AI Management Procedure

Document control

Document ID: B-005

Author(s): GRC & Compliance Team

Version: 1.0

Date: 09-Nov-2026

Disclaimer:

This controlled document is intended for authorized SecureXcel use. It may not be reproduced, distributed, quoted, or disclosed outside its approved audience without prior authorization from the document owner.

Document Details

Revision History

1. INTRODUCTION

1.1 Purpose (B.2.1 Objective)

The core purpose of this procedure is to define the structured, rigorous, and auditable process by which the organization establishes, documents, aligns, communicates, and continually reviews its Artificial Intelligence (AI) Policy. This ensures the AI Policy effectively provides the necessary management direction and strategic support for all AI systems, consistent with business requirements, legal obligations, and the commitment to responsible AI as the Policy serves as the highest-level documented commitment under the AI Management System (AIMS).

1.2 Scope

This procedure applies comprehensively to:

1. 1. All activities involved in the creation, maintenance, or revision of the official AI Policy document.
2. 2. All departments responsible for creating, maintaining, or complying with other organizational policies that may intersect with the AI system development, deployment, or use.
3. 3. The Board, the AI Governance Committee (AIGC), and the designated AI Policy Owner responsible for the authorization and maintenance of the AI Policy.

1.3 Objectives

The primary objectives are to ensure:

1. 1. Mandatory Compliance: The AI Policy adheres to all mandatory requirements specified in IS/ISO/IEC 42001, Clause 5.2 (a-d).
2. 2. Strategic Cohesion: The policy is demonstrably compatible with the organization's strategic direction and risk criteria (5.1).
3. 3. Control Implementation: The organization effectively implements the controls related to Policies in Annex A.2 (A.2.2, A.2.3, A.2.4).
4. 4. Integration (A.2.3): Clear, documented cross-referencing and integration between the AI Policy and other relevant organizational policies (e.g., Information Security, Quality, Privacy, and HR).
5. 5. Effectiveness and Suitability: The policy is routinely reviewed and maintained to ensure its continuing suitability and effectiveness (A.2.4).

1.4 AIMS Process Landscape and Interaction (Clause 4.4)

In accordance with ISO/IEC 42001:2023, Clause 4.4, SecureXcel determines the processes needed for the AI Management System (AIMS), their application throughout the organization, and their sequence and interaction. This section defines that process landscape and applies to all AI systems formally included in the approved AIMS scope and AI System Inventory, consistent with the AIMS Scope Statement.

A. Defined List of AIMS Processes

The table below lists every process that makes up the AIMS, its primary clause or Annex A control reference, the accountable process owner, and the document in which the process is fully specified. This Procedure (B-005) governs Process 2 (AI Policy Establishment, Alignment, Communication & Review) specifically; it is one process within the broader AIMS process landscape defined here.

B. Process Sequence and Interaction

Processes do not operate in isolation. The table below defines, for each process, the output or interface it produces and the downstream process(es) that consume it, establishing the sequence and interaction required by Clause 4.4(b). Several processes (notably AI System Life Cycle Management and Data Life Cycle Management) run in parallel and are tightly coupled rather than strictly sequential.

Taken together, these interactions close a continual-improvement (Plan-Do-Check-Act) loop: Context and Risk determination inform the AI Policy and Objectives (Plan); Resource Management, Competency, AI System Life Cycle, and Data Life Cycle Management deliver AI systems responsibly (Do); Monitoring, Internal Audit, and Incident Management evaluate performance (Check); and Management Review, Nonconformity handling, and Continual Improvement feed decisions back into Context Determination, the AI Policy, and AI Objectives (Act), consistent with Clause 4.4(f) and Clause 10.1. This process landscape and interaction map is reviewed and updated at least annually, or upon material change to the AIMS scope, alongside the annual context review described in the AIMS Manual (A00), Section 3.1.

2. ROLES, RESPONSIBILITIES, AND AUTHORITIES

3. PROCEDURE FOR POLICY ESTABLISHMENT AND REVIEW

This procedure is executed in four defined sequential phases: Establishment, Alignment, Communication, and Review.

PHASE 1: AI POLICY ESTABLISHMENT (Control A.2.2)

The AI Policy Owner ensures the policy draft is informed by strategic inputs and comprehensive.

3.1 Determine Policy Foundation and Inputs

The AI Policy Owner shall formally document the inputs used to inform the policy, including:

1. 1. Strategic Alignment: Review of the organization's long-term business strategy to ensure the policy supports the direction and is not contradictory.
2. 2. Risk Appetite Determination: Consultation with the AIGC Committee and Risk Management to define the high-level risk appetite the organization is willing to pursue or retain regarding the deployment of novel AI technologies (B.2.2).
3. 3. Legal Landscape Review: Comprehensive review by Legal/Compliance of current and pending AI-specific regulations (e.g., EU AI Act, specific national data laws).
4. 4. Context and Stakeholder Impact: Documenting the organization's current roles with respect to AI systems (4.1) and documenting key needs and expectations of relevant interested parties (4.2, B.2.2).

3.2 Draft Policy Content (A.2.2)

The AI Policy Owner drafts the AI Policy, ensuring it explicitly addresses the following:

1. 1. Mandatory Commitments (5.2): Incorporating the four mandatory commitments (Purpose, Objectives Framework, Applicable Requirements, and Continual Improvement).
2. 2. Guiding Principles: Establishing the core ethical principles (e.g., fairness, transparency) and specifying the organization's stance on them.
3. 3. Cross-References: Including necessary cross-references to other organizational policies dealing with specific topics (e.g., Data Security, Privacy, HR) (B.2.2).
4. 4. Deviation Protocol: Defining, at a high level, the protocol for handling exceptions and deviations (B.2.2).

3.3 Formal Approval Cycle (A.2.2)

The policy draft undergoes a two-step approval gate to ensure both strategic and formal endorsement:

1. 1. AIGC Committee Review: The draft is submitted to the AIGC Committee for strategic review to ensure alignment with the defined risk appetite, ethical posture, and strategic goals. The Committee provides a formal recommendation or requests revisions.
2. 2. Board Approval: Upon receiving a favorable recommendation from the AIGC, the policy is submitted to Board for final, formal sign-off. The policy is only deemed "established" upon this documented approval.

PHASE 2: POLICY ALIGNMENT AND INTEGRATION (Control A.2.3)

This phase ensures the new AI Policy is seamlessly integrated into the organization's existing governance framework.

3.4 Conduct Policy Intersect Analysis (A.2.3)

The AI Policy Owner coordinates a formal "Alignment Workshop" involving all Departmental Policy Owners and the Legal team. The workshop determines:

1. 1. Affected Domains: Identifying all existing policies that could be affected by AI systems (e.g., Quality, Security, HR hiring practices, etc.).
2. 2. Applicability Check: Determining which existing policies apply to the organization's AI objectives (e.g., the existing Information Security Policy applies to AI infrastructure).
3. 3. Gap Identification: Pinpointing where existing policies fail to account for unique AI risks (e.g., adversarial attacks, data bias).

3.5 Determine and Implement Actions (A.2.3)

For every identified intersection, a documented action must be taken and tracked:

1. 1. Mandatory Update: If the gap exposes a critical risk (e.g., insufficient controls against data poisoning), the relevant Departmental Policy Owner must initiate an update to their policy.
2. 2. Explicit Cross-Reference: The AI Policy shall explicitly reference the related policy's scope and requirements where appropriate.
3. 3. Policy Alignment Matrix Sign-off: The outcomes of the analysis and the planned actions must be documented in a Policy Alignment Matrix (Appendix B), which is formally signed off by the AI Policy Owner and Legal/Compliance.

PHASE 3: POLICY COMMUNICATION AND CONTROL (Clause 7.5)

This phase ensures the policy is controlled and effectively communicated across all relevant parties.

3.5 Policy Documentation, Versioning, and Control (7.5.3)

The AI Policy Owner assigns the next sequential version number and date, and ensures the policy is stored in the central document repository.

1. 1. Control Measures: Access controls (e.g., read-only access for general staff) and preservation mechanisms (legibility and integrity) are implemented to protect the documented information.
2. 2. External Document Management: Documented information of external origin (e.g., regulatory guidelines referenced in the policy) is identified and controlled as appropriate (7.5.3).

3.6 Policy Communication and Awareness (5.2, 7.3)

1. 1. Internal Awareness: The AI Policy Owner ensures all persons doing work under the organization’s control (including contractors) are made aware of the policy through mandatory training, which details their contribution to the effectiveness of the AIMS and the implications of nonconformity (7.3).
2. 2. External Availability: The policy (or an approved summary) is made available to external interested parties, as required by legal or contractual obligations, or where deemed necessary for transparency by the AIGC Committee.

PHASE 4: POLICY REVIEW AND CONTINUAL IMPROVEMENT (Control A.2.4)

The AI Policy must be subject to periodic, comprehensive review to ensure its continuing suitability and effectiveness.

3.8 Establish Review Frequency and Authority (A.2.4)

1. 1. Planned Review: The AI Policy Owner defines a planned review interval (typically annual, concurrent with the Management Review cycle).
2. 2. Review Authority Chain: The AI Policy Owner coordinates the review, the AIGC Committee performs the strategic assessment, and Board provides final re-approval.

3.9 Trigger Ad-Hoc Policy Review (A.2.4)

An ad-hoc review is mandatory upon the occurrence of any significant event that impacts the policy’s foundation:

1. 1. Major Governance Directive: A formal directive issued by the AIGC Committee or Board regarding a strategic change.
2. 2. Unacceptable Residual Risk: The AI Risk Assessment (6.1.2) identifies an unacceptable risk level that cannot be treated by existing controls and indicates a fundamental flaw in the policy's guidance.
3. 3. Systemic Nonconformity: Repeated failures resulting from the same cause, suggesting the policy is inadequate in eliminating systemic risks (10.2).

3.10 Conduct Comprehensive Policy Review (B.2.4)

The AI Policy Owner compiles all inputs (Appendix C) and submits them for strategic and formal review:

1. 1. AIGC Strategic Assessment: The Committee reviews the policy's strategic fit, ensures ethical consistency, and verifies that the policy remains aligned with the organization's evolving risk appetite.
2. 2. Effectiveness Evaluation: The review assesses the effectiveness of the policy by analyzing trends in nonconformities, deviations, and audit results (9.3).

3.11 Policy Update, Gap Analysis, and Re-Approval

1. 1. Gap Analysis: If changes are necessary, the AI Policy Owner conducts a Gap Analysis comparing the existing policy against new external requirements and internal operational needs.
2. 2. Re-Alignment: Any revisions trigger a mini-Policy Alignment Review (5.4) to ensure the changes do not create conflicts with existing departmental policies.
3. 3. Re-Approval: The revised policy follows the full approval cycle (5.3) before being re-released and re-communicated (5.7).

4. PROCESS MAP: AI POLICY LIFE CYCLE

This flowchart details the four phases of the AI Policy Life Cycle as described in Section 5, explicitly showing the role of the AIGC Committee.

APPENDIX A: AI POLICY CONTENT CHECKLIST (A.2.2)

This checklist provides the minimum mandatory content and recommended additions for the organization’s primary AI Policy document.

APPENDIX B: POLICY ALIGNMENT MATRIX (A.2.3)

This matrix is used to document the outcome of the Policy Intersect Analysis (Section 5.4 and 5.5). The documented actions ensure that the AI Policy is not an isolated document.

APPENDIX C: POLICY REVIEW INPUT CHECKLIST (A.2.4)

The AI Policy Owner shall utilize this detailed checklist during the policy review (Section 5.10) to ensure continuing suitability and effectiveness.

C.1 AIMS Governance and Performance Data

C.2 Risk and Operational Data

C.3 Contextual and External Data

APPENDIX D: PROCEDURE FOR HANDLING AI POLICY DEVIATIONS

The AI Policy (P-8.0) requires a formal process for handling temporary exceptions. This appendix details the rigorous process to maintain control while allowing operational flexibility.

D.1 Objective

To provide a formal, documented, and risk-managed pathway for requesting, reviewing, and authorizing temporary exceptions to the established AI Policy principles or requirements, while ensuring residual risk remains within the organization's acceptable risk appetite.

D.2 Responsibility and Authority

• Requestor: Any employee or team requiring an exception.
• Deviation Review Board (DRB): A mandated multi-disciplinary team led by the AI Policy Owner, including representatives from Legal, Risk Management, and Technical Architecture. The DRB must convene physically or virtually for all High/Critical deviation requests.
• Board: Final approval authority for all deviations classified as High or Critical Risk (D.3, Step 4).

D.3 Deviation Handling Steps (D.3)

5. PROCEDURE EFFECTIVENESS METRICS

To ensure the effectiveness of this procedure (AIMS-PR-001) in fulfilling its objectives, the AIMS Manager shall monitor the following key performance indicators (Engineering LeadIs) and report them during the Management Review (9.3).

6. CONTINUAL IMPROVEMENT OF THE PROCEDURE

This procedure itself is subject to continual improvement (10.1). The AI Policy Owner shall recommend updates based on the following:

• Audit Feedback: Internal or external audit observations related to the efficiency, resource consumption, or adherence to this procedure.
• Process Performance: Detailed analysis of the Procedure Effectiveness Metrics (Section 11) where targets are consistently missed (e.g., a low Alignment Score indicates this procedure's Phase 2 needs revision).
• Lessons Learned: Insights gathered from the Nonconformity and Corrective Action process (10.2), particularly relating to policy deviations that resulted in negative outcomes.

7. REFERENCES AND DEFINITIONS

7.1 External References

• IS/ISO/IEC 42001:2023 – Information technology – Artificial Intelligence – Management System (AIMS)
  • Clause 5.2 (AI Policy Requirements)
  • Annex A.2 (Reference Control Objectives and Controls)
  • Annex B.2 (Implementation Guidance for AI Controls - Policies)
• IS/ISO/IEC 27001 (Information Security Management)
• IS/ISO/IEC 27701 (Privacy Information Management)
• ISO 31000 (Risk Management Guidelines)

7.2 Key Definitions

More in AI governance and management system

• Artificial Intelligence (AI) Management Policy
• Artificial Intelligence (AI) Ethics Committee Charter
• Responsible AI Policy and Principles
• Stakeholder and Requirements Register
• Regulatory Obligations Register India