AI Data Management and Responsible Use Procedure

Document control

Document ID: B-007

Author(s): GRC & Compliance Team

Version: 1.0

Date: 09-Nov-2026

Disclaimer:

This controlled document is intended for authorized SecureXcel use. It may not be reproduced, distributed, quoted, or disclosed outside its approved audience without prior authorization from the document owner.

Document Details

Revision History

1. INTRODUCTION

1.1 Purpose (A.7.1 Objective, A.9.1 Objective)

The core purpose of this consolidated procedure is two-fold:

1. 1. Data Management (A.7.1): To define, document, and implement rigorous data management processes across the AI system life cycle to ensure the organization understands the role and impacts of data on AI system applications. This includes ensuring data quality, tracking provenance, and addressing privacy implications (B.7.2).
2. 2. Responsible Use (A.9.1): To establish formal, documented processes and objectives that ensure the organization uses AI systems responsibly, adheres to organizational policies, and validates that the system operates strictly according to its Intended Use (A.9.4).

1.2 Scope

This procedure applies to:

• All Operational AI Systems (A.9): The deployment and use of all AI systems within the AIMS scope, ensuring continuous adherence to defined use objectives and human oversight requirements.
• All Personnel: Any person or team involved in data acquisition, preparation, model training, or system operation.
• All Data Resources (A.7): Any data used at any stage of the AI system life cycle (training, validation, test, and production data), regardless of its source (internal, third-party, public).
• All Suppliers and Third Parties (A.9.4, A10.3): Any external service, product, model, dataset or material incorporated into an in-scope AI system.

1.3 Objectives

The primary objectives are to ensure:

1. 1. Data Trustworthiness: Data used is of sufficient quality, proven lineage, and representative of the operational domain to produce valid outputs (A.7.4, A.7.5).
2. 2. Privacy and Security: Data management processes explicitly address privacy and security implications, particularly for sensitive and Personally Identifiable Information (PII) (B.7.2).
3. 3. Governance of Use (A.9.3): Clear, documented objectives (e.g., safety, reliability, fairness) are integrated into the deployment and operational control environment.
4. 4. Adherence to Use (A.9.4): Systems are demonstrably used only according to their intended purpose and accompanying documentation, with mechanisms to identify and correct foreseeable misuse.

2. ROLES, RESPONSIBILITIES, AND AUTHORITIES

3. PART A: AI DATA MANAGEMENT (A.7)

This part defines the processes for securing, validating, and preparing data, integrating transparency throughout the data life cycle.

3.1 Planning and Initial Documentation (A.7.2, A.7.3)

This process is mandatory before the start of the design phase.

3.1.0 Data Categories and Life Cycle Stages (A.7.2)

The organization defines and documents the categories of data it processes for the development and enhancement of AI systems. At minimum, the following categories are recognized and tracked in the AI Data Inventory (B-001):

• Training Data: Used to fit model parameters.
• Validation Data: Used to tune hyperparameters and select between candidate models.
• Test Data: Held out and used only for final performance evaluation (3.3, AIMS-B-006 V&V).
• Production / Inference Data: Live data submitted to the deployed system (B-006, Section 5.2).
• Third-Party / Supplier Data: Data obtained from external sources, subject to Supplier Alignment Evaluation (B-007 Section 4.4.3).
• Personal Data / PII: Any of the above categories that additionally contains personal data, subject to AI-002 and B-001.

Every data set, regardless of category, moves through the following mandatory life cycle stages, each governed by a specific subsection of this procedure:

1. Collection / Generation (Section 3.2): Data is sourced, acquired, or synthetically generated.

2. Cleansing / Preprocessing (Section 3.4): Data is cleaned, imputed, and normalized.

3. Training / Refining (AIMS-B-006, Section 4.1): Data is used to fit or refine model parameters.

4. Evaluation / Testing (Section 3.3, AIMS-B-006 Section 4.2-4.3): Data is used to verify the data and the resulting model meet defined quality and performance requirements.

5. Continuous Enhancement (Section 3.4.2, AIMS-B-006 Section 5.2): Production data and monitoring feedback are used to identify drift and inform retraining or data set refresh.

3.1.1 Define Data Management Processes (A.7.2)

The Head of Data Governance defines and documents the processes for data management related to AI development, explicitly covering:

• Privacy and security implications of the data (B.7.2).
• Transparency aspects, including data provenance and the ability to explain how data contributes to an output (B.7.2).
• Data retention and disposal policies.

3.1.2 Initial Acquisition Requirements (A.7.3)

The Data Scientists define the initial requirements for data acquisition, documenting details such as:

• Categories of data needed (e.g., training, validation, test).
• Quantity of data required and data sources (internal, purchased, synthetic).
• Data subject demographics and characteristics to identify potential bias issues (B.7.3).

3.2 Data Acquisition and Vetting (A.7.3)

This process ensures data is legally and ethically sourced and documented.

3.2.1 Data Source Vetting (A.7.3)

Before use, all data sources shall be formally vetted using the Data Acquisition Checklist (Appendix A). This includes documentation of:

• Data characteristics (static, streamed, machine-generated).
• Prior handling of the data (previous uses, conformity with privacy/security).
• Formal confirmation from Legal & Compliance regarding data rights and PII handling compliance (B.7.3).

3.2.2 Data Provenance Recording Initiation (A.7.5)

A formal record of Data Provenance shall be initiated immediately upon acquisition for all data used in AI systems, covering the source and Ingest stages of the data’s life cycle. The record shall document:

• Source: The date of acquisition, the original source (e.g., internal server path, supplier name), and last modification (B.7.3).
• Ingest: The date the data was loaded into the organization's systems or pipelines, the ingestion method used, and initial integrity checks performed on load, in conformity with ISO 8000-2 principles (B.7.5).

3.3 Data Quality Assurance (A.7.4)

This process ensures the data meets the organization's requirements for the specific AI task.

3.3.1 Define and Document Data Quality Requirements (A.7.4)

The Head of Data Governance defines and documents quantifiable Data Quality Requirements (Appendix B) specific to the system's intended purpose. This includes metrics for:

• Accuracy: The data correctly reflects the real-world values or events it represents.
• Completeness: All required fields and records are present, with no unexplained gaps.
• Representativeness and Bias: The data reflects the diversity of the operational domain of use, without systematic skew (B.7.2, 3.3.2).
• Consistency: Values are consistent across records and data sources, with no conflicting entries.
• Timeliness: The data is sufficiently current for the system's intended purpose.
• Uniqueness: Records are free of unintended duplication that could bias training or evaluation results.

3.3.2 Bias Assessment and Mitigation (A.7.4)

A mandatory Bias Assessment shall be conducted on the data set:

• Known or potential bias issues (e.g., skew towards certain demographics) shall be documented (B.7.3).
• The assessment shall consider the impact of bias on system performance and fairness.
• Mitigation strategies (e.g., oversampling, re-weighting) shall be defined and approved by the AI System Owner.

3.4 Data Preparation and Transformation (A.7.6)

This process ensures transformations are rigorous, documented, and justified.

3.4.1 Define Data Preparation Criteria (A.7.6)

The Data Scientists define and document the criteria for selecting specific data preparation methods. The documentation shall justify the choice of method based on the intended AI task (B.7.6). Methods include:

• Collection: Confirmation that the data set used as input to preparation matches the acquired data recorded in Section 3.2 (Data Acquisition and Vetting).
• Cleaning: Correcting or handling missing, malformed, or invalid entries.
• Transformation and Normalization: Imputation, scaling, encoding, and normalization of feature values.
• Labelling and Annotation: Assignment and quality review of target variables and, where applicable, human-annotated labels, including annotator guidelines and inter-annotator agreement checks for subjective labelling tasks.
• Splitting: Division of the data set into training, validation, and test partitions (Section 3.1.0), with the split method (e.g., random, stratified, time-based) documented and justified to prevent data leakage between partitions.

3.4.2 Provenance Recording of Transformations (A.7.5)

Any transformation, encoding, or preparation activity (4.4.1) shall be formally logged in the Data Provenance Record. This ensures traceability and helps provide an explanation of how data are used for determining an AI system's output (B.7.2). The log shall include:

• The specific transformation algorithm or script used.
• The date and responsible team member.
• The statistical result of the transformation (e.g., new mean/std dev).

3.4.3 Recording of Transformations (A.7.5)

The Data Provenance Record shall also capture the Use stage: each occasion a data set is consumed by an AI system. At minimum, the record shall document:

• Which AI system(s) and model version(s) the data set was used to train, validate, test, or operate (cross-referenced to AIMS-B-006 V&V records).
• The date range during which the data set was in active use.
• Any known limitations of the data set that were carried forward into the Impact Assessment (AIMS-B-003) or Risk Assessment (6.1.2).

3.4.4 Full Life-cycle Provenance Record(A.7.5)

Taken together, Sections 3.2.2, 3.4.2, 3.4.3, and 3.5 form a single, continuous Data Provenance Record per data set, spanning all five mandatory stages: Source and Ingest (3.2.2), Transform (3.4.2), Use (3.4.3), and Retention (3.5, including final disposal or archival). The Data Provenance Record is retained per Section 3.5.1 and is a mandatory input to the Data Acquisition Checklist (Appendix A) and the AI System Impact Assessment (AIMS-B-003).

3.5 Data Disposal and Retention (A.7.2, 7.5.3)

Data shall be controlled until the end of its useful life.

3.5.1 Data Retention Policy Adherence

The AI System Owner ensures that all data (training, validation, test) are retained and disposed of in strict accordance with organizational data retention policies and applicable legal requirements (B.7.3).

3.5.2 Formal Disposal Protocol

When data disposal is required, a formal, documented protocol shall be used to ensure secure and irreversible deletion or anonymization, and the disposal date shall be recorded in the Data Provenance Record.

4. PART B: RESPONSIBLE USE GOVERNANCE (A.9)

This part defines the governance framework that ensures deployed AI systems, including those sourced in whole or in part from suppliers, are used responsibly and as intended, integrating human oversight.

4.1 Defining Use Objectives (A.9.3)

This process is mandatory before system deployment .

4.1.1 Organization-Wide Responsible Use Objectives (A.9.3)

The following Responsible Use Objectives are formally adopted by the AI Governance Committee (AIGC) as the organization's baseline objectives for the responsible use of AI systems. These objectives are mandatory for every in-scope AI system and are not merely illustrative; each is assigned an owner, a quantifiable operational metric, and a target threshold in Appendix C.

• Fairness: The system shall not produce outcomes that unfairly disadvantage individuals or groups based on protected characteristics.
• Accountability: Every automated decision shall be traceable to a responsible role and, where applicable, an auditable log entry.
• Reliability / Robustness: The system shall perform consistently within its defined operating envelope and degrade safely outside it.
• Safety: The system shall not cause harm to individuals, the organization, or its customers, and human override shall always take precedence.
• Privacy: Personal data processed by the system shall be protected in line with the AI Data Protection Policy (AI-002) and B-001.
• Transparency: Users and affected individuals shall be able to obtain an appropriate explanation of system behaviour, in line with A.8.2.

The AI System Owner, in consultation with the AIGC, tailors this baseline set to each AI system's context and documents any system-specific additions or exclusions with rationale.

4.1.2 Identify and Document Responsible Use Objectives (A.9.3)

The AI System Owner, in consultation with the AIGC Committee, identifies and documents specific objectives (e.g., Fairness, Accountability, Reliability, Safety) that guide the responsible use of the deployed AI system (B.9.3).

• These objectives shall align with the organization’s high-level AI Policy (AIMS-001).
• Each objective shall be assigned a quantifiable operational metric (Appendix C).

4.1.3 Operational Objective Alignment

The AI System Owner shall confirm that the system meets the identified objectives by analyzing the final Verification and Validation (V&V) results (AIMS-B-006, 5.3). If a third-party solution is used, the system shall meet the organization's objectives before procurement (B.9.3).

4.2 Processes for Responsible Use (A.9.2)

The organization establishes the controls for acceptable usage of the every in-scope AI system.

4.2.1 Document Responsible Use Processes (A.9.2)

The AI System Owner defines and documents the specific operational processes required for the responsible use of the system. This includes:

• Required approvals for activation and access (B.9.2): no AI system may be activated for production use without written sign-off from the AI System Owner and, for high-risk systems (per the AI System Impact Assessment, B-003), the AIGC.
• Monitoring frequency and thresholds (A.6.2.6), defined per system and recorded in the system's operational runbook.
• Protocols for dealing with system malfunctions or unexpected outputs, including immediate escalation to the Operations Team and, where safety-relevant, suspension under Section 4.5.

4.2.2 Sourcing and Integration Controls (B.9.2)

If a third-party AI system is sourced, the procurement process shall ensure the solution:

• Fulfills the organization's documented Responsible Use Objectives (A.9.3).
• Adheres to approved sourcing requirements (e.g., contractual obligations for data provenance/quality).

4.2.3 Governance and Escalation Structure (A.9.2)

Responsible use is governed through the roles defined in Section 2. Issues that cannot be resolved at the AI System Owner level are escalated to the AIGC. The AIGC reviews aggregated responsible-use metrics (Appendix C) and unintended-use trends (Appendix E) at each scheduled Management Review Meeting.

4.3 Human Oversight Integration (A.9.3)

This process ensures meaningful human oversight is incorporated where the AI system can impact natural persons.

4.3.1 Determine Oversight Requirements

Based on the AI System Impact Assessment (AIMS-B-003), the AI System Owner shall determine the necessary level and type of human oversight, including:

• Required intervention points (e.g., for high-risk decisions).
• Authority to override decisions made by the AI system (B.9.3).
• Required qualifications, training, and awareness for oversight personnel (B.9.3).

4.3.2 Document Human Oversight Specification

The detailed procedures for human intervention, monitoring, and reporting shall be documented in the Human Oversight Specification (Appendix D). This includes:

• The threshold that mandates human intervention (e.g., confidence score below ).
• The logging mechanism for all human overrides (A.6.2.8).

4.4 Verifying Intended Use (A.9.4)

This is a continuous monitoring process to ensure the system is not used outside its design parameters.

4.4.1 Establish Intended Use Boundaries (A.9.4)

The AI System Owner defines and documents the strict boundaries of the AI system's intended use based on its accompanying documentation (A.6.2.7). This includes defining:

• Valid domains and contexts of use.
• Acceptable data inputs (data types, formats, or statistical distributions).
• Prohibited uses (A.9.4).

4.4.2 Continuous Monitoring and Validation (A.9.4)

The Operations Team uses log data (A.6.2.8) and monitoring outputs (A.6.2.6) to continuously validate that the system is used as intended.

• Intended Use Validation Log: The Operations Team maintains a log (Appendix E) to record and investigate any instances where usage deviates from the established boundaries (e.g., a system designed for English text processing is fed Japanese text).
• Adherence Review: Periodically review the monitoring logs to confirm the data being processed aligns with the documentation associated with the AI system (B.9.4).

4.4.3 Supplier and Third-Party Alignment Evaluation (A.9.4, A.10.3)

Before any AI-related service, product, model, dataset or other material provided by a supplier is used within an in-scope AI system, Procurement / Sourcing, with support from the AI System Owner and Legal & Compliance, shall perform a documented Supplier Alignment Evaluation. The evaluation shall confirm and record:

● The supplier's approach to responsible AI development and use is compatible with the organization's Responsible Use Objectives (Section 4.1) and AI Policy (AI-001).

● The intended use, known limitations, and prohibited uses of the supplied service, product or material, as stated in the supplier's accompanying documentation.

● Evidence of the supplier's data provenance, data quality, and security practices, where the supply includes data (cross-referenced to Part A of this procedure).

● Contractual commitments obligating the supplier to notify the organization of material changes to the system, known incidents, or newly identified limitations.

● The outcome (Approved / Approved with Conditions / Rejected) and the reviewer's name and date, recorded in the Approved Software, Tools & Open-Source AI Models Register.

The Supplier Alignment Evaluation is repeated whenever the supplier materially changes the service, product or material, and at minimum annually for suppliers supporting high-risk AI systems.

4.5 Deviation and Unintended Use Protocol (A.9.4)

Any deviation from the intended use or documentation shall be treated as a nonconformity.

4.5.1 Reporting Unintended Use

Any personnel identifying use outside the documented boundaries (A.9.4) shall immediately report the incident via the Concern Reporting Process (AIMS-B-004).

4.5.2 Investigation and Corrective Action

The AI System Owner shall investigate the unintended use to determine if it:

1. 1. Constitutes Foreseeable Misuse: If foreseeable, the documentation (A.6.2.7) shall be immediately updated with clearer limitations.
2. 2. Violates Legal Requirements: If so, the incident shall be escalated to Legal & Compliance.

If the unintended use is identified, the system shall be suspended or placed under mandatory human oversight until the risk associated with the deviation is treated.

5. PROCESS MAP: AI DATA AND RESPONSIBLE USE GOVERNANCE FLOW

6. APPENDIX A: DATA ACQUISITION CHECKLIST (A.7.3)

Mandatory checklist to be completed by the Data Scientist and signed off by the Head of Data Governance before data is used for training or development.

7. APPENDIX B: DATA QUALITY REQUIREMENTS (A.7.4)

The Head of Data Governance defines these quantifiable requirements for each data set. Failure to meet these triggers mandatory rework (4.3.1).

8. APPENDIX C: RESPONSIBLE USE OBJECTIVES METRICS (A.9.3)

Quantifiable metrics derived from the AI Policy and Impact Assessment (AIMS-001), used for continuous operational monitoring (A.6.2.6).

9. APPENDIX D: HUMAN OVERSIGHT SPECIFICATION (A.9.3)

Documentation for incorporating mandatory human intervention controls into the use of the AI system.

10. APPENDIX E:Intended Use Validation Log (A.9.4)

Maintained by the Operations Team as the documented evidence that each in-scope AI system, including supplier-provided components, is used according to its intended use and accompanying documentation (Section 4.4). New entries are raised whenever a deviation is detected, reported (Section 4.5.1), or identified during Adherence Review.

11. CONTINUAL IMPROVEMENT OF THE PROCEDURE (10.1)

This procedure is subject to continual improvement (10.1). The Head of Data Governance and the AI System Owner shall collaboratively recommend updates based on the following:

1. 1. Quality Failures (A.7.4): Consistent failure to meet Data Quality Requirements (Appendix B), indicating that the Acquisition (4.2) or Preparation (4.4) processes need mandatory, more stringent controls.
2. 2. Unintended Use Trends (A.9.4): Analysis of the Intended Use Validation Log (Appendix E) shows recurring patterns of deviation, suggesting that the initial Intended Use Boundaries (5.4.1) are impractical or the Responsible Use Processes (5.2) are ineffective.
3. 3. Audit Feedback (9.2): Internal audit observations regarding the completeness of Data Provenance Records (A.7.5) or the adherence to Human Oversight Specifications (A.9.3).

More in AI data protection and responsible use

• Artificial Intelligence (AI) Data Protection and Retention Policy
• AI Data Protection and Security Procedure