-suite) is the set of documents that answers this section: a governance policy, a risk management procedure, an acceptable use policy for AI, a system inventory, a human oversight procedure, an incident and complaint procedure, and a technical documentation template. For a startup whose product does not use AI, the section is answered with a sentence and the suite can wait. ## Who asks for each policy? The table maps each of the nine documents to the people who ask for it and the evidence they look for. Control numbers refer to ISO/IEC 27001:2022 Annex A and the 2017 SOC 2 Trust Services Criteria. | Policy | Who asks for it | What they look for | | --- | --- | --- | | Information security policy | Questionnaire, ISO/IEC 27001 clause 5.2 and Annex A 5.1, SOC 2 CC2.2 and CC2.3 | Approval from the top, scope, owners, review cycle | | Access control policy | Questionnaire, SOC 2 CC6.1 to CC6.3, Annex A 5.15 to 5.18 and 8.2 | Joiner, mover and leaver steps; the last access review | | Acceptable use policy | Questionnaire, Annex A 5.10, 6.2 and 8.1, SOC 2 CC6.7 and CC6.8 | Rules staff can follow; signed acknowledgements | | Incident response procedure | Questionnaire, SOC 2 CC7.2 to CC7.5, Annex A 5.24 to 5.28 and 6.8 | Roles, severity levels, notification clock, post-incident review | | Business continuity and backup policy | Questionnaire, SOC 2 A1.2 and A1.3, Annex A 5.29, 5.30, 8.13 and 8.14 | Recovery targets; the last restore test | | Vendor management policy | Questionnaire, SOC 2 CC9.2, Annex A 5.19 to 5.22 | Vendor register with assessment dates; contract terms | | Data retention policy | Questionnaire, SOC 2 C1.1 and C1.2, Annex A 5.33 and 8.10, GDPR Article 5(1)(e) | Retention schedule; deletion log; consistency with the notice | | Privacy notice and Article 30 register | Buyer's legal team, GDPR Articles 13, 14 and 30, California Civil Code section 1798.100(a) | Lawful bases, recipients, transfers, retention, rights | | AI governance policy | Questionnaire AI section, EU AI Act Article 6, ISO/IEC 42001:2023 | System inventory, classification, human oversight, incident route | ## Which questionnaire sections ask for each policy? The questionnaire arrives in one of a few shapes. - The Cloud Security Alliance publishes the CAIQ, a set of yes or no questions for documenting the security controls of IaaS, PaaS and SaaS services. Version 4.1 is combined with the Cloud Controls Matrix ([Cloud Security Alliance, STAR Level 1: Security Questionnaire (CAIQ v4.1)](https://cloudsecurityalliance.org/artifacts/star-level-1-security-questionnaire-caiq-v4)), whose 17 control domains give the CAIQ its sections ([Cloud Security Alliance, Cloud Controls Matrix](https://cloudsecurityalliance.org/research/cloud-controls-matrix)). - Google published the Vendor Security Assessment Questionnaire (VSAQ) as open-source templates, among them a security and privacy programmes questionnaire and an infrastructure questionnaire. The repository was archived in November 2022 and the templates remain public ([google/vsaq on GitHub, Vendor Security Assessment Questionnaire](https://github.com/google/vsaq)). - Many enterprise buyers send their own spreadsheet instead, which usually asks the same questions in its own order. The table shows where each of the eight policies is asked for in the two published formats: the CAIQ by Cloud Controls Matrix domain, and the VSAQ by template and section. A customer's own spreadsheet can be read the same way, by finding the section that asks about each control. Table: Where the CAIQ and the VSAQ ask for each of the eight policies | Policy | CAIQ v4.1 (Cloud Controls Matrix domain) | VSAQ (template and section) | | --- | --- | --- | | Information security policy | GRC, Governance, Risk Management and Compliance | Security and privacy programmes: Security Controls, and Security and Privacy Policies | | Access control policy | IAM, Identity and Access Management | Security and privacy programmes: Security and Privacy Policies, and Personnel Security; Infrastructure: Administrative Access | | Acceptable use policy | HRS, Human Resources Security, and UEM, Universal Endpoint Management | Security and privacy programmes: Security and Privacy Policies, on acceptable use of information and IT devices | | Incident response procedure | SEF, Security Incident Management, E-Discovery and Cloud Forensics | Security and privacy programmes: Security and Privacy Incident Response | | Business continuity and backup policy | BCR, Business Continuity Management and Operational Resilience | Infrastructure: Backups | | Vendor management policy | STA, Supply Chain Management, Transparency and Accountability | Security and privacy programmes: Partner Security Program | | Data retention policy | DSP, Data Security and Privacy | Security and privacy programmes: Security and Privacy Policies, on retention and destruction of data | | Privacy notice | DSP, Data Security and Privacy | Security and privacy programmes: Security Controls, which asks for a link to the public privacy policy | A policy gives an answer something to point at; it does not make the answer true. Each answer should describe the controls your organisation actually runs and the evidence it actually holds, and a reviewer who reads "yes" will often ask for the record behind it. The [guide to what to do when a customer sends a security questionnaire](https://policydrafters.com/guides/security-questionnaire-what-to-do) covers the response itself: the first day, answering honestly, what to say where a control is not yet in place, and the difference between a policy and the evidence of it. ## What should a startup do with the list? Write the policies in this order and stop when the questionnaire stops. The first six are the policy layer a security reviewer reads. An [information security policy set](https://policydrafters.com/services/information-security-policies) drafts all six against Annex A and the SOC 2 criteria, with a control table in each document that lists the questions it answers. The privacy notice and the register come from the privacy pack. The AI section, where it applies, comes from the governance suite. Each is drafted from an intake, reviewed by our legal team and delivered in Word and PDF at a fixed price. Each is structured the way the reviewer expects to read it. Together, that is what a [SaaS company](https://policydrafters.com/industries/saas-technology) with a deal waiting on the questionnaire needs: the right pages, in the right order, with a clause to point at for every question. The documents do not make the audit pass; the audit also tests whether the controls are followed, and that part is your operation. What the documents do is put the policy, the owner and the record on the page before anyone asks. ## Questions ### Do we need SOC 2 or ISO 27001 before the first enterprise deal? A startup usually does not need a SOC 2 report or an ISO 27001 certificate before its first enterprise deal. Most enterprise buyers send a security questionnaire first and ask for a report or a certificate later, often as a contract condition with a deadline. The questionnaire is answered from the policies, so the policies come first either way. ### Can one document cover all eight policies a SaaS startup needs first? One document can cover all eight policies a SaaS startup needs first, as long as each policy is a separate section with its own owner, control statements and revision history. Questionnaires and auditors ask for the documents by name, and a single file with eight clearly labelled parts answers that. One undifferentiated document does not. ### What does an auditor look for in a policy? An auditor looks for three things: that the policy exists and has been approved, that it names an owner and a control for each requirement, and that there is a record showing the control is followed. The document supplies the first two. The third is your operation, and the policy should say which record proves it. ### Does a startup with twenty people need a records of processing register? The small-organisation exemption in GDPR Article 30(5) rarely covers a SaaS startup, even one with twenty people. It exempts organisations employing fewer than 250 persons, but not where the processing is likely to result in a risk to people's rights and freedoms, is not occasional, or includes special categories of data or data on criminal convictions and offences. A SaaS product that processes customer data continuously will rarely qualify, and enterprise procurement teams ask for the register regardless. ### When does a SaaS startup need an AI governance policy? A SaaS startup needs an AI governance policy when the product uses a model to produce, rank, recommend or decide something a customer or their users see, or when staff use AI tools on customer data. Many enterprise questionnaires now carry an AI section that asks for the policy by name, and buyers in the EU ask whether the product is high-risk under Article 6 of the EU AI Act, Regulation (EU) 2024/1689. --- # EU AI Act: what a deployer has to document URL: https://policydrafters.com/guides/eu-ai-act-required-documents Question: What documents does the EU AI Act require from a deployer of AI? Published: 2026-10-04. Updated: 2026-11-08. Written by PolicyDrafters. Every EU AI Act deployer needs a record of its Article 4 AI literacy measures; some need Article 50 notices. Deployers of Annex III high-risk systems add, from 2 December 2027, Article 26 procedures for use, human oversight and monitoring, logs kept at least six months, notices to workers and affected people and sometimes an Article 27 impact assessment. ## Is your business a provider or a deployer? Regulation (EU) 2024/1689, the EU AI Act, divides most of its obligations between two roles, and the documents you need depend on which one you are. A deployer is a natural or legal person, public authority, agency or other body that uses an AI system under its own authority, except where the use is personal and non-professional, under Article 3(4). A provider is the person or body that develops an AI system, or has one developed, and places it on the market or puts it into service under its own name or trademark, under Article 3(3) ([Regulation (EU) 2024/1689, Article 3(3) and 3(4)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_3)). Most small and medium-sized businesses are deployers: they subscribe to a recruitment screening tool, a credit decisioning service or a customer service assistant and use it in their own operations. The heavy documentation in Chapter III Section 2, from the risk management system in Article 9 to the technical documentation in Article 11 and Annex IV, sits with the provider. The deployer's obligations are about use, oversight and records. Article 25(1) is the exception to watch. A deployer takes on the provider's obligations for a high-risk system if it puts its own name on it, substantially modifies it, or changes the purpose of a system so that it becomes high-risk ([Regulation (EU) 2024/1689, Article 25(1)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_25)). ## What does every deployer need under Article 4? Article 4 applies to providers and deployers of any AI system, not only high-risk ones. Under Article 3(56), AI literacy is the skills, knowledge and understanding that let providers, deployers and affected persons make an informed deployment of AI systems. It also covers being aware of the opportunities and risks of AI and the harm it can cause. Regulation (EU) 2026/1744 replaced Article 4 from 27 July 2026. Article 4(1) requires providers and deployers to take measures to support the development of AI literacy among their staff and the other people who operate and use AI systems on their behalf. The measures must take into account the training and experience of those people, the context of use and the people on whom the systems are used ([Regulation (EU) 2024/1689, Article 4, as amended by Regulation (EU) 2026/1744 (consolidated text of 27 July 2026)](https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_4)). The amended text adds that the duty does not require them to secure any specific level of literacy in any individual. Article 4(2) has the Commission publish practical examples of how to meet it. The Act does not prescribe a document, but an obligation to take measures is proved by a record of them: an AI literacy section in the AI governance policy, stating which roles use which systems and what training each receives, and a training record. Under Article 113 this duty has applied since 2 February 2025, so it is the first document a deployer is asked for. ## Which transparency notices does Article 50 require? Three of the transparency obligations in Article 50 of the EU AI Act fall on deployers. - Under Article 50(3), a deployer of an emotion recognition or biometric categorisation system must inform the natural persons exposed to it that the system is operating. - Under Article 50(4), a deployer of a system that generates or manipulates image, audio or video content constituting a deep fake must disclose that the content is artificially generated or manipulated. A narrower disclosure applies to evidently artistic or satirical content. - Also under Article 50(4), a deployer that publishes AI-generated text to inform the public on matters of public interest must disclose that the text is artificially generated or manipulated. This does not apply where the text has been through human review or editorial control and a person holds editorial responsibility for it. Article 50(5) requires the information to be given clearly and distinguishably, at the latest at the first interaction or exposure ([Regulation (EU) 2024/1689, Article 50(3) to 50(5)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_50)). The documents are notices: the wording shown before an emotion recognition or categorisation system runs, the label on generated media, and the disclosure line on published text. They belong in the AI use policy, so that the people publishing content know when a label is required. ## What does Article 26 require when a system is high-risk? Article 26 is the centre of a deployer's documentation when a system is high-risk, which for most businesses means a system listed in Annex III: recruitment and selection, promotion and termination decisions and worker monitoring under point 4, credit scoring under point 5(b), and risk assessment and pricing for life and health insurance under point 5(c), among others. Each paragraph of Article 26 implies a document ([Regulation (EU) 2024/1689, Article 26](https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_26)). Article 26(1) requires the deployer to take appropriate technical and organisational measures to ensure the system is used in accordance with the provider's instructions for use. The document is a use procedure that restates the provider's instructions in the deployer's own operating terms and records the measures taken. Article 26(2) requires human oversight to be assigned to natural persons who have the necessary competence, training, authority and support. The document is a human oversight procedure that names the overseers by role, states what they may do, including stopping the system or overriding an output, and records their training. Article 26(3) preserves the deployer's freedom to organise its own resources, so the procedure can fit the business. Article 26(4) requires that, to the extent the deployer exercises control over the input data, the data is relevant and sufficiently representative in view of the intended purpose. The document is an input data check: a record of which inputs the deployer controls and how their relevance has been assessed. Article 26(5) requires the deployer to monitor the operation of the system on the basis of the instructions for use and, where relevant, to inform the provider under Article 72. Where the deployer has reason to consider that use may present a risk within Article 79(1), it informs the provider or distributor and the market surveillance authority without undue delay and suspends use; where it identifies a serious incident, it immediately informs first the provider, then the importer or distributor and the relevant market surveillance authorities. The document is a monitoring and incident procedure with the contact routes and the clock written in. Article 26(6) requires the deployer to keep the logs automatically generated by the system, to the extent they are under its control, for a period appropriate to the intended purpose and for at least six months, unless other Union or national law provides otherwise. The document is a log retention line in the data retention schedule. Article 26(7) requires a deployer that is an employer, before putting a high-risk system into service or using it at the workplace, to inform the workers' representatives and the affected workers that they will be subject to the system. The document is the notice to workers, with a record of when it was given. Article 26(9) requires the deployer, where applicable, to use the information the provider supplies under Article 13 to carry out a data protection impact assessment under Article 35 of the GDPR ([Regulation (EU) 2016/679 (GDPR), Article 35](https://eur-lex.europa.eu/eli/reg/2016/679/oj#art_35)). The document is the DPIA itself, which belongs with the privacy documentation a [privacy policy pack](https://policydrafters.com/services/privacy-policy-pack) supplies. Article 26(11) requires a deployer of an Annex III system that makes or assists decisions about natural persons to inform those persons that they are subject to it. Article 86 gives a person subject to a decision taken on the basis of the output of an Annex III system, other than the critical infrastructure systems in point 2 of that Annex, a right to an explanation where the decision produces legal effects or similarly significantly affects them in a way they consider adverse to their health, safety or fundamental rights. That person may obtain from the deployer a clear and meaningful explanation of the system's role in the decision and the main elements of the decision ([Regulation (EU) 2024/1689, Article 86(1)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_86)). The documents are the notice to affected persons and an explanation template for the staff who answer those requests. ## Which logs does a deployer keep under Article 12? Article 12 is a provider obligation. It requires a high-risk AI system to allow the automatic recording of events over its lifetime, so that risks can be identified, post-market monitoring under Article 72 is supported and the deployer's own monitoring under Article 26(5) is possible ([Regulation (EU) 2024/1689, Article 12](https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_12)). The deployer does not design the logging, but Article 26(6) makes it the keeper of the logs under its control, so the system inventory should record where each system's logs are held and who can reach them. ## Who needs a fundamental rights impact assessment under Article 27? Article 27 requires some deployers, before putting a high-risk system referred to in Article 6(2) into use, to assess the impact its use may have on fundamental rights. It applies to bodies governed by public law, private entities providing public services, and deployers of the systems in points 5(b) and 5(c) of Annex III: credit scoring, and risk assessment and pricing for life and health insurance. Systems for the critical infrastructure area in point 2 of Annex III are excluded, and a deployer outside the categories the Article names is not required to carry one out ([Regulation (EU) 2024/1689, Article 27, as amended by Regulation (EU) 2026/1744 (consolidated text of 27 July 2026)](https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_27)). A fundamental rights impact assessment under Article 27(1) of the EU AI Act has six parts: - The deployer's processes in which the system will be used. - The period and frequency of use. - The categories of natural persons and groups likely to be affected. - The specific risks of harm to those categories, taking account of the information the provider gives under Article 13. - How the human oversight measures are implemented. - The measures to be taken if the risks materialise, including internal governance and complaint arrangements. Article 27(2) applies the duty to the first use and requires an update when any of those elements changes. Article 27(3) requires the deployer to notify the market surveillance authority of the results. It does so using the questionnaire template the AI Office is to develop under Article 27(5). Article 27(4), as amended in 2026, lets the deployer cross-refer to, or include, the relevant parts of a data protection impact assessment carried out under Article 35 of the GDPR. ## When do the obligations apply under Article 113? The Regulation was published in the Official Journal on 12 July 2024 and entered into force on 1 August 2024. Article 113, as first enacted, applied it in stages ([Regulation (EU) 2024/1689, Article 113, as first enacted](https://eur-lex.europa.eu/eli/reg/2024/1689/oj#art_113)): - From 2 February 2025: Chapters I and II, which contain the definitions, the AI literacy duty in Article 4 and the prohibited practices in Article 5. - From 2 August 2025: Chapter III Section 4 on notifying authorities and notified bodies, Chapter V on general-purpose AI models, Chapter VII on governance and Chapter XII on penalties, except Article 101. - From 2 August 2026: the rest, including Article 50. - From 2 August 2027: Article 6(1) and the obligations that follow from it. The timetable for high-risk systems was then changed. Regulation (EU) 2026/1744, the Digital Omnibus on AI, was adopted on 8 July 2026. It was published in the Official Journal on 24 July 2026 and entered into force on 27 July 2026. It amends Article 113 for Sections 1, 2 and 3 of Chapter III, which carry the high-risk requirements and the provider and deployer obligations in Articles 26 and 27. These now apply from 2 December 2027 for systems classified as high-risk under Article 6(2) and Annex III. They apply from 2 August 2028 for systems classified as high-risk under Article 6(1) and Annex I ([Regulation (EU) 2026/1744 (Digital Omnibus on AI), 8 July 2026](https://eur-lex.europa.eu/eli/reg/2026/1744/oj)). Article 50 keeps its date of 2 August 2026. A new Article 111(4) gives providers of generative systems already on the market until 2 December 2026 to apply the marking in Article 50(2). The two prohibitions the amendment adds to Article 5 also apply from 2 December 2026. Article 111(2), as amended, sets the rule for systems already in use. A high-risk system placed on the market or put into service before its Chapter III date is covered only if its design changes significantly from that date. Providers and deployers of high-risk systems intended for use by public authorities must comply by 2 August 2030 in any case ([Regulation (EU) 2024/1689, Article 111, as amended by Regulation (EU) 2026/1744 (consolidated text of 27 July 2026)](https://eur-lex.europa.eu/eli/reg/2024/1689/2026-07-27#art_111)). For an Annex III system, the Article 26 and 27 documents are therefore due from 2 December 2027, subject to that rule. The literacy and transparency documents are already due. The maintenance plan tracks the text as amended, so the dates in these documents move when the Regulation does. ## Which document answers which article? | Document | Article | Who needs it | | --- | --- | --- | | AI literacy measures and training record | Article 4 | Every deployer, from 2 February 2025 | | Transparency notices and labels | Article 50(3) to 50(5) | Deployers of emotion recognition, biometric categorisation, deep fakes and public AI text, from 2 August 2026 | | Use procedure with the provider's instructions filed | Article 26(1) | Deployers of high-risk systems | | Human oversight procedure and overseer training record | Article 26(2) and 26(3) | Deployers of high-risk systems | | Input data check | Article 26(4) | Deployers of high-risk systems that control input data | | Monitoring and incident procedure | Article 26(5) | Deployers of high-risk systems | | Log retention statement and inventory entry | Articles 26(6) and 12 | Deployers of high-risk systems | | Notice to workers' representatives and workers | Article 26(7) | Deployers that are employers using high-risk systems at work | | Data protection impact assessment | Article 26(9) | Deployers where GDPR Article 35 applies | | Notice to affected persons and explanation template | Articles 26(11) and 86 | Deployers of Annex III systems deciding about natural persons | | Fundamental rights impact assessment | Article 27 | Public bodies, public service providers, credit scoring and insurance deployers | ## How does an AI governance suite cover them? An [AI governance suite](https://policydrafters.com/services/ai-governance-suite) drafts the deployer's documents as one set: - The governance policy carries the Article 4 literacy section and the Article 50 notice rules. - The human oversight procedure carries Article 26(2). - The incident and complaint procedure carries Article 26(5) and the Article 86 explanation route. - The system inventory carries the Article 12 and 26(6) log entries. - The risk management procedure carries the Article 27 points or the risk register. The same documents are drafted against the NIST AI Risk Management Framework, AI RMF 1.0 ([NIST AI Risk Management Framework (AI RMF 1.0)](https://www.nist.gov/itl/ai-risk-management-framework)), and ISO/IEC 42001:2023 ([ISO/IEC 42001:2023, AI management systems](https://www.iso.org/standard/42001)). A [SaaS company](https://policydrafters.com/industries/saas-technology) selling into both markets therefore keeps one set. Each document is reviewed by our legal team before delivery. Under the maintenance plan, it is revised with the changes marked when the Act moves. The suite records the classification you make for each system and the reasons for it. It does not decide the classification for you. ## Questions ### Is a company a provider or a deployer under the EU AI Act? A company that develops an AI system, or has one developed and puts it on the market under its own name, is a provider under Article 3(3) of the EU AI Act. A company that uses an AI system under its own authority in its business is a deployer under Article 3(4). A deployer becomes a provider under Article 25(1) if it puts its own name on a high-risk system, substantially modifies it, or changes its purpose so that it becomes high-risk. ### When do a deployer's obligations under the EU AI Act apply? The AI literacy duty in Article 4 has applied since 2 February 2025, when Article 113 brought Chapters I and II into application. The transparency obligations in Article 50 apply from 2 August 2026. Regulation (EU) 2026/1744 moved the high-risk obligations, including Article 26 and the Article 27 impact assessment, to 2 December 2027 for Annex III systems and 2 August 2028 for Annex I systems. Under Article 111(2), a high-risk system placed on the market or put into service before its date is covered only if its design changes significantly from then on, except systems intended for public authorities, which must comply by 2 August 2030. ### How long must a deployer keep the logs of a high-risk AI system? Article 26(6) of the EU AI Act requires a deployer of a high-risk AI system to keep the logs the system generates automatically, to the extent they are under the deployer's control, for a period appropriate to the system's intended purpose and in any case for at least six months, unless other Union or national law sets a different period. ### Does every deployer need a fundamental rights impact assessment? Only some deployers need a fundamental rights impact assessment under the EU AI Act. Article 27(1) applies to deployers that are bodies governed by public law or private entities providing public services, and to deployers of the credit scoring and life and health insurance systems listed in points 5(b) and 5(c) of Annex III. It excludes the critical infrastructure systems in point 2 of Annex III, and other deployers of high-risk systems are not required to carry one out. ### Does holding the EU AI Act documents mean a company meets the Act? Holding the documents the EU AI Act describes is not the same as meeting the Act. The documents record what the Act asks a deployer to do and who does it. Whether a system is high-risk, whether the obligations apply and whether they are met in practice depend on the system and how it is used, which a document records but cannot settle on its own. --- # NIST AI RMF vs ISO 42001: which to document against? URL: https://policydrafters.com/guides/nist-ai-rmf-vs-iso-42001 Question: NIST AI RMF vs ISO 42001: which one should a small company document against? Published: 2026-10-04. Updated: 2026-11-08. Written by PolicyDrafters. Document against whichever framework your customers name. US customers usually ask for NIST AI RMF alignment, which is voluntary and not certifiable; certification-driven procurement asks for ISO/IEC 42001:2023, which is audited against clauses 4 to 10 and Annex A. If nobody has asked, start with the documents both share: an AI policy, a system inventory and a risk procedure. ## What is the NIST AI RMF? The NIST AI Risk Management Framework 1.0 is a voluntary framework, published by the US National Institute of Standards and Technology on 26 January 2023, that organises the management of AI risk into four functions: Govern, Map, Measure and Manage ([NIST AI 100-1, AI RMF 1.0](https://doi.org/10.6028/NIST.AI.100-1)). Govern is the cross-cutting function: policies, roles, accountability and culture. Map sets the context for a system, who it affects and what could go wrong. Measure tests and tracks the risks that Map identified. Manage decides what to do about them and records the decision. Each function is divided into categories and subcategories that read as outcomes rather than instructions, and the framework does not say which of them a given organisation must meet. A companion Playbook suggests actions, references and documentation for each subcategory, and NIST publishes profiles for particular uses, including NIST AI 600-1, the generative AI profile issued on 26 July 2024 ([NIST AI RMF resource page](https://www.nist.gov/itl/ai-risk-management-framework)). Two things follow from the framework being voluntary. Nobody certifies against it; an organisation says it is aligned, and a customer either takes its word or asks to see the evidence. And it carries no fixed clause structure, so two organisations that both claim alignment can hold very different document sets. That flexibility is what US buyers like about it, and it is also what makes it hard to point at a single list of required documents. ## What is ISO/IEC 42001? ISO/IEC 42001:2023 is an international standard, published in December 2023, that specifies the requirements for an AI management system: the policies, roles, processes and records through which an organisation establishes, operates, monitors and improves its development or use of AI ([ISO/IEC 42001:2023](https://www.iso.org/standard/42001)). It uses the same harmonised structure as ISO/IEC 27001 and ISO 9001, so clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement, in that order. Annex A lists the reference controls, grouped under nine objectives (A.2 to A.10) that run from AI policies and internal organisation through resources, impact assessment, the system life cycle, data, information for interested parties, use of AI systems and third-party relationships. Annex B gives implementation guidance for each control, and clause 6.1.3 asks the organisation to produce a statement of applicability saying which controls it has adopted and why the others do not apply. The standard is written to be audited. Every "shall" in clauses 4 to 10 is a requirement an accredited certification body can test, and each one expects documented information behind it. That is the trade: a fixed structure that takes more work to set up, in exchange for a certificate at the end. ## Who asks for which framework? In practice the question is settled by whoever is sending you the questionnaire. US enterprise customers and US public bodies tend to reference NIST, partly because the framework comes from a US federal agency, and partly because NIST frameworks are familiar from the security questionnaire that arrived first. The usual form of the request is "describe how your AI risk management aligns to the NIST AI RMF", and it is answered with a mapping document rather than a certificate. Procurement that is driven by certification asks for ISO/IEC 42001 in the same breath as ISO/IEC 27001, because the buyer's vendor process is built around certificates and a management system standard fits the slot. European buyers, larger buyers with formal supplier assurance programmes and any buyer that already holds 42001 itself are the ones most likely to ask. Regulators, so far, name neither as mandatory. The EU AI Act lets conformity with its requirements be shown through harmonised standards, and under Article 40(1) a standard gives that presumption only once its reference is published in the Official Journal ([Regulation (EU) 2024/1689 (EU AI Act)](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)). The first European standard written for the Act, EN 18286:2026 on the quality management system that Article 17 asks of providers of high-risk systems, was published by CEN and CENELEC in July 2026 ([CEN and CENELEC, EN 18286:2026](https://www.cencenelec.eu/news-events/news/2026/en-in-the-spotlight/2026-07-30-ai-quality-management/)). The Act is therefore a reason to watch both texts rather than a reason to hold a 42001 certificate today. ## Which one can you be certified against? NIST AI RMF alignment is a claim you make and support. ISO/IEC 42001 certification is a claim a third party makes about you after a two-stage audit: a review of the documented management system, then a test of whether the system runs as documented, followed by surveillance audits in the following years and a recertification audit at the end of the cycle. The standard therefore carries a visible cost that the framework does not, and a visible result that the framework cannot give. A small company that documents against 42001 without seeking certification still gains the structure; it forgoes the certificate, and should say so plainly rather than imply otherwise. ## What documents does each one imply? Neither text hands you a list of documents by name, but each implies one. For NIST, the Govern function expects an AI policy that assigns accountability, a record of roles, and a process for reviewing risks; Map expects an inventory of AI systems with the context and intended use of each; Measure expects a testing and monitoring record; Manage expects a procedure for responding to risks and incidents and for deciding whether a system continues. A mapping table that places each of your documents under the relevant subcategory is the artefact customers actually ask to see. For ISO/IEC 42001, the documents are closer to prescribed. Clause 5.2 asks for an AI policy, clauses 6.1.2 and 6.1.3 for a risk assessment and risk treatment process with its results and a statement of applicability against the Annex A controls, clauses 6.1.4 and 8.4 for an AI system impact assessment, clause 6.2 for objectives, clause 7.5 for controlled documented information, clause 9 for monitoring, internal audit and management review records, and clause 10 for nonconformity and corrective action records. An organisation seeking certification should also expect to show an internal audit programme and at least one completed management review before the certification body arrives. The overlap is large. An AI policy, a system inventory, a risk assessment procedure, a human oversight procedure, an incident procedure and a technical documentation template serve both, which is why our [AI governance suite](https://policydrafters.com/services/ai-governance-suite) is drafted against the two together with the EU AI Act and carries a mapping table showing which clause, function and article each document answers. The documents that serve only one are the ISO-specific ones: the statement of applicability, the internal audit programme and the management review record. ## What does it take to keep each one current? The framework changes slowly and informally. NIST updates the Playbook and adds profiles without reissuing the core, though its resource page states that AI RMF 1.0 is being revised as part of the White House AI Action Plan ([NIST AI RMF resource page](https://www.nist.gov/itl/ai-risk-management-framework)). A document set aligned to it therefore needs a review when a relevant profile or the revised framework appears, and otherwise an annual check. The standard changes rarely and formally, and its running cost sits elsewhere: in the certification cycle, the internal audits, the management reviews and the records those produce. A small company documenting against 42001 should expect the management system to need an owner with time set aside each quarter, where the NIST-aligned set needs an owner with time set aside each year. Under the [maintenance plan](https://policydrafters.com/maintenance), $29 to $99 a month, we track whichever you were drafted against and reissue the documents with the changes marked when the text moves. ## How do they map to each other and to the EU AI Act? NIST lists crosswalks submitted by the AI RMF user community in its AI Resource Center, and the one for ISO/IEC 42001 was contributed by Microsoft rather than prepared by NIST ([NIST AI Resource Center, AI RMF crosswalks](https://airc.nist.gov/airmf-resources/crosswalks/)). Read side by side, the mapping runs the way you would expect: Govern to clauses 5 and 7 and to Annex A.2 and A.3; Map to clause 4, clause 8.4 and Annex A.5 and A.6; Measure to clause 9 and Annex A.6 and A.7; Manage to clauses 6.1, 8 and 10. The EU AI Act, for its part, asks providers of high-risk systems for a risk management system under Article 9, data governance under Article 10, technical documentation under Article 11 and Annex IV, record-keeping under Article 12, human oversight under Article 14 and a quality management system under Article 17, and gives deployers their own obligations in Article 26 ([Regulation (EU) 2024/1689, Articles 9 to 17 and 26](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)). Article 17's quality management system reads much like clauses 4 to 10 of 42001, so a company documented against the standard has most of Article 17 in hand. A document set built on the shared core answers most of all three, and the mapping table shows where the gaps are. Table: NIST AI RMF 1.0 and ISO/IEC 42001:2023 side by side | Aspect | NIST AI RMF 1.0 | ISO/IEC 42001:2023 | | --- | --- | --- | | What it is | A voluntary risk management framework from a US agency | An international management system standard | | Published | January 2023, with a Playbook and later profiles | December 2023 | | Structure | Four functions: Govern, Map, Measure, Manage, with categories and subcategories | Clauses 4 to 10 plus Annex A controls under nine objectives | | Who asks for it | US enterprise customers and public bodies | Certification-driven procurement, European buyers, buyers that hold it themselves | | Certifiable | No; alignment is self-declared and evidenced | Yes; accredited certification bodies audit against it | | Documents implied | AI policy, system inventory, risk and incident procedures, mapping table | The same, plus statement of applicability, impact assessment, internal audit and management review records | | Cost to keep current | Annual review; updates when a profile, the Playbook or the 1.0 core is revised | Quarterly management system work; surveillance and recertification audits | | Relation to the EU AI Act | Crosswalked; no presumption of conformity | Closest to Article 17, for which EN 18286:2026 is the standard written | ## So which one should you document against? A small company should document against whichever of the NIST AI RMF and ISO/IEC 42001 its customers name. If they ask for the NIST AI RMF, write the AI policy, the system inventory, the risk procedure and the incident procedure, and put a mapping table at the front that places each one under Govern, Map, Measure and Manage. If they ask for ISO/IEC 42001, use the structure of clauses 4 to 10, add the statement of applicability against Annex A, and decide early whether certification is the goal, because that decision sets the budget for internal audit and management review. If nobody has asked, start with the documents both share, name both frameworks in the mapping table, and let the first questionnaire decide which column you expand. Neither choice locks you in, because the shared core carries over when a later customer names the other one. The one route to avoid is holding two document sets. A company that keeps a NIST-aligned policy for US customers and a separate 42001 policy for European ones has two revision histories, two owners and, within a year, two different rules. One policy with a mapping table serves both readers. ## Where should a small company start? For a [SaaS or technology company](https://policydrafters.com/industries/saas-technology) with a few AI features and its first AI questionnaire, the sequence that works is the inventory first, because every other document refers to it; then the policy, because it assigns the owner; then the risk assessment and human oversight procedures, because those are what the questionnaire actually probes; then the incident procedure. The ISO-specific records come last and only if certification is in view. The security side of the same questionnaire is answered by the [information security policy set](https://policydrafters.com/services/information-security-policies), and the two sets are drafted to share one document ID convention and one revision block. We draft the AI set as the [AI governance suite](https://policydrafters.com/services/ai-governance-suite), quoted at $3,000 to $5,000, reviewed by our legal team before delivery, with the mapping table included so one set of documents can be read against a NIST question, an ISO audit or an Article 26 questionnaire. The classification of each system, provider or deployer, high-risk or not, is yours to make; the suite records the answer and the reasons for it. ## Questions ### Can a company be certified against the NIST AI RMF? No company can be certified against the NIST AI RMF, which is voluntary and has no certification scheme. A company states that it is aligned and shows the mapping and the documents behind the statement. ISO/IEC 42001:2023 is the one with an accredited certification audit. ### Do we need both the NIST AI RMF and ISO 42001 if we sell to the US and the EU? Usually one document set with a mapping table serves both the NIST AI RMF and ISO/IEC 42001. The policy, system inventory, risk assessment procedure, human oversight procedure and incident procedure are common to both frameworks. Only the ISO-specific records, such as the statement of applicability and the internal audit programme, are added when certification is the goal. ### Does the NIST AI RMF or ISO 42001 satisfy the EU AI Act? Neither the NIST AI RMF nor ISO/IEC 42001 satisfies the EU AI Act on its own. The Act sets its own obligations for providers and deployers of high-risk systems, and under Article 40 a presumption of conformity comes only from harmonised standards whose references are published in the Official Journal. The first European standard written for the Act, EN 18286:2026 on the Article 17 quality management system, was published by CEN and CENELEC in July 2026. Documents drafted against the shared core of the two frameworks answer most of what Articles 9 to 17 and 26 ask for, with the gaps marked. ### How long does the AI governance suite take? The AI governance suite takes twenty working days from a complete intake to the first draft. It is drafted against the EU AI Act, the NIST AI RMF 1.0 and ISO/IEC 42001:2023 together, reviewed by our legal team, and carries a mapping table showing which clause, function and article each document answers. --- # A customer sent a security questionnaire: what next? URL: https://policydrafters.com/guides/security-questionnaire-what-to-do Question: A customer sent us a security questionnaire. What do we do next? Published: 2026-11-08. Written by PolicyDrafters. Read the whole questionnaire first, note the deadline and format, check whether it is a standard one such as the CAIQ, and give each section an owner. Then answer every question with the control you run and the evidence you hold. Where the honest answer is no, say so, with a date and a plan. ## What is a security questionnaire, and who sends it? A security questionnaire is a list of questions an enterprise customer sends a supplier before it lets the supplier's product or service near its systems or data. It arrives during procurement, usually after the commercial conversation has gone well, and it asks how you protect information: who can reach what, how staff use devices, how incidents and outages are handled, which vendors hold the data, and which documents set the rules. Three teams on the customer's side may send it. Procurement sends it because the buying process will not close without it. A vendor risk or third-party risk team sends it because its job is to assess every supplier before a contract is signed and to keep assessing them afterwards. The customer's security team sends it, or reads your answers, because it has to decide whether your controls are good enough for the data you will hold. In practice the questionnaire often comes from procurement and is read by security, and knowing which team will read it tells you how technical the answers need to be. The customer is not being difficult. Its own frameworks ask it to do this. The NIST Cybersecurity Framework 2.0 calls for planning and due diligence before entering supplier relationships, and for supplier risks to be understood, assessed and monitored over the course of the relationship ([NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29, GV.SC-06 and GV.SC-07](https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf)). Where the customer is a GDPR controller and you will process personal data for it, Article 28(1) requires it to use only processors that give it sufficient assurance that they will implement appropriate technical and organisational measures. Article 28(3)(h) requires the contract to oblige the processor to make available the information needed to demonstrate compliance with that Article and to allow for and contribute to audits ([Regulation (EU) 2016/679, Article 28(1) and 28(3)(h)](https://eur-lex.europa.eu/eli/reg/2016/679/oj#art_28)). The questionnaire is how many customers do that work, which is also why a second one tends to arrive a year later. ## What should we do in the first day? Read the whole questionnaire before answering any of it. The questions that look simple near the top often depend on answers further down, and a section on incident notification or data location may raise a contract point that needs more time than the rest put together. Note the deadline and the format. The deadline is the customer's, and if it cannot be met honestly, ask for more time now rather than on the due date; asking early gives the customer time to adjust its own plan. The format matters as much: a spreadsheet, a vendor risk portal, a form inside the customer's procurement system or a list of documents to upload each changes how the work is shared and how long answers can be. Find out whether it is a standard questionnaire or the customer's own. Some customers send an industry questionnaire, such as the Cloud Security Alliance's CAIQ. The CAIQ is a set of yes or no questions in which a cloud provider documents which security controls exist, framed against the Cloud Controls Matrix ([Cloud Security Alliance, STAR Level 1 security questionnaire (CAIQ v4.1)](https://cloudsecurityalliance.org/artifacts/star-level-1-security-questionnaire-caiq-v4)). A standard questionnaire is worth recognising because the work carries over: the next customer may send the same one, and the answers you write now, kept current, become your starting point. Then name an owner for each area. Access and identity usually sit with engineering or IT, devices and staff rules with operations or people, incidents and continuity with whoever is on call, vendors with finance or operations, and privacy with whoever answers for personal data. One person coordinates and submits; each owner answers for their area and finds the evidence. Without an owner per section the questionnaire stalls on the first question nobody feels able to answer. ## How do we answer honestly? Every answer describes the control you actually run and the evidence you actually hold. That is the whole method, and it is the part that matters more than any wording. If access is removed when someone leaves, say how, by whom and how quickly it usually happens, and keep the record that shows it. If backups are taken daily and a restore was last tested in a given month, say that. If multi-factor authentication covers some systems and not others, name which. An answer that describes what you plan to do as though you already do it, or that is borrowed from another company's questionnaire or a template, is an answer that is not true of your company. The customer may ask for the evidence behind an answer, or audit you later under a right in the contract. The completed questionnaire is often attached to or referred to in the contract. And after an incident, a customer rereads what you told it. A precise answer about a modest control holds up in all three; a broad answer about a control you do not run holds up in none. Short, specific answers with the owner, the frequency and the record named are also quicker for a reviewer to accept than long ones that restate the question. ## What if the honest answer is "we do not have that"? Say so, and say what happens next. The useful form is what you do today, what you will put in place, who owns it, and the date it will be in place. "We do not yet run formal access reviews. Our head of engineering will run the first quarterly review by the end of next quarter, recorded in our ticketing system" is an answer a reviewer can work with. A documented gap with a plan is a normal answer. A gap with an owner and a date gives a reviewer something to track. Some will write the plan into the contract, which is another reason to choose a date you will meet. What a reviewer cannot work with is a yes that turns into a no when someone asks to see the record. Some questions do not apply to you, such as questions about physical data centres when you run entirely on a cloud provider. Answer those as not applicable and give the reason in a sentence, naming where the control sits instead. ## What is the difference between a policy and the evidence of it? A policy says the rule. Evidence shows the rule was followed. Questionnaires ask for both, sometimes in the same question: "do you have an access control policy" asks for the document, and "how often are user access rights reviewed" asks for the practice, which a reviewer may then ask you to show. Assessors think about evidence in a structured way. NIST's guide to assessing security and privacy controls describes three methods: examining documents, mechanisms or activities, interviewing the people involved, and testing whether a control behaves as it should ([NIST SP 800-53A Rev. 5, section 2.4.2, assessment methods](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53Ar5.pdf)). A policy is one thing an assessor examines. The records of operation are examined too, and the interview and test methods go further: they ask the people who run a control, and they check the control itself. Table: What a policy says and what shows it was followed | Area | The policy says | The evidence shows | | --- | --- | --- | | Access control | Who grants access, how it is approved and how quickly it is removed at offboarding | An access review signed off, an offboarding ticket closed, a screenshot of the identity provider's settings | | Acceptable use | What staff may do with devices and customer data | Signed acknowledgements from current staff | | Incident response | Who declares an incident, who is told and by when | An incident log, a post-incident review, a record of a tabletop exercise | | Business continuity and backup | What is backed up, how often and the recovery targets | Backup job reports and the log of the last restore test | | Vendor and third-party | How suppliers are assessed before and during the relationship | A vendor register with assessment dates and the contracts on file | The practical point is that each policy should name the record that proves it, so that the person answering knows where to look. A policy that names its record turns the question "can you show us" into a link to a folder. ## Which documents does the questionnaire usually ask to see first? Many questionnaires ask first for an information security policy, an access control policy, an incident response procedure, a business continuity and backup policy, a vendor and third-party policy, an acceptable use policy and a privacy notice. Customers ask for them because they are the documents the rest of the questionnaire's answers point back to. The guide to [the policies a SaaS startup needs first](https://policydrafters.com/guides/policies-saas-startup-needs) sets out each one, what it contains and which standards it maps to. The [information security policy set](https://policydrafters.com/services/information-security-policies) lists the six security documents and the controls each answers. The privacy notice is a public document and usually already exists; if not, it comes from the [privacy policy pack](https://policydrafters.com/services/privacy-policy-pack). If you already hold policies, check them before you send them. A policy that names a role you no longer have, a tool you stopped using or a step nobody takes undermines the answers it sits beside. A [policy review and update](https://policydrafters.com/services/policy-review-and-update) reads existing documents against the current text of the rules they name and returns them with the changes marked, a document ID and a revision block. ## What do we send, and in what order? Send the answers first, in the customer's format, with every question answered and every gap dated. Then send the documents the questionnaire asked for, named the way the questionnaire names them, so the reviewer can match each document to its question without asking. Send only what was asked for at this stage; evidence of operation, such as an access review or a restore test log, usually follows when the reviewer asks for it, and is often shared on a call or through a portal rather than by email, because it can contain internal detail. Mark documents as confidential, check that the versions you send carry a date, an owner and an approval, and keep a copy of exactly what was sent and when. Keep the final answers in one place you can find again: the next questionnaire will ask most of the same questions, and answers kept current are much quicker to reuse than answers rebuilt. ## How long does this usually take, and what slows it? The time a questionnaire takes depends less on its length than on whether the answers already exist. When the policies are written and the records are kept, answering is mostly a matter of finding and pasting. When they are not, the questionnaire becomes the project that writes them, and the deadline it carries is set by the customer's procurement calendar rather than by the work. Four things slow it most. There is no owner, so questions sit unanswered. Evidence has to be found, because nobody knew which record proved which control. Answers are written aspirationally and then rewritten when someone checks them against practice, which costs twice. And the documents the customer asked for do not exist, or exist only as templates that no longer match what the company does. The first two can be dealt with early, by naming owners and agreeing where records live. The last two take longer, and the honest move is to tell the customer the date the documents will be ready rather than send something that is not true. ## Where does PolicyDrafters fit? PolicyDrafters drafts the [information security policy set](https://policydrafters.com/services/information-security-policies): six documents drafted against ISO/IEC 27001:2022 Annex A and the security criteria of the AICPA Trust Services Criteria used in SOC 2 reports, reviewed by our legal team and delivered in Word and PDF. When you name the questionnaire in the intake and send it once we reply, the set is drafted so that each question in it has a clause to point at, and the control table in each document lists the questions that document answers. The first draft takes twelve working days from a complete intake, and the set is $1,200 to $2,500, fixed before we start. The set is the policy layer. It does not supply the evidence that the controls operate, which is your access reviews, logs, tickets and test records, and it does not write the questionnaire answers. If the questionnaire's deadline is sooner than the set can be ready, answer it honestly now, with each missing document listed as a gap and its date, and send the documents when they arrive. For a [SaaS company](https://policydrafters.com/industries/saas-technology), answers written truthfully the first time are the starting point for the second questionnaire. ## Questions ### Can we copy answers from another company's questionnaire or a template? Borrowed answers describe someone else's controls, so they are only usable where they happen to be true of yours. A questionnaire answer is a statement about your company, and the customer may ask for the evidence behind it, attach it to the contract or test it later. Use a template to understand what a question is asking, then write the answer from what you run. ### Is it acceptable to answer no on a security questionnaire? A no is an acceptable answer when it is true and comes with a plan. Write what you do today, what you will put in place, who owns it and the date it will be done. Many vendor review processes have a place to record a gap and its remediation date; what a reviewer cannot work with is an answer that turns out not to match practice. ### Do we need a SOC 2 report before we can answer a security questionnaire? A SOC 2 report is not needed to answer a security questionnaire. The questionnaire is answered from your policies and the records that show they are followed. Some customers ask whether a report or certificate exists or is planned, and the honest answer, with a date if one is set, is the right one. ### Will PolicyDrafters fill in the questionnaire for us? PolicyDrafters drafts the information security policy set, not the questionnaire answers. When you name the questionnaire in the intake and send it once we reply, the set is drafted so that each question has a clause to point at, with a control table listing the questions each document answers. The evidence of operation stays with you, and we do not write the questionnaire answers; they describe your controls and come from you. --- # Who can write or review your SaaS security policies URL: https://policydrafters.com/guides/who-writes-saas-security-policies Question: Who can help write or review our SaaS security policies? Published: 2026-11-08. Written by PolicyDrafters. The person who runs a control should own its policy, whoever writes it. A template, an AI draft, a consultant, a virtual CISO, a compliance platform or a drafting firm can produce the text, and a law practice answers questions about your legal position. Choose by who will read the documents against practice and who will keep them current. ## Who should own the policies, whoever writes them? The first enterprise security questionnaire usually arrives on the desk of whoever is nearest: a founder, an operations lead, or the first engineer with security in their title. It asks for the information security policy and a set of topic policies, and the question that follows is who should write them. Before choosing a writer, it helps to separate writing from owning, because the routes below differ in who writes and hardly at all in who owns. The top document is the information security policy, and it commits the company as a whole, so as a matter of good practice it is approved by the most senior people in the company; in a startup that usually means the chief executive or the founders. What a customer typically expects is practical: a policy that names who approved it and when, and that matches what the reviewer later finds when they ask for evidence. Good practice goes one step further. The person who runs a control should own the procedure that describes it, because they are the one who will be asked whether it is true. The engineering lead who grants and removes access should own the access control policy; whoever carries the pager should own the incident response procedure. A writer from any of the routes below can produce excellent text, but only an owner inside the company can keep it honest. ## Can we write them in house? Writing in house has the best fit and highest cost in time. The people who run the systems know the facts, so the first draft describes real practice, not an assumed one. But they are usually building the product, and policy writing is a skill of its own: stating a control so a reader can test it, naming the record that proves it, and keeping six documents from contradicting each other. An in-house draft is most likely to stall at the incident response procedure, because the steps, roles and notification times all have to be decided rather than described. In house works best when one person holds the pen across the set, the control owners each review their part, and someone outside the writing reads it once before it goes to a customer. ## Is a template or a policy pack enough? A downloaded template or a policy pack from a vendor gives you structure and wording on the day you buy it. The trade, set out in our guide to [templates and drafted policies](https://policydrafters.com/guides/policy-template-vs-drafted), is that the work of making each sentence true stays with you. A template names controls the vendor assumed you run, and it is current as of the day it was written. If you edit it honestly with the control owners in the room, it can serve a small team well. Adopted unread, it becomes a document a reviewer can compare to practice and find wanting. ## Can an AI tool draft them? An AI-assisted draft is useful for structure and a first pass. It can propose a table of contents, explain what a control is for and turn rough notes into readable sentences in minutes. The real risk is that it writes with confidence about controls you do not run, such as a quarterly access review nobody performs, and that it cites rules, editions or control numbers that have since been replaced. A draft built on older material reads as current until someone checks each reference against the text in force today. An AI draft therefore needs the same honest edit as a template, by the same control owners, and the same outside read before a customer sees it. It shortens the writing; it does not shorten the checking. ## What does a freelance writer or consultant add? A freelance writer or an independent security consultant brings experience of what reviewers ask and how other companies have answered. A good one interviews your control owners and writes from what they say, which solves the in-house time problem without losing the facts. What varies is scope and continuity: the engagement ends when the documents are delivered, the price is often set by the hour, and the documents depend on that person's knowledge of the current rules. Ask who reviews the work, what is included if the first draft is wrong, and who will update the set when a rule moves. ## Where do a virtual CISO or a compliance platform fit? A virtual CISO is a part-time security leader who sets the programme, decides which controls to run and often writes or commissions the policies as part of it. That is the right route when the company needs security leadership, not only documents, and the policies are one output of a wider piece of work. A compliance automation platform generates policies alongside monitoring of your systems, usually as part of a SOC 2 or ISO 27001 programme. The policies arrive quickly and are tied to the controls the platform tracks, which is a real advantage when you are already running that programme. They start from the platform's own library, so they need the same edit for your facts, and they tend to sit inside the subscription, which matters if you later change tools. Both routes suit a company whose questionnaire is the start of a formal audit rather than a one-off request. ## When do you need a law practice? A law practice is the route when the question is the organisation's legal position: how a particular rule applies to you, what a customer contract commits you to, or what a regulatory filing should say. A law practice gives advice on those questions, which no drafting route does. Most security policies, though, describe operational controls rather than legal positions: an acceptable use or backup policy sets out how the company works, not how a rule applies to it. Where a contract sets security obligations, the policies are drafted to match what the contract says; reading the contract itself is a question for a law practice. ## What does a fixed-price drafting firm do? A fixed-price drafting firm such as PolicyDrafters writes the documents from an intake against a named rule, at a price quoted before work starts. Our [information security policy set](https://policydrafters.com/services/information-security-policies) is six documents: an information security policy, an access control policy, an acceptable use policy, an incident response procedure, a business continuity and backup policy, and a vendor and third-party policy. They are drafted against ISO/IEC 27001:2022 Annex A and the security criteria of the AICPA Trust Services Criteria used in SOC 2 reports, and against your customer's questionnaire when you send it. The intake asks how access is granted and removed, how incidents are reported, how backups are taken and tested and which vendors hold your data. Where you have no practice yet, it offers the common options and you pick one you will follow. Our legal team reviews each document before it reaches you, you mark what you want changed, and we revise once. The first draft arrives twelve working days from a complete intake. The final set comes in Word and PDF with a document ID on every page, for $1,200 to $2,500. Under the [maintenance plan](https://policydrafters.com/maintenance), when Annex A or the Trust Services Criteria move, a revised set arrives with the changes marked. If you already hold policies from another route, a [policy review and update](https://policydrafters.com/services/policy-review-and-update) reads each one against the current text of the rules it names for $350 to $500 per document. What stays with you is ownership, the decision to adopt, running the controls, the evidence that they operate and your answers to any questionnaire. More on the sector sits on the [SaaS and technology](https://policydrafters.com/industries/saas-technology) page. ## How do the routes compare? Table: What each route gives you and what stays with you | Route | What it gives you | What stays with you | | --- | --- | --- | | In house | Documents written by the people who know the facts | The writing time, the consistency across the set and an outside read | | Template or policy pack | Structure and wording today, at a low price | Making each sentence true, and noticing when the rule changes | | AI-assisted draft | A fast first pass and a usable structure | Removing controls you do not run, checking every citation, and a reviewer | | Freelance writer or consultant | Experience of what reviewers ask, written from interviews | Checking scope and review, and finding someone to update the set later | | Virtual CISO | Security leadership, with policies as one output | Running the programme the role sets, and the cost of the engagement | | Compliance platform | Policies tied to monitoring inside a SOC 2 or ISO 27001 programme | Editing the library text for your facts, and the documents if you change tools | | Law practice | Advice on your legal position, contracts and filings | The operational policies, which are usually outside a legal engagement | | Fixed-price drafting firm | Six documents from an intake, reviewed by our legal team, one revision, Word and PDF; kept current if you add the maintenance plan | Ownership, adoption, and running the controls the documents describe | ## Which route fits your company? Three questions settle most cases. The first is who will read the documents and compare them to practice. If the answer is your own staff, a template edited honestly or an in-house draft is often enough. If it is an enterprise customer's security team, a SOC 2 auditor or an ISO 27001 certification body, the documents need to state controls you can show, in the order the reader expects. The second is how many rules and jurisdictions apply. One customer questionnaire built on one framework is a narrow brief. A company answering ISO/IEC 27001, SOC 2 and a privacy law in two regions has documents that must reconcile those rules, and that reconciling is the drafting. The third is whether anyone will keep the set current. Policies are approved once and read for years. If nobody inside the company will watch the rules and the practice and revise the documents when either moves, choose a route that includes that work, or name the person who will do it before you start. Many companies combine routes: a virtual CISO or the first security hire sets the programme, a drafting firm writes the set, and the control owners each own their part. ## What none of these routes does None of these routes, PolicyDrafters included, establishes security on its own, passes an audit or earns a certification. A policy describes a control; the organisation has to run it. An auditor or a customer typically reads the policy first and then asks for the record that shows the control operating, such as the last access review or the notes from the last incident. The best-written policy set is worth what the practice behind it is worth, which is why the owner matters more than the writer. ## Questions ### Can we draft our security policies with an AI tool and have them reviewed? Yes. An AI draft can be sent for a policy review and update like any policy someone else wrote. Each document is read against the current text of the rules it names, returned with the changes tracked and a change note saying what moved and why, and reviewed by our legal team. A review is $350 to $500 per document, fixed before we start. ### Will a set of security policies get us a SOC 2 report or an ISO 27001 certificate? No set of policies earns a SOC 2 report or an ISO/IEC 27001 certificate on its own, whoever writes it. The set is the written policy layer an auditor asks to see, structured the way auditors expect to read it. Whether the controls it describes are in place and operating is your operation, not the document. ### Who in a SaaS company should sign off the information security policy? As a matter of good practice, the information security policy at the top of the set is approved by the most senior people in the company, because it commits the company as a whole; in a startup that usually means the chief executive or the founders. The topic policies beneath it are best owned by the people who run each control, such as the engineering lead for access control and the on-call lead for incident response. ### Do we need a lawyer to write our security policies? Most security policies describe operational controls, such as access, devices, backups and incidents, rather than a legal position. A law practice answers the questions that are about your organisation's legal position: how a rule applies to you, what a contract commits you to, or what a regulatory filing should say. --- # Privacy notice vs cookie consent: what each does URL: https://policydrafters.com/guides/privacy-notice-vs-cookie-consent Question: What is the difference between a privacy notice and a cookie consent setup? Published: 2026-11-08. Written by PolicyDrafters. A privacy notice tells people what personal data you collect, why, who receives it and what rights they have. A cookie consent setup asks before non-essential cookies or trackers run, as ePrivacy Article 5(3) requires in the EU, and records the answer. The notice is a document; consent is a working mechanism; each fails without the other. ## Why do people confuse a privacy notice with cookie consent? A customer's procurement team asks for your privacy policy, an advertising platform asks whether you obtain consent for its pixel, or the agency rebuilding your website asks what should go in the cookie banner. Each names a different piece of the same area, and answering one can look like settling all of them. There are three different things here: - The privacy notice: a document that tells people what personal data you collect, why, who receives it, how long you keep it and what rights they have. - The cookie notice and the consent it supports: the text that lists the cookies and trackers your site sets, by category, with the rule that some may only run after the visitor agrees. - The consent tool and the work of running it: the banner, the code that holds back scripts until consent is given, the record of each choice, and a tag inventory kept current. The first two are documents. The third is software and operation, and it is the part most often assumed to come with the documents. ## What is a privacy notice, and which laws require one? A privacy notice is the public statement of how an organisation handles personal data. Under the GDPR, Article 13 sets out what a controller gives the person at the time the data is obtained from them. That includes the purposes and legal basis of the processing, the recipients, the retention period and, where the processing relies on consent, the right to withdraw it. Article 14 covers data obtained from someone else. Article 12(1) asks for the information in a concise, transparent, intelligible and easily accessible form ([Regulation (EU) 2016/679 (GDPR), Articles 4(11), 7, 12 to 14 and 94(2), and recital 32](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). In California, section 1798.100(a) of the Civil Code requires a business that controls the collection of personal information to tell consumers certain things at or before the point of collection. These are the categories collected, the purposes, whether that information is sold or shared, and how long each category is kept ([California Consumer Privacy Act, Civil Code sections 1798.100(a), 1798.120, 1798.135 and 1798.140, as posted by the California Privacy Protection Agency](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). The regulations turn that into a notice at collection with a fixed list of contents in section 7012(e). The list includes a link to the notice of right to opt out where the business sells or shares, and a link to the privacy policy ([CCPA regulations, 11 CCR sections 7012, 7025 and 7026 (effective 1 January 2026)](https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf)). In Nigeria, section 27(1) of the Nigeria Data Protection Act 2023 lists what a controller tells the data subject before collecting personal data. Section 27(3) requires that information to be contained in a privacy policy ([Nigeria Data Protection Act 2023, sections 26 and 27](https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf)). Our [guide to what each regime requires in a notice](https://policydrafters.com/guides/gdpr-ccpa-ndpr-privacy-notice-requirements) takes the three lists line by line. None of those provisions asks the visitor to agree to anything. A privacy notice informs; reading it is not consent to the cookies a site sets. ## What does the cookie rule require that a privacy notice does not? In the EU the cookie rule comes from a different instrument: Article 5(3) of the ePrivacy Directive 2002/58/EC, as replaced by Directive 2009/136/EC. It requires Member States to ensure that storing information, or gaining access to information already stored, in a user's terminal equipment is only allowed once the user has given consent. Consent must be given after the user has been given clear and comprehensive information about the purposes ([Directive 2009/136/EC, Article 2(5), replacing Article 5(3) of Directive 2002/58/EC](https://eur-lex.europa.eu/eli/dir/2009/136/oj)). The same paragraph exempts two cases: technical storage or access for the sole purpose of carrying out the transmission of a communication, and storage or access strictly necessary for a service the user has explicitly requested ([Directive 2009/136/EC, Article 2(5), replacing Article 5(3) of Directive 2002/58/EC](https://eur-lex.europa.eu/eli/dir/2009/136/oj)). Because it is a directive, it reaches a business through the law each Member State passes to implement it. The rule is not limited to cookies. The European Data Protection Board's guidelines on the technical scope of Article 5(3), adopted on 7 October 2024, conclude that tracking pixels and tracking links fall within it, because distributing them to the user's device is storage and collecting the identifier they carry is gaining access ([EDPB, Guidelines 2/2023 on the technical scope of Art. 5(3) of the ePrivacy Directive, version 2.0, paragraphs 47 to 51](https://www.edpb.europa.eu/system/files/documents/2024-10/edpb_guidelines_202302_technical_scope_art_53_eprivacydirective_v2_en_0.pdf)). The consent Article 5(3) asks for is GDPR consent. The directive refers to Directive 95/46/EC, and Article 94(2) of the GDPR reads references to that repealed directive as references to the GDPR. Article 4(11) defines consent as freely given, specific, informed and unambiguous, given by a statement or a clear affirmative action. Article 7 adds that the controller must be able to demonstrate it, that a consent request is clearly distinguishable from other matters, and that withdrawing consent is as easy as giving it ([Regulation (EU) 2016/679 (GDPR), Articles 4(11), 7 and 94(2), and recital 32](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). Recital 32 says silence, pre-ticked boxes or inactivity do not constitute consent. The Board's consent guidelines draw two practical conclusions: - Scrolling or swiping through a page does not satisfy the requirement of a clear affirmative action ([EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1, paragraphs 39 and 86](https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_202005_consent_en.pdf)). - Access to a service may not be made conditional on accepting cookies, the practice known as a cookie wall ([EDPB, Guidelines 05/2020 on consent under Regulation 2016/679, version 1.1, paragraphs 39 and 86](https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_202005_consent_en.pdf)). That is the gap. A privacy notice meets an information duty. The cookie rule adds a permission duty: before a non-essential cookie or tracker runs, the visitor has said yes, on terms that meet the consent standard, and can later say no as easily. ## How does California treat cookies? The CCPA does not ask for consent before cookies are set. It reaches them through its definitions: personal information includes unique personal identifiers and online identifiers, and a unique identifier expressly includes cookies, beacons, pixel tags and mobile ad identifiers. Sharing means making personal information available to a third party for cross-context behavioural advertising, whether or not money changes hands ([California Consumer Privacy Act, Civil Code section 1798.140(k), (v), (ad), (ah) and (aj)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). A third-party advertising cookie is therefore usually a question of sale or sharing. The consumer's tool is the right to opt out under section 1798.120(a). A business that sells or shares provides a clear and conspicuous link titled "Do Not Sell or Share My Personal Information" under section 1798.135(a)(1), or relies on an opt-out preference signal under section 1798.135(b) ([California Consumer Privacy Act, Civil Code sections 1798.120 and 1798.135](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). The regulations go further. Section 7025(b) requires a business that sells or shares to process a qualifying opt-out preference signal as a valid opt-out request. Section 7026(a)(4) says a cookie banner or cookie controls is not by itself an acceptable method for opting out of sale or sharing ([CCPA regulations, 11 CCR sections 7025 and 7026 (effective 1 January 2026)](https://cppa.ca.gov/regulations/pdf/ccpa_statute_eff_20260101.pdf)). The California Privacy Protection Agency names the Global Privacy Control as an example of such a signal ([California Privacy Protection Agency, frequently asked questions](https://cppa.ca.gov/faq.html)). So a business that both regimes reach runs two logics at once: opt-in before non-essential tags where the ePrivacy rule applies, and, where it is a business under Civil Code section 1798.140(d) that sells or shares, an opt-out that honours the browser signal ([California Consumer Privacy Act, Civil Code section 1798.140(d)](https://cppa.ca.gov/regulations/pdf/cppa_act.pdf)). The definition turns on thresholds such as annual gross revenue, so not every site with Californian visitors meets it. One banner can carry both logics, but only if it is configured for both. ## What does Nigeria add? Nigeria's rule on cookies sits in the Commission's General Application and Implementation Directive 2025. Article 19 sets these rules: - The use of cookies on a website requires consent that is freely given, informed and specific. - Necessary cookies that enable core functionality, such as security, network stability management and accessibility, are exempt. - Every other cookie must be offered as a specific yes or no choice. - It asks for a conspicuous banner that the visitor does not have to scroll to find. - It asks for the cookie information to identify the organisation responsible and explain how consent is withdrawn. - Article 19(8) applies the same rules to tracking tools that work like cookies ([NDPC, General Application and Implementation Directive 2025, Articles 7(l) and 19](https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf)). Article 7(l) expects privacy and cookie notices on the website's homepage ([NDPC, General Application and Implementation Directive 2025, Articles 7(l) and 19](https://ndpc.gov.ng/wp-content/uploads/2025/07/NDP-ACT-GAID-2025-MARCH-20TH.pdf)). The Act's own consent rules point the same way. Section 26(3) says silence or inactivity is not consent, and section 26(7) requires consent to be affirmative and not based on a pre-selected confirmation ([Nigeria Data Protection Act 2023, section 26(3) and (7)](https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf)). ## What does running a consent tool involve? A consent tool, whether a commercial platform or code your developer writes, presents the banner, offers the categories, and holds back every script in a non-essential category until the visitor accepts it. It stores the choice, offers a way back in so consent can be withdrawn, and keeps a record of what was agreed. The law sets the outcome rather than the method. Article 7(1) of the GDPR requires the controller to be able to demonstrate consent, and Article 5(3) of the ePrivacy Directive requires that nothing non-essential is stored or read before it is given ([Regulation (EU) 2016/679 (GDPR), Article 7(1)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)) ([Directive 2009/136/EC, Article 2(5), replacing Article 5(3) of Directive 2002/58/EC](https://eur-lex.europa.eu/eli/dir/2009/136/oj)). How the record is kept, with a timestamp, the version of the notice shown and the categories accepted, is good practice that makes the demonstration possible. A customer's privacy reviewer may ask to see that record, and evidence that tags do not fire before consent. The tool also has to keep step with the site: a new pixel or a chat widget that sets its own cookies reaches neither the banner nor the cookie notice unless someone updates them. ## How does each fail without the other? A privacy notice with no working consent mechanism fails the permission duty. The notice may describe every cookie accurately, but if the advertising tags load as the page opens, the storage happens before any consent. Article 5(3) asks for consent before the storage, so an accurate description does not meet it on its own. A banner whose categories block nothing fails the same way. A working banner with a notice that lists the wrong cookies fails the information duty. Article 4(11) asks for informed consent, and a category described as analytics that loads an advertising pixel does not inform the visitor of what runs. The same mismatch breaks a California notice at collection, which has to say whether each category of personal information is sold or shared. Table: What a privacy notice and a cookie consent setup each do | Aspect | Privacy notice | Cookie notice and consent setup | | --- | --- | --- | | What it is | A document describing what personal data is collected, why, who receives it and the rights people have | A cookie notice listing cookies and trackers by category, plus a tool that asks before non-essential ones run | | The duty it meets | Information: GDPR Articles 13 and 14, Civil Code section 1798.100, Nigeria Data Protection Act section 27 | Permission: ePrivacy Article 5(3) with the GDPR consent standard; the CCPA opt-out of sale or sharing; GAID Article 19 in Nigeria | | Does the visitor act | No; it informs | Yes; the visitor accepts, refuses or later withdraws, or sends an opt-out signal | | Who produces it | A drafter, from the facts about your processing | A drafter for the cookie notice and categories; you or your developer for the tool | | How it fails | Wrong or missing facts about collection, sharing or retention | Tags that fire before consent, no real refusal, or categories that do not match what loads | | When it changes | When your processing or the rule changes | Whenever a tag, vendor or site feature is added or removed | ## What does a website actually need to do? Start with an inventory. List every cookie, pixel, tag and script the site loads, including those from a tag manager or embedded services, with who sets each, what it does and how long it lasts. Then decide the categories. Strictly necessary covers only what the service the visitor asked for needs; analytics, preferences and advertising sit in separate categories so each can be accepted or refused, which keeps consent specific. For California, mark which tags make personal information available to a third party in a way that counts as a sale or a share. Write the privacy notice and the cookie notice from the same facts, so the banner, the cookie notice and the sharing section match. Then configure the tool or the code, and test three things: - Nothing in a non-essential category fires before consent. - Withdrawing consent is as easy as giving it, as GDPR Article 7(3) requires ([Regulation (EU) 2016/679 (GDPR), Article 7(3)](https://eur-lex.europa.eu/eli/reg/2016/679/oj)). - An opt-out preference signal is honoured where the CCPA applies. Checking that refusing takes no more effort than accepting, and testing the whole setup, are good practice: they are how you know the required outcomes have been reached. Finally, keep the consent records and re-run the inventory whenever the site changes. ## What does PolicyDrafters draft, and what does it leave to you? The [privacy policy pack](https://policydrafters.com/services/privacy-policy-pack) delivers the external privacy notice, the cookie notice, the internal data protection policy, the data subject request procedure and the records of processing template, quoted at $1,200 to $2,500. The cookie notice is the text and the cookie categories, written to sit inside a consent banner that you or your developer configure. PolicyDrafters does not supply or configure the banner software. The intake asks which cookies and trackers your site sets, so the notice describes the inventory you bring, and our legal team reviews the draft before it reaches you. A [SaaS or technology company](https://policydrafters.com/industries/saas-technology) with visitors in Europe and California is the usual buyer, and the pack is drafted against each regime that applies to it. A [healthcare organisation](https://policydrafters.com/industries/healthcare-administration) buys the same pack for the administrative side of its privacy notices, for patients and the regulator; clinical procedures and clinical SOPs are out of scope. Under the [maintenance plan](https://policydrafters.com/maintenance) the pack is reissued with the changes marked when a regime it was drafted against changes. A new tag changes your facts rather than the rule, so keeping the inventory current, and the banner matched to it, stays with you and your developer. ## Questions ### Does a website that only uses analytics need a cookie banner? Under the EU rule, Article 5(3) of the ePrivacy Directive requires consent before an analytics cookie is set unless the cookie is strictly necessary for a service the visitor explicitly requested, which is the only exemption besides transmitting a communication. Nigeria's General Application and Implementation Directive 2025 likewise limits its exemption to necessary cookies that enable core functionality such as security and network stability, and only where those cookies do not process sensitive data, financial data or data the visitor stores privately (Article 19(5) and (6)). In California the question is different: the CCPA asks whether the analytics provider receives personal information in a way that counts as a sale or a share, and if it does, the visitor can opt out. ### Is the cookie notice part of the privacy notice? The cookie notice can be a section of the privacy notice or a separate page linked from it and from the consent banner. What matters is that it lists the cookies and trackers the site actually sets, by category and purpose, and says how consent is given and withdrawn. The PolicyDrafters privacy policy pack delivers it as its own document so that the banner can quote its categories directly. ### Does PolicyDrafters set up the cookie banner? No. The privacy policy pack delivers the cookie notice, meaning the text and the cookie categories, written to sit inside a consent banner that you or your developer configure. PolicyDrafters does not supply or configure the banner software, and does not test whether scripts are blocked before consent. ### Does a cookie banner satisfy the CCPA's Do Not Sell or Share requirement? Not by itself. Section 7026(a)(4) of the CCPA regulations says a cookie banner or cookie controls is not by itself an acceptable method for submitting requests to opt out of sale or sharing, because cookies concern the collection of personal information rather than its sale or sharing. A business that sells or shares personal information also processes opt-out preference signals and offers a method that addresses sale and sharing directly. --- # When does a business need an employee handbook? URL: https://policydrafters.com/guides/when-does-a-business-need-an-employee-handbook Question: When does a growing business need an employee handbook? Published: 2026-11-08. Written by PolicyDrafters. No federal law in the US requires an employee handbook. A growing business needs one when staff questions get different answers: at the first manager who is not a founder, the first hire in another state or country, the first leave request or disciplinary matter, or when an investor, insurer or customer asks to see the policies. ## Does the law require an employee handbook? In the United States, no federal law requires a private employer to have an employee handbook. That surprises founders who assume the handbook is the document an employer must have, and it shapes the honest answer to the question this guide asks. The need for a handbook is practical, not statutory, and it arrives at a point in a company's growth rather than on a date. Federal law does require some things in writing, and it helps to keep them separate from the handbook. Several statutes enforced by the Department of Labor require posters or notices in the workplace. Not every employer is covered by every statute. The Department's Poster Advisor exists to tell an employer which ones apply ([US Department of Labor, Wage and Hour Division, Workplace posters](https://www.dol.gov/agencies/whd/posters)). The Family and Medical Leave Act covers a private employer with 50 or more employees for each working day during 20 or more calendar workweeks in the current or preceding calendar year ([29 CFR 825.104(a)](https://www.govinfo.gov/content/pkg/CFR-2025-title29-vol3/xml/CFR-2025-title29-vol3-sec825-104.xml)). The FMLA also asks a covered employer for written notices ([29 CFR 825.300(a), (b) and (c)](https://www.govinfo.gov/content/pkg/CFR-2025-title29-vol3/xml/CFR-2025-title29-vol3-sec825-300.xml)): - It must post the FMLA general notice. - Once it has eligible employees, it must also give that notice to each employee. It does so by including it in the employee handbook or other written guidance on benefits or leave, if such materials exist, or by handing a copy to each new hire. - When an employee asks for FMLA leave, or the employer learns that leave may be for an FMLA-qualifying reason, it has five business days, absent extenuating circumstances, to say whether the employee is eligible. Each time it gives that eligibility notice, it must give a written notice of the employee's rights and responsibilities. So the law does not ask for a handbook. But if you have one and the FMLA covers you, the handbook is where the general notice is expected to sit. Headcount also brings federal anti-discrimination law into play. The Equal Employment Opportunity Commission states that a private employer is covered by Title VII and the Americans with Disabilities Act once it has 15 or more employees, and by the Age Discrimination in Employment Act at 20 or more, counted over at least twenty calendar weeks in this year or last, while virtually every employer is covered by the Equal Pay Act ([EEOC, Coverage of business and private employers](https://www.eeoc.gov/coverage-businessprivate-employers)). None of these laws tells an employer to write a handbook. They are the rules a handbook's conduct, complaints and leave sections are written against, which is why companies approaching these numbers often find the handbook question on the table at the same time. The United Kingdom asks for more in writing. Section 1 of the Employment Rights Act 1996 requires an employer to give every worker who begins employment a written statement of particulars, generally in a single document, no later than the beginning of the employment ([Employment Rights Act 1996, section 1](https://www.legislation.gov.uk/ukpga/1996/18/section/1)). Section 3 requires that statement to include, among other things ([Employment Rights Act 1996, section 3](https://www.legislation.gov.uk/ukpga/1996/18/section/3)): - A note of the disciplinary rules and the disciplinary and dismissal procedure. The employer may give this note by referring the worker to a reasonably accessible document. - The identity, by description or otherwise, of the person the worker can apply to with a grievance, and how to apply. The Acas Code of Practice on disciplinary and grievance procedures has been in force since 11 March 2015. It asks for those rules and procedures to be set down in writing and to be specific and clear. Employment tribunals take the Code into account and can adjust awards by up to 25 per cent for an unreasonable failure to follow it ([Acas Code of Practice on disciplinary and grievance procedures (2015)](https://www.acas.org.uk/acas-code-of-practice-on-disciplinary-and-grievance-procedures/html)). A UK employer can meet section 3 without a handbook. But the reasonably accessible document the statement points to is very often the handbook. In Nigeria, section 7(1) of the Labour Act requires an employer to give a worker a written statement of the main terms of employment within three months after employment begins. It covers matters such as the nature of the work, notice, wages, hours, holidays and sick pay. Section 7(3) lets the statement refer the worker to another document the worker has reasonable opportunities of reading ([Labour Act, Cap L1 LFN 2004, sections 7 and 91 (National Library of Nigeria compendium)](https://nigeriareposit.nln.gov.ng/bitstreams/3fe91e63-2ec7-43ea-a8e0-f72b49f9ef7f/download)). Section 91's definition of a worker leaves out people exercising administrative, executive, technical or professional functions, so check whether section 7 reaches a given staff member before relying on it. ## What does the law ask for, and where does a handbook fit? Table: Documents the law asks for in writing, and where a handbook fits | Document | When it is due | Where a handbook fits | | --- | --- | --- | | US federal workplace posters | Displayed in the workplace, for each statute that covers the employer | The handbook does not replace a poster | | US FMLA general notice | Posted by a covered employer, and given to each employee once any are eligible | Included in the handbook, where one exists | | US FMLA eligibility and rights notices | Within five business days of a leave request or of learning leave may qualify, absent extenuating circumstances; the rights notice goes with each eligibility notice | The leave section says who sends them | | UK written statement of particulars | No later than the first day of employment | May point to the handbook for the disciplinary rules and procedure | | UK Acas Code of Practice | Sets how rules and procedures are written, and applies when a disciplinary or grievance matter arises | The discipline and grievance sections are written to it | | Nigeria written statement of terms | Within three months of the start of employment, for workers as section 91 defines them | May point to a document the worker can read, such as the handbook | ## When does the need for a handbook actually arrive? The clearest sign is that more than one person is now answering staff questions, and the answers have started to differ. In a company of four, the founder answers every question about time off, expenses or working from home, and the answers are consistent because they come from one head. Somewhere past the first few hires that stops being true. A second person starts answering, then a third, and an employee who asks two of them the same question gets two answers. Nobody intended it, and that is the problem: the rule exists only in conversation. Several moments tend to bring that point forward. The first manager who is not a founder is one, because that person has to apply rules they did not make and cannot check with themselves. The first remote hire in another state or country is another, because the rules that were never written down were also never checked against that place. The first leave request that is not a day or two of holiday, such as parental leave or an extended sickness, tests whether anyone knows how leave is requested, approved and recorded. The first disciplinary matter tests whether there is a procedure, and whether the steps taken can be shown afterwards. The others come from outside. An investor in diligence, an insurer underwriting an employment practices policy or an auditor may ask to see the company's policies, and a customer's security or vendor questionnaire may ask whether the company has HR policies and how staff acknowledge them. None of these readers is enforcing a statute. They read the policies as evidence of how the company runs, so a request like this is a customer's or reviewer's expectation rather than a legal one. It is still the moment many companies discover that the answer is a set of messages and a shared folder. ## What does a handbook do that the required documents do not? The documents the law requires are narrow by design. A poster tells staff their rights under one statute. An FMLA notice deals with one leave request. A written statement of particulars records one person's terms. None of them tells a new manager what to do when someone asks to change their hours, raises a complaint about a colleague or wants to know how many sick days they have left. A handbook gives the company one consistent answer to those questions, written once and read by everyone. It covers: - The employment basics, such as probation, hours, pay dates and expenses. - A leave section in which each type of leave has a rule, a request route and a record. This is where most handbooks fall apart, and where the FMLA general notice sits for an employer the Act covers. - The standards of conduct, including conflicts of interest and the use of equipment and data. - How performance is reviewed and the steps before any dismissal. This is the procedure the Acas Code expects to be written down and clear. - How a grievance is raised, who hears it and what is written down. - What happens on leaving: notice, handover, return of property and references. - An acknowledgement form at the end, which each employee signs, so the company can show who has read which version. Apart from the FMLA general notice for a covered employer that has a handbook, none of that is required by a federal statute in the United States. It is good practice, and it is the document an investor, insurer or customer may ask to see. The handbook is about rules. The step-by-step processes behind them, such as how a new starter is set up or how a leaver's access is removed, belong in procedures, and a company that has outgrown informal rules has often outgrown informal processes too. Our [SOP library](https://policydrafters.com/services/sop-library) writes five to twelve of those procedures to one template, with a register and change control. ## What will a handbook not do? A handbook does not by itself mean a company is meeting its obligations as an employer. It records the rules the company says it follows; whether the company follows them, and whether those rules match the law of each place it employs people, are separate questions that the handbook cannot answer for you. A handbook that is not followed creates a gap between what the company says and what it does. Once the rules are written, managers, employees and anyone reviewing a dispute will read the document as a statement of how the company behaves. A handbook that promises a grievance hearing within a set time, or a warning before dismissal, sits badly beside a practice that skips those steps. The fix is to write only what the company will do, and to change the handbook when the practice changes. A handbook for one place does not stretch to another. A company with staff in several states or countries has several sets of rules to reconcile, and a single document written for the head office reads wrongly for everyone else. Our [employee handbook](https://policydrafters.com/services/employee-handbook) is drafted against the employment rules of the jurisdiction you name in the intake. A handbook for staff in more than one country is scoped in the intake and quoted before we start. Every handbook we draft is reviewed by our legal team before it reaches you, arrives in Word and PDF with an acknowledgement form, and includes one round of revisions. What it costs, and what moves the price, is set out in [how much an employee handbook costs](https://policydrafters.com/guides/employee-handbook-cost). ## How do you know it is time to write one? Ask three questions. Is more than one person answering staff questions about leave, conduct or discipline, and do the answers match? Is the company about to add a manager, a hire somewhere new or a headcount that brings in a new rule? Has anyone outside the company asked to see the policies? One yes is usually enough to start. Two or more means the questions are already arriving faster than informal answers can keep up, and the most useful thing to do first is write down how the company actually handles leave, complaints and discipline today, because that is what the handbook will be built from. ## Questions ### Is an employee handbook a legal requirement in the United States? No federal law requires a private employer in the United States to have an employee handbook. Federal law does require some things in writing, such as the workplace posters that apply to the employer and, for employers covered by the FMLA, the leave notices in 29 CFR 825.300. Where a covered employer with eligible employees has a handbook, the FMLA general notice belongs in it. ### Is a written statement of particulars the same as a handbook in the UK? A written statement of particulars is not a handbook. Section 1 of the Employment Rights Act 1996 requires the statement no later than the first day of employment, and section 3 lets it refer to a reasonably accessible document for the disciplinary rules and the disciplinary and dismissal procedure, while the person to apply to with a grievance is identified in the statement itself. That document is often the handbook, so the two work together. ### How many employees should we have before writing a handbook? There is no headcount at which a handbook becomes necessary. The useful trigger is the point at which more than one person answers staff questions and the answers start to differ. Some rules do attach at a headcount, such as the 15 and 20 employee thresholds the EEOC states and the FMLA's 50 in 29 CFR 825.104, and a handbook written before those points is easier to extend. ### Can PolicyDrafters draft a handbook for staff in several countries? The PolicyDrafters employee handbook is drafted against the employment rules of the jurisdiction where your staff are employed, which the intake asks you to name. A handbook for staff in more than one country is scoped in the intake and quoted before we start.