Published as written. This is SecureXcel's own working document, shown with its document control and notices as they appear in the file. Adapt it to your organization, approve it through your own document control, and treat it as a starting point: it is not legal advice and does not make an organization compliant or certified.
Document control
Document ID: B-029
Author(s): GRC & Compliance Team
Version: 1.0
Date: 09-Nov-2026
Disclaimer:
This controlled document is intended for authorized SecureXcel use. It may not be reproduced, distributed, quoted, or disclosed outside its approved audience without prior authorization from the document owner.
| Document Title | Stakeholder and Requirements Register | ||||
|---|---|---|---|---|---|
| Document Id | SecureXcel/AIMS/B-029 | Current Version | 1.0 | Date of Release | 09-Nov-2026 |
| Classification | Internal | Author | GRC & Compliance Team | ||
| Reviewed by | GRC & Compliance Lead | ||||
| Approved by | Management Representative | AI Governance Committee (AIGC) | |||
| Designation |
Revision History
| Version | Date | Author | GRC & Compliance Team | GRC & Compliance Lead | Management Representative |
|---|---|---|---|---|---|
| 1.0 | 30/09/2026 | GRC Lead | GRC Head | AIGC | Initial version |
1. Purpose
The purpose of this register is to identify and document the needs and expectations of relevant interested parties, including their applicable legal, regulatory, contractual, and other requirements, and to establish their linkage to the relevant AIMS controls, processes, or documented information. This register supports the effective management and monitoring of interested-party requirements in accordance with Clause 4.2.
2. Scope
Covers interested parties relevant to SecureXcel’s approved AI systems and the AIMS as a whole. System-specific interested-party requirements shall be added whenever a new AI system or material AI-enabled use case is brought into scope.
3. Stakeholder and Requirements Register
| Interested party | Requirement | Legal / contractual source | How addressed |
|---|---|---|---|
| Regulators — MeitY / Data Protection Board | Lawful processing of personal data, purpose limitation, security safeguards and data-principal rights for AI-enabled processing. | Digital Personal Data Protection Act, 2023 and applicable Rules | B-001, AI-002 and the Regulatory Obligations Register (B35). |
| Regulators — CERT-In | Reporting and handling of qualifying cyber incidents affecting AI systems or supporting infrastructure. | CERT-In directions under the Information Technology Act, 2000 | B-002 AI Incident Management Procedure and B35. |
| Enterprise customers | Assurance that AI-assisted security and GRC outputs are appropriately governed, explainable, reviewable and used within agreed scope. | Commercial contracts, statements of work and service-level commitments | B-003 impact assessment, B25 risk treatment, B-031 model/user documentation and applicable customer evidence. |
| Customer-authorized users | Clear information on intended use, limitations, human oversight and channels for raising concerns. | Contractual requirements and responsible-AI commitments | AI-001, B-031 and the concern/incident reporting process. |
| Employees and contractors | Clear AI usage rules, training, security requirements and a channel to raise concerns. | Employment/engagement terms and A33 Employee AI Usage Policy | A33, awareness activities and B-002 concern reporting. |
| Suppliers — AI/model/API providers | Security, privacy, licence, model-use and responsible-AI requirements for third-party components. | Supplier contracts, licence terms and applicable law | B-034 supplier and third-party AI assessments and approved-component records. |
| Management / governance body | Visibility of AI risk, significant incidents, performance, compliance status and treatment actions. | Corporate governance and management-system requirements | Management review, risk register, internal reporting and AIMS governance records. |
| Legal & Compliance | Accurate mapping of legal, regulatory, contractual and customer obligations applicable to AI use. | Applicable laws, regulations, contracts and standards | B35 Regulatory Obligations Register and periodic compliance review. |
| Internal audit / independent assurance | Objective evidence that the AIMS is implemented and operating as documented. | ISO/IEC 42001:2023 clause 9.2 and approved audit programme | AIMS Internal Audit Plan, audit evidence and corrective-action records. |
| Relevant public / affected stakeholders | Appropriate transparency where an approved AI use case can materially affect external stakeholders. | Responsible-AI principles and applicable legal/contractual requirements | Responsible AI Policy, impact assessment, transparency information and escalation process. |
4. Maintenance
- Reviewed at each management review and whenever a new regulator, customer segment or supplier category is added.
- GRC Lead owns this register; Legal & Compliance confirms the legal-source column at each review.
5. Compliance with ISO 42001:2023
| Requirement | Where met | Clause |
|---|---|---|
| Interested parties and their requirements determined | Whole document | 4.2 a) |
| Which requirements will be addressed through the AIMS | Column 4 | 4.2 b) |
| Legal, regulatory and contractual requirements identified | Column 3 | A.8.5 |
More in AI governance and management system
Sign in to download the Word documentSign in to download the PDFFree. You return straight to this page after you sign in.