> ## Documentation Index
> Fetch the complete documentation index at: https://docs.matproof.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Policy Management
> AI-generated policies in 6 languages, mapped to your compliance frameworks, with versioning and acknowledgement tracking.
# Policy Management
Matproof generates a complete policy library pre-mapped to your active frameworks. Policies are produced in your chosen language (German, English, French, Spanish, Italian, or Dutch), version-controlled, and ready for review — so you start from a draft tailored to your organization, not a blank page.
## Languages
When you set up your organization, you pick a **policy language** — the language Matproof generates policies in. Supported languages:
| Language | Code |
| -------- | ---- |
| German | `de` |
| English | `en` |
| French | `fr` |
| Spanish | `es` |
| Italian | `it` |
| Dutch | `nl` |
You can change the policy language at any time in **Settings → Organization**.
### Also generate English
DACH organizations often need parallel English versions of policies for international auditors, customers, or partners. Enable **Also generate English** in Settings to have Matproof produce both your primary-language version and an English version of every policy. The two versions stay in sync — when you edit one, the other can be regenerated to match.
This is independent of the UI locale (the language the Matproof app itself displays in). You can run the app in German while generating policies in French.
## Included policies
| Policy | Frameworks satisfied |
| --------------------------- | ---------------------------- |
| Information Security Policy | ISO 27001, SOC 2, DORA, NIS2 |
| Acceptable Use Policy | ISO 27001, SOC 2 |
| Access Control Policy | ISO 27001, SOC 2, DORA |
| Incident Response Plan | ISO 27001, SOC 2, DORA, NIS2 |
| Business Continuity Plan | ISO 27001, DORA |
| Disaster Recovery Plan | ISO 27001, DORA |
| Data Protection Policy | GDPR, ISO 27001 |
| Vendor Management Policy | ISO 27001, DORA, GDPR |
| Change Management Policy | ISO 27001, SOC 2, DORA |
| Risk Management Policy | ISO 27001, SOC 2, DORA |
| Cryptography Policy | ISO 27001 |
| Physical Security Policy | ISO 27001 |
| AI Use Policy | EU AI Act, ISO 42001 |
| Sustainability Policy | CSRD / ESRS |
| Supply Chain ESG Policy | CSRD / ESRS |
Custom frameworks can declare their own required policies — see [Custom Frameworks](/features/custom-frameworks).
## Generating policies
From the sidebar, go to **Policies → Generate**. Matproof shows the policies suggested by your active frameworks.
Click **Generate all**, or select specific policies. Drafting takes 1–3 minutes per policy.
Each generated policy opens in the [AI Policy Editor](/features/ai-policy-editor) with sections, headings, and framework alignment notes already in place.
Edit, rewrite, or accept as-is. The AI's draft is calibrated from your setup-wizard answers (industry, size, geography, work pattern), so it's usually 70–80% right out of the box.
Each policy needs a designated owner and a review cadence (typically annual). Auditors check both.
Click **Publish**. The policy becomes available for team acknowledgement and counts as evidence on the controls it satisfies.
## The Policy Editor
The editor supports:
* **Rich text** — headings, lists, tables, callouts
* **Inline AI suggestions** — highlights gaps against framework requirements; offers stronger language where auditors expect specifics
* **Multi-language toggle** — if "Also generate English" is enabled, switch between primary language and English views without losing edits
* **Version history** — every save is a version; restore any prior version; diff between versions
* **Comments** — inline comments for reviewers
* **Approval workflow** — submit → review → approve, with the approval timestamp and reviewer name preserved as audit evidence
See [AI Policy Editor](/features/ai-policy-editor) for the editor's deeper capabilities.
## Publishing and acknowledgements
When you publish a policy:
* Team members in the relevant role receive a notification
* They can acknowledge reading the policy in the platform
* Acknowledgement rate is tracked and exposed as evidence on training/awareness controls
* For mandatory policies (typically driven by ISO 27001 or DORA), unacknowledged users surface as a finding
You can require **re-acknowledgement** when a policy is materially updated — useful for major policy changes (new incident reporting timeline, updated access control rules).
## Version control
Matproof keeps full version history on every policy:
* Saving creates a version automatically — you cannot lose work
* Previous versions are archived (never deleted) and accessible from the policy header
* The change log records who changed what and when
* Affected team members are notified of material updates
* Re-acknowledgement can be required on update
This audit trail satisfies ISO 27001 A.5.1 (policies for information security), SOC 2 CC2.2 (communication of policies), and DORA Article 5 (governance and organisation).
## Exporting policies
Export individual policies or the full policy library:
* **PDF** — for distribution and audit packages (includes approval status, version, last review date)
* **Word (`.docx`)** — for further editing outside Matproof
* **ZIP bundle** — full policy library at the current version, organized by framework
Open any policy and click **Export**, or go to **Policies → Export library** for the bundle.
Editor capabilities and inline AI suggestions
How policies link to framework controls
Acknowledgements and version history as control evidence