AI Governance Policy

Purpose

It ensures that AI systems align with legal, regulatory, and ethical standards, fostering trust, accountability, and fairness while mitigating risks associated with AI-driven decisions. This policy is designed to support ISO/IEC 27001:2022, ensuring AI security, risk management, and compliance with data protection, access control, and incident response requirements.

Scope

This policy applies to all AI systems developed, deployed, or procured by FEHA, including:

• AI-driven decision-making tools and automated processes.
• Machine learning applications handling customer or internal data.

It applies to all personnel and third-party vendor engaged in AI-related activities.

Roles & Responsibilities

Business Strategy

AI systems are developed and deployed to support FEHA's strategic objectives, particularly AI adoption is driven by defined business needs, measurable value, and regulatory alignment.

Organizational Values and AI Risk Context

FEHA defines the amount of risk it is willing to pursue or retain when using AI systems, in alignment with its organizational values and risk culture. This risk assessment guides decisions related to the design, development, deployment, and operation of AI systems, particularly where AI may impact compliance outcomes, decision-making processes, users, or regulated activities. FEHA conducts AI Risk Assessments and Impact Analyses throughout the AI lifecycle to identify, assess, and mitigate risks related to bias, security, privacy, reliability, and regulatory compliance.

Each AI system is evaluated to determine its inherent and residual risk level, considering the system's purpose, degree of automation, data sensitivity, potential user impact, and regulatory exposure.

AI risks are further assessed within FEHA's broader operational, regulatory, and threat environment, including evolving regulations, cybersecurity threats, and changes in business operations or technology.

AI Governance Principles

FEHA adheres to the following core principles for AI governance:

• Fairness & Non-Discrimination: AI models must be designed to eliminate bias and ensure fair outcomes.
• Transparency & Explainability: AI systems must be documented, auditable, and interpretable.
• Accountability & Oversight: AI decision-making must be traceable with clear governance structures and assigned responsibilities.
• Privacy & Security: AI models must adhere to industry standards for data security and privacy, ensuring encryption, anonymization, and controlled access.
• Human Oversight & Control: AI must augment human decision-making, with humans retaining the final authority over high-risk governance and compliance decisions.
• Continuous Risk Management: AI systems must be regularly tested, monitored, and updated to detect vulnerabilities and compliance risks.

AI Model Lifecycle

FEHA follows a structured AI model lifecycle to ensure transparency, security, fairness, and compliance throughout AI system development and deployment. The AI lifecycle consists of the following key phases:

Problem Definition & Feasibility Assessment

• Identify the business use case for AI, ensuring alignment with FEHA's compliance and security objectives.
• Conduct an AI feasibility analysis, assessing potential bias, ethical concerns, and regulatory implications.

Data Collection & Preprocessing

• Ensure data used for AI training is accurate, relevant, and bias-free.
• Apply data anonymization, encryption, and access control to protect sensitive information.
• Maintain compliance with AI-related data protection standards.

Model Development & Training

• Develop AI models using secure coding best practices and robust validation techniques.
• Implement bias detection mechanisms to identify and mitigate unfair outcomes.
• Ensure model explainability and interpretability to enhance transparency and accountability.

Testing and Validation

• Conduct extensive testing and validation to verify model accuracy, reliability, and security.
• Perform regular bias audits to detect unintended discrimination in decision-making processes.

Deployment & Monitoring

• Deploy models in secure cloud environments with controlled access.
• Continuously monitor AI systems for performance drift, adversarial attacks, and security risks.
• Implement real-time logging and alerting mechanisms for AI anomalies.

Model Updates, Retirement & Compliance Review

• Periodically retrain AI models to maintain relevance, accuracy, and compliance.
• Decommission outdated AI models securely, ensuring proper data sanitization.

FEHA ensures that AI models are continuously improved, securely maintained, and ethically governed throughout their lifecycle.

AI Risk Management

To ensure AI security and compliance, FEHA will:

• Assess AI risks before deployment, evaluating bias, security vulnerabilities, and regulatory risks.
• Establish an AI incident response process to address ethical concerns or model failures.
• Ensure AI solutions comply with AI governance and frameworks standards.

Reporting AI Concerns

All users, customers, partners, contractors, and other stakeholders are encouraged to promptly report any AI-related concerns, including but not limited to:

• Unexpected, unintended, or harmful AI behavior.
• Biased, discriminatory, or unfair outputs.
• Inaccurate, misleading, deceptive, or unsafe responses.
• Suspected privacy, security, or confidentiality incidents, including exposure of personal data or sensitive information.
• Unauthorized access or misuse of AI systems.
• Suspected non-compliance with applicable laws, regulations, contractual obligations, or organizational AI governance requirements.

Reporting Channels

AI-related concerns may be reported through the appropriate communication channels or by contacting our Data Protection Officer (DPO) at privacy@feha.io. Reports should include, where possible, the affected AI system, a description of the issue, and any supporting evidence.

All reported concerns are logged, assigned a unique reference, and tracked throughout investigation, remediation, and closure. Anonymous reporting may be accepted where applicable.

AI Compliance Enforcement

FEHA ensures strict compliance with AI governance through continuous monitoring, risk assessments, and corrective actions when necessary.

• AI Compliance Monitoring: AI systems will be regularly monitored to verify adherence to governance, security, and ethical guidelines.
• Regulatory Compliance Checks: AI deployments must comply with applicable regulations.
• Incident Handling & Remediation: Any AI-related risks, bias detections, or compliance failures must be reported for review and corrective action.
• Non-Compliance Consequences: Violations of AI governance policies may result in:
  • Corrective Actions: Required adjustments to AI models, retraining, or process improvements.
  • Access Restrictions: Temporary or permanent revocation of access to AI tools and data.
  • Disciplinary Measures: Severe or repeated violations may lead to internal sanctions, including role reassignment or personnel termination.

FEHA is committed to ensuring AI compliance remains proactive, risk-aware, and aligned with industry best practices.