Artificial Intelligence (AI) Management Policy

Document control

Document ID: AI-001

Author(s): GRC & Compliance Team

Version: 1.0

Date: 09-Nov-2026

Disclaimer:

This controlled document is intended for authorized SecureXcel use. It may not be reproduced, distributed, quoted, or disclosed outside its approved audience without prior authorization from the document owner.

Revision History

1. Introduction

The purpose of this policy is to establish a unified framework for the responsible management, acceptable use, and governance of Artificial Intelligence (AI) systems within the organization. This policy ensures compliance with ISO 42001:2023 and other relevant standards and regulations. It promotes responsible, ethical, transparent, and secure adoption of AI technologies while minimizing risks and maximizing benefits.

2. Scope

Artificial Intelligence (AI) Management Policy

• Employees, contractors, third-party vendors, and partners involved in AI-related activities.
• All AI-powered platforms, models, and systems, including Generative AI (GenAI), Machine Learning (ML), chatbots, automation tools, and decision-support systems.
• Data Governance in AI Systems: Management of message metadata, customer information, and enterprise data processed in compliance with GDPR, DPDPA, and applicable Act.
• AI-related activities covering:
  • AI system design, development, deployment, operation, monitoring, and retirement.
  • Data Governance in AI systems.
  • AI-driven decision-making processes requiring human oversight.
• Both organization-owned and third-party/cloud-based AI solutions integrated into business processes.

3. Policy Objectives

The key objectives of this policy shall be to:

• Ensure AI systems comply with applicable legal, ethical, and regulatory requirements aligned with ISO 42001 Standard.
• Promote transparency, fairness, and accountability in AI decision-making.
• Safeguard data privacy and human rights.
• Identify and mitigate risks associated with AI, including bias, security vulnerabilities, and unintended consequences.
• Minimize technical and legal risks, while maximizing upside opportunities from responsible AI adoption.
• Establish governance structures for AI oversight to enable continuous improvement.
• Ensure continuous improvement through training, monitoring, and audits.

4. AI Objectives

In addition to the Policy Objectives above, which set out the principles this policy is built on, the organization establishes specific, measurable AI Objectives that translate those principles into tracked targets. AI Objectives are defined as S.M.A.R.T. (Specific, Measurable, Achievable, Relevant, Time-bound) targets, are maintained in the AIMS Objectives Tracker together with their owner, baseline, target, measurement method, and linked risk, and are reviewed and updated at least quarterly.

AI Objectives shall be defined for each AI system included in the approved AI System Inventory and AIMS scope. The objectives shall cover, at a minimum, the following categories:

• Accuracy and Performance – e.g., classification accuracy, false-positive rate, latency.
• Fairness and Bias – e.g., bounded variance in outcomes across defined segments.
• Explainability and Transparency – e.g., explanation-log coverage of production models.
• Data Governance and Security – e.g., data quality score, vulnerability closure SLA.
• Availability and Business Continuity – e.g., platform uptime, incident recovery time.

Communication and Monitoring of AI Objectives

AI Objectives, once approved by the AIGC, are communicated to the relevant functions and system owners responsible for delivering them, and are made available through the AIMS Objectives Tracker. Progress against each objective is monitored on the frequency defined for that objective (continuous, monthly, or quarterly) and formally reviewed by the AIGC on a quarterly basis as part of the Management Review Meeting (MRM). Objectives that fall behind target are flagged, and corrective action is agreed and tracked to closure.

Resource Allocation Plan for AI Objectives

The personnel, tooling, and budget required to achieve each AI Objective are identified and recorded against that objective in the AIMS Objectives Tracker, and are reviewed and approved by the AIGC as part of the quarterly MRM review. Where an objective is assessed as at risk due to insufficient resourcing, this is escalated to the AIGC for a resourcing decision.

5. AI Governance and Accountability

5.1. AI Governance Committee (AIGC)

The organization shall establish an AI Governance Committee (AIGC) to provide strategic oversight, policy approval, and accountability for SecureXcel’s Artificial Intelligence Management System (AIMS).This committee plays a critical role in ensuring that all AI initiatives are developed and operated in an ethical, transparent, secure, and compliant manner, aligned with SecureXcel’s business objectives and regulatory obligations. The committee formation and member details are defined in the AI Ethics Charter.

The committee shall be responsible for:

• Overseeing the development, approval, and enforcement of AI-related policies.
• Reviewing and approving AI deployments based on the results of AI Impact Assessments (AIIA) and associated risk evaluations.
• Ensuring that AI systems are aligned with organisation’s strategic objectives, legal and regulatory requirements, and ethical principles.
• Monitoring AI-related risks in compliance with DPDPA , GDPR and applicable Act and recommending corrective actions where necessary.
• Promoting continuous improvement in AI governance, including transparency, fairness and accountability practices.

Roles, Responsibilities, and Communication

Beyond the AIGC, the AIMS assigns specific roles and responsibilities to the Information Security & GRC Lead, the GRC Lead, the Centralized Cyber Security Team, and AI Lifecycle Owners & Developers for each AI system in scope. These roles, their responsibilities, and the detailed RACI (Responsible, Accountable, Consulted, Informed) matrix that decomposes them are documented in the AIMS Manual (A00), Sections 4.2 and 5.2.

These roles and responsibilities, and this policy itself, are communicated to all relevant personnel through: (a) onboarding for new joiners with AI-related responsibilities; (b) mandatory AIMS awareness training, refreshed at least annually; (c) publication on the internal governance portal; and (d) direct briefing of AI Lifecycle Owners and Developers at the point a role is assigned. Communication is tracked by the GRC team, and the roles table and RACI matrix are reviewed and updated at least annually or upon organizational change.

5.2. External Communication of the AI Policy (A.5.2, A.10.4)

Beyond internal communication, the organization maintains a documented plan for making its responsible AI approach available to external interested parties, as appropriate. The externally facing counterpart to this internal Policy is the Responsible AI Policy and Principles (Classification: Public), which is published on SecureXcel's public website.

• Audience and Content Segmentation: Customers and the general public receive the public-facing Responsible AI Policy and Principles, covering high-level commitments (fairness, transparency, human oversight, security, sustainability) without internal operational detail. Regulators and authorities receive the same public policy plus, upon lawful request and under appropriate confidentiality, relevant operational evidence (e.g., Impact Assessment summaries per AIMS-B-003 Section 3.11, incident records) coordinated by Legal & Compliance. Enterprise customers with a contractual relationship may additionally receive system-specific information (intended use, limitations, human oversight mechanisms) per AIMS-B-008 Section 4.3 (Customer Relationship Management).
• Channels: (a) the public SecureXcel website, where the Responsible AI Policy and Principles is published with version history; (b) direct disclosure to enterprise customers via contract, SLA, or account management, coordinated by the External Communication Team (AIMS-B-008); (c) responses to regulator or authority requests, coordinated by Legal & Compliance; and (d) the public-facing contact channel named in the Responsible AI Policy and Principles (Section 10) for stakeholders to raise concerns.
• Triggers and Frequency: The public policy is republished whenever it is materially revised and is otherwise reviewed at least annually (Responsible AI Policy and Principles, Section 12). Customer-facing system information is provided at onboarding and upon material change to the system (AIMS-B-008 Section 4.3.1). Regulatory disclosures are made upon lawful request and, where mandated, within statutory timelines.
• Ownership and Tracking: The GRC Team owns the public policy publication and version history. The External Communication Team owns customer-facing disclosures and maintains the Customer Information Vetting Checklist (AIMS-B-008 Appendix D) as evidence that required disclosures were made. Both are reviewed by the AIGC at least annually, alongside the internal communication review in Section 5.1 above.

6. Acceptable Use Guidelines

6.1 Ethical and Responsible AI Use

• AI-generated content shall align with organizational values, laws, and ethical standards.
• Employees shall not use AI to produce or present content in a manner that constitutes deception, or misinformation
• Employees involved in the AI lifecycle shall review and verify AI-generated outputs before use/submission to customer/client.
• AI-generated decisions shall not replace critical human judgment in sensitive matters

6.2 Data Privacy and Confidentiality

• When necessary, use enterprise-approved AI tools with data security measures. AI-generated content shall align with organizational values, laws, and ethical standards.

6.3 AI Generated Content Accountability

• Employees involved in AI design and development are responsible for the accuracy of AI-generated content.
• AI-generated content shall cite sources where applicable.

6.4 Bias and Fairness Mitigation

• The organization shall conduct regular AI bias audits and content quality checks.
• For our spam classification system (SecureXcel AI Services), we shall address bias through technical design and operational controls.
• Training Data Quality
• Diverse teams shall classify training data to minimize individual biases
• Regular audits and oversight shall ensure labelling quality and consistency
• Bias-Resistant Architecture
• Ensemble of specialized models shall analyse different message aspects independently
• Multiple models shall reduce the impact of systematic bias in any single component
• Operational Safeguards
• Business rules shall define for non-negotiable exceptions (e.g., bank OTPs from registered headers)
• Client-specific whitelists shall maintain for premium customers or trusted sources
• Monitoring shall prevent undesirable flagging (e.g., legitimate advocacy or small business P2P messages)
• Monitoring
• Ongoing tracking of false positive/negative rates across message categories shall be performed.
• Periodic fairness audits shall identify discriminatory patterns
• Feedback mechanisms shall capture and address undesirable outcomes
• Regular updates shall be applied to rules and exceptions based on operational learnings

6.5 Copyright and Intellectual Property Protection

• AI-generated content shall comply with intellectual property laws.
• Employees shall verify AI outputs for Accuracy, originality and legal usage rights.

7. Usage of AI Tools

The use of AI tools shall follow the principles of responsibility, transparency, and compliance:

• Only enterprise-approved AI tools may be used for official purposes.
• AI tools shall not be used to process or expose confidential, sensitive, or Personally Identifiable Information (PII) in public/unapproved systems, without appropriate safeguards and approvals
• Users shall apply human oversight and critical judgment in all AI-generated outputs.
• AI-driven decision-making in high-impact areas shall involve human validation and approval
• Employees involved in AI lifecycle shall review, fact-check, and appropriately cite AI outputs when applicable.

8. Prohibited Use of Generative AI

The following activities are strictly prohibited when using Generative AI within the organization:

• Creating or distributing content that is false, misleading, defamatory, or otherwise harmful (including but not limited to fake news or deepfakes).
• Deploying AI-generated code, outputs, or recommendations without first ensuring compliance with security, privacy, and regulatory requirements.
• Attempting to bypass content moderation controls or leveraging AI for activities that could constitute unauthorized access, system exploitation, or other unethical practices.
• Using AI systems to impersonate employees, customers, executives, or any individual/entity for deceptive purposes.

9. AI Model Development and Lifecycle Management

The organization shall establish clear objectives, standards, and processes to guide the responsible design, development, validation, and management of AI models throughout their life cycle. These processes shall ensure compliance with legal, ethical, and regulatory requirements while safeguarding fairness, security, and accountability.

9.1. AI Model Development Standards

All AI models shall follow standardized Machine Learning Operations (ML Ops) and Secure Software Development Lifecycle (SSDLC) principles, incorporating fairness, transparency, and privacy into design, data use, and training. Only approved data sources and validated methods may be used to minimize risks.

9.2. AI Model Validation and Testing

AI models shall be rigorously validated before deployment to ensure accuracy, reliability, fairness, and compliance. Testing shall include robustness, explainability, and documented approvals prior to release.

9.3. AI Model Monitoring and Continuous Improvement

AI models shall be subject to ongoing monitoring and evaluation to ensure continued accuracy, reliability, fairness, and compliance.

• Models shall be regularly assessed for performance degradation, bias, or drift.
• Based on monitoring results, models will be updated, retrained, or decommissioned if they no longer meet compliance, ethical, or business standards.
• The organization will maintain procedures to document monitoring frequency, metrics, retraining triggers, and retirement criteria.
• Refer to the AI Model Monitoring and Continuous Improvement Policy for detailed procedures on monitoring frequency, metrics, retraining triggers, and retirement criteria.

AI System Life Cycle Stages

The Development Standards, Validation and Testing, and Monitoring principles above are applied consistently across the following documented life cycle stages for every AI system in scope, in accordance with the AI System Lifecycle Management Procedure (B-006) and Section 8.2 (AI System Life Cycle Controls) of the AIMS Manual (A00):

• Requirements and Specification – documented technical, data, ethical, and performance requirements, approved before development begins.
• Design and Development Documentation – design objectives, architecture decisions, and the responsible-development process followed.
• Verification and Validation – independent testing that the system was built to specification and meets the intended need.
• Deployment – a documented deployment plan confirming requirements, verification, and impact-assessment outcomes are met before production release.
• Operation and Monitoring – ongoing monitoring for drift, bias, and latency, with defined thresholds that trigger review or rollback.
• Technical Documentation – maintained and kept current for each relevant category of interested party.
• Event Logging – model inference, data pipeline, user interaction, and infrastructure logs enabled from first use and retained per the records retention schedule.

10. AI Risk Management Process

The organization shall adopt a structured approach to identify, analyze, and mitigate risks across the AI system life cycle to ensure responsible use and protect the organization from potential adverse impacts.

The following process will be followed for all AI systems:

10.1. Risk Identification

• Algorithmic bias and fairness issues.
• Data privacy and protection concerns.
• Security vulnerabilities (adversarial attacks, model theft).
• Legal and regulatory compliance gaps.
• Intellectual property risks.
• Operational, Technical risks from model drift or inaccurate outputs.

10.2. Risk Assessment

• Risks will be assessed using a Risk Matrix (Likelihood × Impact).
• Risks will be categorized as High, Medium, or Low.

10.3. Risk Treatment / Mitigation

• Implement controls such as human-in-the-loop oversight, model monitoring, access controls, encryption, and vendor compliance checks.
• Risks shall be raised to the AI Governance Committee for exception approval and mitigation.

10.4. Risk Monitoring

• Continuous monitoring of AI systems for anomalies, security threats, or compliance violations as per applicable Act.
• Regular AI bias audits and model performance reviews.

10.5. Risk Reporting

• All identified AI risks shall be documented in the AI Risk Register.
• Incidents or high-risk findings shall be reported to the IT Security Team and AI Governance Committee immediately.

10.6. AI Impact Assessments (AIIA)

All AI systems deployed or utilized by the organization shall undergo an AI Impact Assessment (AIIA) to evaluate potential risks.

The purpose of the AIIA is to ensure that AI systems are designed, implemented, and operated in a manner that safeguards human rights, ethical principles, and societal well-being, while minimizing risks and unintended harms. The objectives for the assessment include but not limited to:

• Ethical implications and fairness.
• Bias detection and mitigation.
• Data protection, privacy and information security risks.
• Environmental and social impact.

11. AI Incident Response and Report

11.1 AI Incident Response Plan (AI-IRP)

The organization shall maintain an AI Incident Response Plan to detect, report, and resolve AI-related incidents. All incidents shall be reported to the AI Governance Committee (AIGC), with AI systems equipped to flag anomalies and potential failures. Incidents shall be documented, analysed, and addressed through corrective actions, with procedures for both internal and external parties to report adverse impacts. Communication of incidents shall follow documented timelines, regulatory requirements, and stakeholder obligations.

11.2 AI Misuse Reporting

Employees shall report any AI misuse, unethical behaviour, or security issues to the IT Security Team or AI Governance Committee.

11.3 Disciplinary Actions

Violations of this policy shall result in:

• Formal warnings.
• Access restrictions to AI tools.
• Disciplinary action, including termination (in severe cases).
• Legal consequences if AI misuse violates laws or contracts.

12. AI Audit and Compliance Checks

AI systems shall undergo regular internal and external audits to confirm compliance with policies, regulations, and ISO/IEC 42001:2023. Policies shall be reviewed annually to reflect emerging risks and regulatory updates, with audit findings reported to the AIGC for oversight and continuous improvement.

13. Third-Party AI Systems and Supply Chain Compliance

Third-party AI vendors shall comply with ISO/IEC 42001:2023 requirements and all applicable legal, security, and privacy regulations. All suppliers of AI components or systems shall undergo a Third-Party AI Risk Assessment before procurement or integration, assessing risks related to data quality, privacy, security, bias, and ethical impacts as applicable.

Ongoing monitoring and evaluation of supplier performance shall be conducted to ensure continuous alignment with the organization’s responsible AI practices. Where third-party AI systems are integrated, the organization shall maintain traceability and documentation to demonstrate compliance, accountability, and stakeholder trust.

14. AI Ethical Principles

The organization shall define and implement ethical principles to guide the responsible design, deployment, and use of AI systems. These principles ensure compliance with laws and regulations, safeguard human rights, and promote trust, accountability, and transparency across the AI life cycle.

14.1 Fairness and Bias Mitigation

AI systems shall be trained on diverse and unbiased datasets, and regular audits shall be conducted to detect and mitigate bias.

14.2 Transparency and Explainability

AI decisions shall be interpretable and explainable to users and stakeholders, and users shall be informed when they interact with AI-driven decisions.

14.3 Transparency Briefings – Frequency & Scope

The AI Governance Committee (AIGC) shall conduct bi-annual internal Transparency Reviews to evaluate how explainability, interpretability, and user communication requirements are being met across all AI systems. Each review will produce an Internal Transparency Report summarizing:

• Explainability assessments of production AI models (including methods such as SHAP or LIME).
• Key actions and findings from fairness or bias audits.
• Any customer or regulator queries related to AI transparency, along with internal resolutions.

These reports are intended solely for SecureXcel’s internal governance and audit reference and shall not be shared externally without formal management authorization.

Records of the reviews and reports shall be retained for 24 months.

14.4 Human Oversight and Accountability

Human intervention shall be required in high-risk AI decision-making scenarios, and AI systems should not make final decisions on critical matters (e.g., healthcare, legal, HR) without human approval.

14.5 Privacy and Data Protection

AI shall comply with privacy laws (e.g., GDPR) and AI models shall not retain Personally Identifiable Information (PII) unless necessary and legally permitted.

14.6 AI Environmental Sustainability

AI systems shall minimize carbon footprint and energy consumption, and preference shall be given to energy-efficient AI models.

15. AI Training and Awareness

All employees shall receive annual training on AI ethics and compliance, while AI development teams shall additionally undergo specialized training on bias detection and security. Non-technical employees should be educated on the broader impacts of AI, including fairness, transparency, and responsible use, to ensure awareness and accountability across the organization.

16. AI Policy Review and Continuous Improvement

This AI Policy will be reviewed annually or upon significant AI-related regulatory changes. AI governance stakeholders will provide recommendations for updates.

17. Compliance with ISO 42001:2023 and Other Standards

This policy is aligned with:

• ISO 42001:2023 (Artificial Intelligence Management System).
• ISO 27001 (Information Security Management).
• ISO 9001 (Quality Management System).
• GDPR and other data protection regulations.

More in AI governance and management system

• Artificial Intelligence (AI) Ethics Committee Charter
• Responsible AI Policy and Principles
• AI Management Procedure
• Stakeholder and Requirements Register
• Regulatory Obligations Register India