1. Scope of Our AI Management System (AIMS)

Digisoul’s AIMS applies to all AI-related activities, solutions, and services
that we design, implement, host, or manage, whether for our own use or for clients.

1.1 Services & Solutions in Scope

• AI-Powered Marketing & Personalization:
  Recommendation engines, dynamic content, segmentation, and automation flows.
• AI Content, SEO & AEO Systems:
  Tools and workflows that generate, optimize, or analyze content for search and
  answer engines.
• AI-Enhanced Websites & Experience Layers:
  Intelligent sites, chatbots, forms, personalization widgets, and analytics-driven UX.
• AIOps & Automation Frameworks:
  Orchestrations that use AI/ML or LLMs for monitoring, enrichment, routing,
  anomaly detection, or decision support.
• AI Training & Advisory:
  Programs and playbooks where Digisoul recommends or configures AI tools,
  governance models, or automation strategies for clients.

1.2 Assets & Activities Covered

• AI models (first-party where applicable) and configurations of third-party models.
• Prompt libraries, workflows, and orchestration logic we design or deploy.
• Data pipelines feeding AI systems (including logs, events, customer and content data)
  where Digisoul has design or operational influence.
• Processes for vendor selection, risk assessment, testing, deployment,
  monitoring, incident handling, and decommissioning of AI-powered solutions.

Client-managed AI systems fully outside Digisoul’s control fall outside this AIMS
but are considered in our consulting guidance and risk advisories.

2. Our AI Governance Principles

Our AIMS is built on clear, operational principles that guide every AI use case:

• Lawful & Compliant:
  We design AI to comply with applicable laws and industry standards,
  including data protection, consumer protection, IP, accessibility,
  and advertising rules.
• Human-Centric & Beneficial:
  AI must enhance human decisions and experiences, not replace accountability
  or exploit vulnerabilities.
• Privacy & Data Minimisation:
  Only the minimum necessary data is processed; personal data is protected
  using appropriate technical and organisational measures.
• Fairness & Non-Discrimination:
  We assess AI use cases for potential bias and take steps to prevent
  discriminatory outcomes in design, training, and deployment.
• Transparency & Explainability:
  We aim to give clients and end-users meaningful information about when
  and how AI is used, the purpose it serves, and its limitations.
• Security & Robustness:
  AI systems must be resilient against misuse, adversarial prompts, data
  leaks, and unintended behavior.
• Accountability:
  Clear owners are assigned for AI systems, decisions, and risk controls.
  “The system did it” is never an acceptable justification.
• Continuous Improvement:
  Controls, models, prompts, and policies are monitored, reviewed, and
  improved using a structured feedback loop.

3. Governance Structure & Accountable Roles

Digisoul operates a layered AI governance model to ensure decisions are owned,
traceable, and auditable.

3.1 AI Governance Council (AIGC)

A cross-functional council that provides strategic direction and oversight
for all AI initiatives.

• Approves AIMS scope, policies, and key AI use cases.
• Reviews AI risk reports, incidents, and continuous improvement actions.
• Ensures alignment with Digisoul’s mission, legal obligations, and partner expectations.

3.2 AIMS Lead / AI Governance Lead

• Day-to-day owner of the AIMS framework.
• Coordinates risk assessments, lifecycle controls, and internal audits.
• Reports status and issues to the AI Governance Council.

3.3 Product & Solution Owners

• Own specific AI-enabled offerings (e.g. marketing automation, AI content engines, AI UX layers).
• Ensure each solution complies with this Policy and approved risk level.
• Maintain documentation: use case description, data flows, vendors, controls.

3.4 Data Protection & Security Leads

• Evaluate privacy, security, and data residency implications of AI use.
• Review data processing agreements and technical safeguards with vendors.
• Support incident response for AI-related security or privacy events.

3.5 Delivery & Engineering Teams

• Implement AI systems according to approved designs and controls.
• Apply secure development, testing, and monitoring practices.
• Log issues, anomalies, and improvement opportunities.

3.6 Partners & Suppliers

• Are expected to adhere to equivalent responsible AI standards.
• Undergo selection and review processes aligned with this AIMS.

4. Alignment with ISO/IEC 42001 & the PDCA Cycle

Digisoul structures its AIMS following the Plan–Do–Check–Act (PDCA)
methodology used in ISO management system standards, including ISO/IEC 42001.
This policy is not a substitute for the standard; it is our operational expression of it.

4.1 Plan

• Define AI strategy, objectives, and risk appetite.
• Identify internal/external requirements (laws, standards, client obligations).
• Maintain an AI Systems & Use Case Register with owners and risk levels.
• Establish policies on data, vendors, security, ethics, and lifecycle.

4.2 Do

• Design and implement AI solutions according to approved requirements.
• Apply secure development and privacy-by-design principles.
• Train teams on responsible AI and AIMS procedures.

4.3 Check

• Monitor AI system performance, safety, and compliance.
• Conduct internal reviews and spot-checks on high-impact use cases.
• Track incidents, complaints, and non-conformities.

4.4 Act

• Update models, prompts, configurations, and processes based on findings.
• Adjust policies, controls, and training where gaps are found.
• Continuously improve the AIMS to reflect new risks, regulations, and technologies.

5. AI Risk & Safety Framework

Our AI Risk & Safety approach ensures every AI initiative is evaluated and
controlled proportionately to its potential impact on people, clients, and partners.

5.1 Risk Identification & Classification

• Each AI use case is documented: purpose, users, data sources, decisions influenced.
• We evaluate potential impacts on:
  • Privacy and confidentiality
  • Fairness and discrimination
  • Security and misuse
  • Content integrity and reputation
  • User autonomy and vulnerable groups

5.2 Typical Controls

• Data controls:
  minimisation, masking, aggregation, access controls, retention limits.
• Technical controls:
  guardrails on prompts, filtering, rate-limiting, environment isolation,
  logging and monitoring.
• Organisational controls:
  approvals for high-impact use cases, segregation of duties, documented SOPs.
• Human oversight:
  human review required wherever outputs materially affect individuals or
  business-critical decisions.
• Vendor due diligence:
  security, privacy, compliance, model behavior assurances where feasible.

5.3 Incident Management

AI-related issues (e.g. harmful outputs, security incidents, major bias indicators)
are treated as formal incidents:

• Logged in our internal tracking system.
• Assessed for severity, root cause, and required remediation.
• Escalated to the AI Governance Council and, where applicable, clients or authorities.

6. How We Design, Test & Monitor Our AI Systems

This section summarises how Digisoul turns governance into concrete lifecycle
practices across AI use cases. It applies to both our internal solutions and
client projects where we have design influence.

6.1 Use Case Intake & Gating

• Every AI initiative starts with a documented use case:
  objectives, users, data, impact, success metrics.
• We reject or redesign use cases that:
  • Lack a lawful basis or clear value.
  • Target vulnerable groups in manipulative ways.
  • Conflict with our ethical principles or client obligations.

6.2 Data Governance by Design

• Identify data categories (personal, sensitive, behavioural, content, logs).
• Prefer pseudonymised or aggregated data where possible.
• Ensure contracts and consents cover intended AI processing.
• Restrict access to training and operational data on a need-to-know basis.

6.3 Model & Vendor Selection

• Select cloud/LLM providers and tools that meet security and privacy expectations.
• Evaluate:
  • Documented safeguards against misuse and bias.
  • Data usage terms (no unauthorised training on client data).
  • Regional/legal compatibility where data residency matters.

6.4 Design & Implementation

• Apply modular architectures so AI components are controllable and auditable.
• Use prompt patterns and workflows with:
  • Explicit instructions on safety, privacy, and tone.
  • Constraints on disallowed content and actions.
• Tag AI-generated content or decisions where appropriate in client journeys.

6.5 Testing & Validation

• Scenario-based testing:
  • Edge cases, stress conditions, adversarial prompts.
  • Language and cultural contexts relevant to our clients.
• Quality checks:
  • Accuracy against ground truth where available.
  • Consistency with brand, compliance, and ethical rules.
• Bias & harm checks proportional to the use case:
  • Look for systematically skewed or harmful outputs.
• Security & privacy checks:
  • Leakage risks, prompt injection resilience, access controls.
• Only after successful validation can a solution move to production.

6.6 Monitoring in Production

• Log key interactions and system behavior in compliance with privacy rules.
• Track defined KPIs, such as:
  • Output quality / relevance.
  • Error and override rates (how often humans correct AI).
  • Safety flags, user complaints, anomalous usage.
• Run periodic sample reviews to detect drift, bias, or misuse.
• Update or roll back configurations when thresholds are breached.

6.7 Decommissioning & Change Management

• Retire AI components through a controlled process:
  documentation, client notification (where applicable), and secure data handling.
• All major changes (models, providers, logic) follow documented change control
  with impact assessment.

7. Documentation, Training & Continuous Improvement

• Maintain internal records for AI systems, assessments, approvals, and incidents.
• Provide periodic training on AIMS, data protection, and ethical AI to relevant teams.
• Conduct internal reviews of the AIMS at least annually or after major changes.
• Refine controls based on lessons learned, client feedback, and regulatory updates.

8. Governance Contacts

For questions about this AI Governance & AIMS Policy, or to raise concerns
related to Digisoul AI systems, please contact:

• AI Governance & AIMS:
  aims@digisoul.io
• Privacy & Data Protection:
  privacy@digisoul.io
• Ethics & Social Responsibility:
  ethics@digisoul.io

Last updated: 8th of Nov 2025