AI Policy (EU AI Act · ISO 42001)

1. Legal Framework

This AI Policy is governed by Regulation (EU) 2024/1689 of the European Parliament and of the Council (EU AI Act), which establishes harmonised rules on artificial intelligence across the European Union.

We also align our AI management practices with ISO 42001:2023, the international standard for AI management systems, ensuring a structured, risk-based, and ethics-driven approach to developing and deploying AI.

This policy applies to all AI systems we develop, provide, or deploy as part of our services.

2. Risk Classification

The EU AI Act classifies AI systems into four risk categories:

Unacceptable Risk — AI uses that are prohibited outright, such as social scoring by public authorities, real-time biometric surveillance in public spaces, or systems that exploit psychological vulnerabilities. We do not develop or deploy any such systems.

High Risk — AI systems used in critical areas such as employment decisions, education, access to essential services, law enforcement, or safety components of regulated products. Where our services fall within this category, we apply the full set of obligations described in this policy.

Limited Risk — AI systems that interact with users (e.g. chatbots) carry transparency obligations. We ensure users are always informed when they are interacting with an AI system.

Minimal Risk — The majority of general-purpose AI applications. We apply good-practice standards even where regulation does not require it.

3. Governance Principles

Our AI governance is built on five core principles:

Accountability — We clearly identify responsible persons for each AI system we operate. Decisions made by or with AI can always be traced back to a responsible human actor within our organisation.

Transparency — We communicate openly about the nature, capabilities, and limitations of our AI systems. Users and affected parties are informed when AI plays a material role in a decision that affects them.

Fairness — We actively work to identify and mitigate bias in AI systems. We do not allow AI to discriminate on the basis of race, gender, age, disability, religion, or any other protected characteristic.

Human Oversight — All high-risk AI decisions are subject to meaningful human review. Automated outputs are treated as recommendations, not final determinations, unless explicitly and lawfully defined otherwise.

Continuous Improvement — We commit to ongoing monitoring, evaluation, and improvement of our AI systems in light of new evidence, regulatory updates, and stakeholder feedback.

4. Obligations as an AI Service Provider

As a provider of AI-powered services, we fulfil the following obligations under the EU AI Act:

— We maintain up-to-date technical documentation for high-risk AI systems.
— We implement conformity assessment procedures before placing high-risk AI systems in service.
— We register high-risk AI systems in the EU database where required.
— We affix CE marking where applicable and draw up EU declarations of conformity.
— We establish and maintain a post-market monitoring system to track performance in real conditions.
— We report serious incidents or malfunctions to competent national authorities without undue delay.
— We cooperate fully with market surveillance authorities upon request.

5. Risk Management Process

We operate a documented AI risk management process aligned with both the EU AI Act and ISO 42001:2023. This process includes:

Identification — Cataloguing all AI systems in use or under development, and assessing their intended purpose, potential uses, and foreseeable misuse.

Assessment — Evaluating the likelihood and severity of potential harms to individuals, groups, or society, including indirect and cumulative effects.

Mitigation — Applying technical and organisational measures proportionate to identified risks, including dataset quality controls, explainability mechanisms, and access restrictions.

Monitoring — Continuously tracking system behaviour in deployment, with defined metrics and escalation thresholds.

Review — Periodically reassessing risk profiles in response to system changes, new regulatory guidance, or emerging evidence of harm.

6. Human Rights in Automated Decisions (GDPR Art. 22)

Where our services involve automated decision-making that produces legal or similarly significant effects on individuals, we comply fully with Article 22 of the General Data Protection Regulation (GDPR).

Individuals have the right not to be subject to a decision based solely on automated processing. Where such processing occurs, we ensure that individuals:

— Are informed that automated decision-making is taking place.
— Have the right to request human review of any automated decision.
— Can express their point of view and contest the decision.
— Receive a meaningful explanation of the logic involved.

We implement these rights through clear user interfaces, accessible contact channels, and defined internal review procedures.

7. Training Plan

We maintain an ongoing AI literacy and responsibility training programme for all staff involved in the development, deployment, or management of AI systems. This programme covers:

— Foundational concepts in AI and machine learning.
— Applicable legal and regulatory requirements, including the EU AI Act and GDPR.
— Ethical principles and responsible AI practice.
— Identification of bias, unfair outcomes, and risks.
— Incident reporting procedures and escalation paths.

Training is reviewed and updated at least annually, and whenever significant regulatory or technical developments occur. Completion records are maintained and available for audit.

8. Coordination with GDPR

Our AI Policy operates alongside and in full coordination with our Data Protection Policy (GDPR). The two frameworks are complementary:

— Personal data used to train or operate AI systems is processed only on a lawful basis and subject to appropriate data minimisation, purpose limitation, and retention controls.
— Data Protection Impact Assessments (DPIAs) are conducted for AI systems that are likely to result in high risk to individuals' rights and freedoms.
— Our Data Protection Officer (DPO) is involved in the review and approval of all high-risk AI initiatives.
— Subject access requests, erasure requests, and other data subject rights are honoured within legally required timeframes, including where AI systems have processed personal data.

For any questions regarding the intersection of AI and personal data, please contact our team.

9. Contact

For any questions, concerns, or requests related to our AI policy, risk management practices, or the exercise of your rights, please contact us at:

info@certitrue.com

We aim to respond to all enquiries within 15 business days.