Document control
SecureXcel AI Services Model Card and User Documentation
Document ID: B-031
Author(s): GRC & Compliance Team
Version: 1.0
Date: 09-Nov-2026
Disclaimer:
This controlled document is intended for authorized SecureXcel use. It may not be reproduced, distributed, quoted, or disclosed outside its approved audience without prior authorization from the document owner.
| Document Title | AI Model Card and User Documentation | ||||
|---|---|---|---|---|---|
| Document Id | SecureXcel/AIMS/B-031 | Current Version | 1.0 | Date of Release | 09-Nov-2026 |
| Classification | Internal | Author | GRC & Compliance Team | ||
| Reviewed by | GRC & Compliance Lead | ||||
| Approved by | Management Representative | AI Governance Committee (AIGC) | |||
| Designation |
Revision History
| Version | Date | Author | GRC & Compliance Team | GRC & Compliance Lead | Management Representative |
|---|---|---|---|---|---|
| 1.0 | 30/09/2026 | GRC Lead | GRC Head | AIGC | Initial version |
1. Purpose
The purpose of this model card is to provide clear and consistent information about SecureXcel AI Services, including its intended use, capabilities, performance, limitations, and applicable considerations. It supports transparency for enterprise customers, auditors, and internal stakeholders while protecting confidential and proprietary model information.
2. System Overview
| Field | Content |
|---|---|
| System | Approved AI System / Model (system identifier as recorded in the AI System Inventory) |
| Intended use | AI-assisted security, GRC and assurance activities such as evidence classification, control mapping, risk analysis, security-signal triage, document analysis and decision support within approved SecureXcel workflows. |
| Deployment context | Business-to-business and internal enterprise use within approved SecureXcel services and platform workflows. Customer data or environments are processed only where contractually authorized and within the approved scope. |
| Not intended for | Fully autonomous high-impact decisions affecting legal rights, employment, access to essential services or other material outcomes; any use outside approved security, GRC and assurance purposes without an updated impact assessment. |
| Users | Enterprise customers (via reporting and, once live, the Customer Explainability Portal), SecureXcel AI CoE and Engineering, GRC and Legal & Compliance, and, on lawful request, regulators |
3. How It Works
SecureXcel AI Services may use one or more approved AI models to support security, GRC and assurance activities such as evidence classification, control mapping, risk analysis, anomaly detection, document analysis and security-signal triage. Approved models, data sources and material changes are recorded in the AI System Inventory and the applicable model/change register.
4. Performance
| Metric | Target |
|---|---|
| Accuracy | ≥ 95% (AIIA action R-03, target date Q1 FY2027; interim figures tracked in AI-005 KRI dashboard) |
| Precision / recall | ≥ 90% each (AIIA action R-03) |
| Explanation-log coverage | 100% of production model decisions, target Q2 FY2027 (AIIA action R-02); current coverage tracked in AI-005 |
| Fairness monitoring | Monthly false-positive/false-negative tracking by sender category (B25 KR-AI-E-01 treatment plan) |
Formal minimum Engineering LeadI thresholds per model type are being finalised and published as a formal AI Model Standards annex (AIIA action R-03); until published, the targets above are the interim reference.
5. Limitations and Known Failure Modes
- AI-assisted outputs may contain false positives, false negatives, incomplete classifications or context errors. High-impact outcomes require human review, and approved exception or override processes shall be used where automated output is not sufficiently reliable.
- Performance can degrade under model drift as fraud patterns evolve; monitored under AI-005 and treated under B25 KR-AI-T-01/08/09/13/15.
- AI Model Card and User Documentation
- The AI system shall only be used for approved SecureXcel security, GRC and assurance use cases. Any materially different use requires a new or updated AI impact and risk assessment before deployment.
6. Human Oversight
Automated decisions are supported by a human review queue for flagged or contested cases, per AI-001 section 6.1 and the acceptable-use controls. Review-queue backlog and analyst error are tracked as KR-AI-E-08 in B25, with a treatment plan requiring SLA monitoring and second-reviewer sampling for high-impact decisions.
7. Explainability
Explanations are generated per decision and logged for audit; a Customer Explainability Portal providing plain-language rationales to enterprise clients and regulators is in development (AIIA action R-01, target Q3 FY2027). Until the portal is live, explanations are available on request through the account team, coordinated by the AI CoE.
8. Data and Privacy
Training and operational data sources are listed in the AI System Inventory (B28). Personal data handling is governed by B-001 (AI Data Protection and Security Procedure) and AI-002 (AI Data Protection and Retention Policy); retention periods are reconciled in the Regulatory Obligations Register (B35).
9. Raising a Concern
Any customer, partner, employee or member of the public who believes SecureXcel AI Services has produced an unfair, inaccurate or harmful outcome can raise it through the AI Concern & Adverse Impact Reporting Form (F-B002-01), per B-002 (AI Incident Management Procedure). Reports are logged, triaged and investigated by the Ethics & Concerns Officer.
10. Document Control
| Owner | Review frequency | Distribution |
|---|---|---|
| AI System Owner (Engineering Lead), with AI CoE input | Reviewed at each material model change (via B30) and at least annually | Enterprise customers on request; internal AIMS folder; summary version for the public-facing Responsible AI Policy page |
11. Compliance with ISO 42001:2023
| Requirement | Where met | Clause |
|---|---|---|
| Technical documentation for each relevant AI system | Whole document | A.6.2.7 |
| Information made available to users | Sections 2, 4, 8 | A.8.2 |
| Limitations and predictable failures documented | Section 5 | B.5.3 (via B-003 methodology) |