Artificial Intelligence Governance Policy
PURPOSE
The purpose of this Policy is to establish the organization’s AI governance principles for the responsible acquisition, development, deployment, use, and commercialization of Artificial Intelligence (AI).
The organization recognizes AI as a technology that can enhance productivity, innovation, decision-making, and the delivery of high-quality services when used appropriately.
This Policy provides the organization’s high-level AI governance framework by defining the principles for the responsible acquisition, development, deployment, use, and commercialization of AI.
Operational controls, approval processes, validation activities, risk assessments, monitoring requirements and other implementation details are defined within the applicable Standard Operating Procedures (SOPs) and the Integrated Management System (IMS) documents.
SCOPE
This Policy applies to all personnel acting on behalf of the organization, including employees, contractors and authorized third parties.
It applies to:
Use of AI systems within the organization.
AI systems embedded within third-party products or services.
Development, deployment, or substantial modification of AI-enabled solutions.
Delivery of AI-enabled solutions to customers.
Recommendation, referral, or commercialization of AI-enabled solutions.
Specific governance and validation requirements applicable to each scenario shall be defined through the relevant organizational procedures.
For the purposes of this Policy, AI-enabled solutions include products or services that incorporate AI capabilities and are developed, integrated, or commercialized by the organization.
ROLES AND RESPONSIBILITIES
CEO with the support of the Digital Steering is responsible for:
Approving this Policy.
Promoting the responsible use of AI.
Supporting the implementation of appropriate governance measures.
Providing adequate resources for AI governance.
Ensuring appropriate AI literacy and awareness across the organization, taking into account employees’ roles, responsibilities and the context in which AI is used.
Employees and Authorized Users of AI are responsible for:
Using AI responsibly and professionally.
Using approved AI systems where required by organizational policies.
Applying appropriate professional judgment and human oversight when using AI in accordance with the intended use and applicable organizational procedures.
Complying with applicable organizational policies and procedures.
Reporting suspected misuse, security concerns, or AI-related incidents through established organizational channels.
Information Technology, Information Security and Data Protection functions are responsible for supporting the secure and compliant adoption of AI by:
Providing governance, security and compliance guidance.
Defining approved AI systems where applicable.
Assessing AI-related risks within their respective responsibilities.
Supporting compliance with applicable legal, regulatory and contractual obligations.
AI GOVERNANCE PRINCIPLES
The organization adopts the following AI governance principles:
Human Accountability and Oversight:
AI shall be used, developed and deployed under appropriate human accountability and oversight. Professional expertise, judgment and accountability shall remain with appropriately qualified personnel.
Human oversight shall be applied as appropriate, considering the nature of the AI use, its potential impact and applicable legal, regulatory, quality and customer requirements.
Responsible, Secure and Ethical Use:
AI shall be used responsibly, securely, and ethically, protecting the confidentiality, integrity, and availability of information while fostering innovation and adhering to the organization’s AI Ethical Principles.
Privacy and Data Protection:
Personal data, confidential and customer information shall be processed in accordance with applicable legislation, contractual obligations, and organizational policies.
AI systems shall be used in a manner that protects information throughout its lifecycle.
Transparency and Risk Management:
The organization promotes the responsible and transparent use of AI where appropriate.
AI-related risks shall be identified, assessed, and managed proportionately to their intended use, potential impact, and applicable legal, regulatory, and organizational requirements.
Compliance and Good Practice:
The organization is committed to complying with applicable legal, regulatory, and contractual obligations governing the use of AI and to aligning its AI governance practices with recognized international standards and industry best practices, where appropriate.
Continuous Improvement:
The organization is committed to continually improving its AI governance practices in response to technological, regulatory, and organizational developments.
INFORMATION AND DATA PROTECTION
The use of AI systems shall comply with the organization’s information security, data protection, and information classification requirements.
Information submitted to AI systems shall be handled according to its classification and in accordance with applicable organizational procedures.
Where organizational or customer information is processed using AI systems, only authorized AI systems shall be used where required by organizational policies, contractual obligations, or applicable regulations.
The organization seeks to use AI systems that provide contractual assurances that organizational and customer information will not be used to train foundation models unless explicitly authorized and supported by appropriate contractual, legal, and technical safeguards.
Detailed requirements regarding information classification, acceptable use, supplier management, information security, and data protection are defined in the corresponding organizational procedures.
GOVERNANCE FRAMEWORK AND COMPLIANCE
This Policy forms part of the organization’s governance framework and shall be implemented in conjunction with the Integrated Management System (IMS).
The organization is committed to complying with applicable legal, regulatory, and contractual obligations governing the use of AI. The organization also seeks to align its AI governance practices with recognized international standards and industry best practices, including but not limited to:
General Data Protection Regulation (GDPR)
European Union Artificial Intelligence Act (EU AI Act)
ISO/IEC 42001 – Artificial Intelligence Management Systems
ISO/IEC 27001 – Information Security Management Systems
Applicable Computerized System Validation (CSV) principles
RELATED DOCUMENTS
This Policy shall be communicated in conjunction with the organization’s Integrated Management System (IMS) and the applicable policies, procedures and work instructions governing the use of Artificial Intelligence, including but not limited to:
AI Ethical Principles
Information Security Policy
Information Classification and Use SOP
Asphalion, S.L.
Tarragona 151–157, Planta 11 Bloque A
08014 Barcelona, Spain
Document reference: P.04.01 – Artificial Intelligence Governance Policy
Effective date: 15 October 2026
