AI Risk Management and Customer Relationship Procedure

Document control

Document ID: B-008

Author(s): GRC & Compliance Team

Version: 1.0

Date: 09-Nov-2026

Disclaimer:

This controlled document is intended for authorized SecureXcel use. It may not be reproduced, distributed, quoted, or disclosed outside its approved audience without prior authorization from the document owner.

Document Details

Revision History

1. INTRODUCTION

1.1 Purpose (6.1.1 General, A.10.1 Objective)

The core purpose of this procedure is two-fold:

1. 1. Risk Management (6.1): To establish the mandatory, systematic process for defining AI risk criteria, assessing AI risks, and determining appropriate AI risk treatment actions to prevent or reduce undesired effects and achieve continual improvement.
2. 2. External Control (A.10.1): To ensure that the organization understands its responsibilities, remains accountable, and risks are appropriately apportioned and managed when third parties (suppliers, partners, customers) are involved at any stage of the AI system life cycle.

1.2 Scope

This procedure applies to:

• All AI Systems and Activities: Any development, procurement, deployment, or use of an AI system within the AIMS scope.
• Risk Evaluation: The initial and ongoing assessment of AI risks and opportunities.
• External Interfaces: All contractual and operational relationships with suppliers, third-party component providers, partners, and customers that rely on or interact with the organization's AI systems.

1.3 Objectives

The primary objectives are to ensure:

1. 1. Risk Criteria Definition (6.1.1): Clear, documented criteria are established for distinguishing acceptable from non-acceptable AI risks.
2. 2. Consistent Assessment (6.1.2): AI risk assessments are designed to produce consistent, valid, and comparable results, informed by context and impact.
3. 3. Statement of Applicability (SoA) (6.1.3): A comprehensive SoA is produced, documenting all necessary controls and justification for inclusion or exclusion.
4. 4. Accountability (A.10.2): Responsibilities across the AI system life cycle are clearly and formally allocated between internal teams and external parties.
5. 5. Supplier Alignment (A.10.3): Suppliers' products and services align with the organization's approach to responsible AI.
6. 6. Customer Consideration (A.10.4): Customer expectations and needs are considered, and they are provided with the necessary information to manage their own risks.

3. ROLES, RESPONSIBILITIES, AND AUTHORITIES

3. PART A: AI RISK MANAGEMENT PROCESS (6.1)

This part follows the standard risk cycle: define criteria, assess, and treat.

3.1 Define AI Risk Criteria (6.1.1)

The RMO shall establish and maintain AI Risk Criteria, which must be approved by the AIGC Committee.

3.1.1 Risk Acceptance Criteria

Criteria must be documented to support distinguishing acceptable from non-acceptable risks. This includes:

• Consequence Thresholds: Defining the severity levels (e.g., Catastrophic, Major, Moderate, Minor) for impacts on individuals, society, and the organization (e.g., financial loss, reputational damage, safety violation).
• Risk Matrix: Defining the combination of consequence and likelihood that results in an "Critical," "High," "Medium," or "Low" risk rating.

3.1.2 Risk Assessment Criteria

Criteria for performing the risk assessment, including the methodology, tools, and frequency (e.g., initial assessment at design phase, ad-hoc assessment upon major change).

3.2 AI Risk Assessment (6.1.2, 8.2)

The AI System Owner initiates the assessment process at planned intervals (at least Annually) or when significant changes occur (8.2).

3.2.1 Context and Input Gathering (6.1.1)

The ASO documents the AI system's domain, intended use, and external/internal context (4.1). Mandatory inputs include:

• AI System Impact Assessment : The potential consequences on individuals and societies must be used to analyze consequence severity (6.1.2 d) 1)).
• Legal Requirements: Requirements from Legal & Compliance regarding prohibited uses and compliance obligations.
• Internal Organization: Roles and responsibilities that affect the ability to manage risk.

3.2.2 Risk Analysis and Evaluation (6.1.2 d, e)

The RMO analyzes identified AI risks (see Appendix B for potential sources) to produce documented results:

1. 1. Consequence Assessment (6.1.2 d) 1)): Assess the potential consequences if the identified risk materializes (using the Impact Assessment as a key input).
2. 2. Likelihood Assessment (6.1.2 d) 2)): Assess the realistic likelihood of occurrence.
3. 3. Risk Determination (6.1.2 d) 3)): Determine the initial level of risk (inherent risk).
4. 4. Prioritization (6.1.2 e) 2)): Evaluate the inherent risk against the established Risk Acceptance Criteria (4.1.1) and prioritize risks for treatment.

3.3 AI Risk Treatment and SoA (6.1.3, 8.3)

For risks deemed "High" or "CriticalCritical," the RMO defines a treatment process.

3.3.1 Select Risk Treatment Options (6.1.3 a)

Select appropriate treatment options, including:

• Modify Risk: Apply controls (e.g., mandatory human oversight, stricter V&V).
• Retain Risk: Accept the residual risk (requires AIGC approval).
• Avoid Risk: Discontinue the system or process that generates the risk.
• Share Risk: Apportion risk to an external party (e.g., supplier, insurance), formalizing via contract (A.10.2). / Transfer Risk

3.3.2 Determine Necessary Controls (6.1.3 b, c, d)

The RMO determines all controls necessary to implement the chosen treatment options:

1. 1. Reference Comparison (6.1.3 b, c): Compare necessary controls against those in Annex A to verify no critical controls (e.g., A.7.4 Data Quality) have been omitted.
2. 2. Additional Controls (6.1.3 d): Identify and design any additional controls necessary beyond Annex A.

3.3.3 Statement of Applicability (SoA) Production (6.1.3 f)

The RMO produces and maintains the SoA, which documents:

• The necessary controls selected (4.3.2).
• Justification for the inclusion of controls.
• Justification for the exclusion of controls (e.g., control is not necessary based on risk assessment, or is subject to an exception under an external requirement).

3.3.4 Approval and Residual Risk Acceptance (6.1.3 g)

The RMO formulates the AI Risk Treatment Plan. This plan, and the acceptance of any residual risk, must be formally approved by the AIGC Committee.

4. PART B: EXTERNAL RELATIONSHIP CONTROL (A.10)

This part ensures that risk treatment controls are effectively extended and managed through all external partnerships.

4.1 Allocating Responsibilities (A.10.2)

The Procurement/Supplier Manager and Legal & Compliance ensure clear responsibility allocation whenever a third party is involved.

4.1.1 Responsibility Apportionment

Document the split of responsibilities between the organization (ASO), its partners, suppliers, and customers for critical AI life cycle stages. This is mandatory for:

• Data Handling: PII Controller vs. PII Processor roles (B.10.2).
• System Maintenance: Who is responsible for monitoring and applying updates/patches.
• Liability: Formal allocation of accountability for adverse impacts (B.10.2).
• License Check: For all the third-party and open-source LLMs/Models, license check shall be done prior to adopting/fine-tuning the AI models.

4.1.2 Contractual Formalization

The allocation of responsibilities (including the decision to share risk from 4.3.1) must be formalized and legally documented in contracts and service level agreements (SLAs).

4.2 Supplier Management (A.10.3)

The Procurement/Supplier Manager establishes a rigorous process for controlling the selection, onboarding, and ongoing monitoring of suppliers.

4.2.1 Supplier Vetting and Due Diligence

A process must be established to ensure that the supplier's approach to providing services or products aligns with the organization's AI Policy (AIMS-001). Due diligence must verify:

• Data Quality: Evidence of the supplier's data quality assurance processes (A.7.4).
• Security: Compliance with security standards, especially related to model protection (e.g., against model stealing).
• Documentation: Commitment to deliver appropriate and adequate documentation (A.6.2.7) for the procured AI system (B.10.3).

4.2.2 Ongoing Monitoring and Corrective Action

The Procurement/Supplier Manager monitors supplier performance, particularly for AI system components:

• Non-Alignment: If a supplier's component is found to cause adverse impacts or fails to meet the organization's responsible AI requirements, the ASO requires the supplier to take corrective action (B.10.3).
• Review: Supplier performance is periodically reviewed based on failure rates and adherence to contractual performance metrics.

4.3 Customer Relationship Management (A.10.4)

This process ensures customers receive necessary information to understand and manage the risks associated with using the organization's AI system.

4.3.1 Customer Expectation Analysis

The ASO assesses customer expectations and needs during the product planning phase (B.10.4).

4.3.2 Information Provision (A.10.4)

The External Communication Team ensures that customers are provided with the necessary information to treat their corresponding risks. This must include:

• System Limitations: Clear communication of the AI system's valid domain of use and its technical limitations (A.6.2.7, B.10.4).
• Oversight Requirements: Clear instructions on mandatory human oversight requirements (if applicable) and acceptable error rates.
• Adverse Impact Reporting: Provision of capabilities for customers to report adverse impacts (A.8.3).

5. PROCESS MAP: AI RISK & EXTERNAL CONTROL FLOW

6. APPENDIX A: AI RISK MANAGEMENT TEMPLATE (6.1.2)

This template is used by the ASO and RMO to document the analysis and evaluation of identified AI risks.

7. APPENDIX B: POTENTIAL AI RISK SOURCES (6.1.2)

This list is based on Annex C and serves as a starting point for the ASO to identify hazards and risk sources during the initial assessment (4.2.1).

8. APPENDIX C: SUPPLIER VETTING AND OVERSIGHT CHECKLIST (A.10.3)

Mandatory checklist for the Procurement/Supplier Manager to ensure alignment of third-party AI systems.

9. APPENDIX D: CUSTOMER INFORMATION VETTING CHECKLIST (A.10.4, A.8.5)

The ASO and External Communication Team use this checklist to ensure all information provided to customers meets the necessary standard for risk management.

10. CONTINUAL IMPROVEMENT OF THE PROCEDURE (10.1)

This procedure itself is subject to continual improvement (10.1). The Risk Management Officer (RMO) shall recommend updates based on the following:

1. 1. SoA Audits (9.2): Internal audit findings related to the thoroughness of the Statement of Applicability (SoA) or the effectiveness of controls listed in it.
2. 2. Critical Residual Risk: Any instance where the AIGC Committee is required to accept a residual risk classified as High, indicating the current risk treatment options defined in this procedure are inadequate.
3. 3. Supplier Failures (A.10.3): Systemic failures traced back to a third-party component (e.g., poor data quality from a supplier), suggesting the Supplier Vetting process (5.2.1) needs increased rigor.

More in AI risk, impact and assurance

• AI System Impact Assessments Procedure
• AI Risk Criteria and Assessment Methodology Procedure
• AI Model Monitoring and Improvement Policy