Artificial Intelligence (AI) Management Policy
This policy ensures compliance with ISO 42001:2023 and other relevant standards and regulations.
Policies and procedures for an AI management system: AI governance and ethics, impact assessment, risk criteria, data protection, incident handling and the lifecycle of an AI system, written to the structure of ISO/IEC 42001.
ISO/IEC 42001 is the management system standard for organizations that develop, provide or use artificial intelligence. It asks for an AI policy, a way to assess the impact of an AI system on people and society, risk criteria, controls over the data and the lifecycle of each system, and a process for AI incidents. These are the documents SecureXcel itself works to.
Each one is published as written, with its own document control, owner and revision history. Read them here, then download the Word file to adapt to your organization.
This policy ensures compliance with ISO 42001:2023 and other relevant standards and regulations.
The AI Governance Committee (AIGC) decisions are binding on all AI project teams and must be implemented within agreed timelines.
SecureXcel and its group companies are committed to designing, developing, and operating Artificial Intelligence (AI) responsibly.
This procedure is executed in four defined sequential phases: Establishment, Alignment, Communication, and Review.
This register supports the effective management and monitoring of interested-party requirements in accordance with Clause 4.2.
India-specific obligations applicable to SecureXcel AI Services and its data.
This procedure applies to any AI system (newly developed, procured, or materially enhanced) that falls within the scope of the AIMS.
This part follows the standard risk cycle: define criteria, assess, and treat.
This procedure sets out the AI risk criteria and the methodology used to identify, analyse, evaluate and treat risks arising from SecureXcel’s AI systems.
The objective of this policy is to implement the controls necessary for the continuous monitoring and measurement of AI systems post-deployment.
The purpose of this policy is to ensure the protection of data used, processed, and generated by Artificial Intelligence (AI) systems within the organization.
The classification process ensures protection controls are proportional to data sensitivity.
This part defines the processes for securing, validating, and preparing data, integrating transparency throughout the data life cycle.
The entire organizational structure responsible for developing, providing, procuring, or using AI systems within the defined scope of the AIMS.
The V&V Team must define and document the specific verification and validation measures and specify criteria for their use.
Approved models, data sources and material changes are recorded in the AI System Inventory and the applicable model/change register.
This record provides a documented assessment of third-party AI components and services used by SecureXcel AI Services, ensuring that applicable suppliers...
This policy ensures timely detection, assessment, and mitigation of AI-related risks while maintaining compliance with ISO 42001:2023.
This procedure is executed in four mandatory phases covering proactive, reactive, and mandatory communication activities.
ISO/IEC 42001:2023 is the first international standard for an AI management system. Like ISO 27001 for information security, it sets out how an organization governs a subject, here AI, and can be certified by an accredited body.
They are designed to work together. Many AI controls build on information security, such as access, data protection and supplier management, and the two systems can share documents. The Employee AI Usage Policy sits in the ISO 27001 set and applies here too.
No document can. Certification depends on your own AI inventory, impact assessments, risk decisions and evidence that you follow your procedures. These give you structured documents to adapt.
Yes. Each document is available as a Word file, and as PDF, once you sign in. The account is free.