AI Ethics Framework

This framework sets Tanqory’s AI principles, controls, and governance to ensure AI is safe, transparent, fair, respects human rights, and aligns with applicable laws/standards.

1) Scope and Definitions

Applies to all Tanqory AI systems/models/features from design, development, training, testing, deployment, monitoring, to decommissioning, including personnel, partners, suppliers, and external processors. “AI” includes ML, Generative AI, recommendation/ranking, decision automation, and agents/chatbots. “Training data” means data used to develop/tune/evaluate models. “Human Oversight” means human approval/review/override before material impact. “High‑risk” refers to use cases impacting fundamental rights, safety, or access to financial/payment services, aligned with internal definitions and EU AI Act Title III. Read with Privacy Policy, DPA, Security Policies, Acceptable Use Policy, and Incident Response Playbook; if conflicts arise, the more specific/mandated document controls. External models must undergo risk assessment and data agreements before use. This framework binds employees and contractors involved with AI and will update promptly when new AI laws take effect.

2) Core Ethical Principles

AI decisions affecting rights or account status require Human Oversight and appeal paths. Users must know when interacting with AI; provide Model Cards. Ensure transparency, explainability, bias testing pre/post release with suitable fairness metrics, mitigation plans, and guardrails. Test safety, defend against prompt injection/data poisoning, and provide fallbacks. Apply data minimization, role‑based access, retention per policy, and consider DP/Federated Learning where appropriate. Every model must have an owner/approval workflow and logs/traceability for audit/appeal. Use resources responsibly and reduce environmental impact. If principles conflict, prioritize safety, human rights, and law. Document and audit measures; align with emerging standards (e.g., ISO/IEC 42001, NIST AI RMF) as updated.

3) AI Risk Classification

• Four levels: Unacceptable (forbidden), High‑risk, Limited‑risk, Low‑risk, referencing EU AI Act and internal criteria.
• Forbidden: manipulative AI targeting vulnerable users to cause harm; discriminatory social scoring; real‑time biometric ID in public (unless legally mandated); rights‑violating predictive policing; illegal content generation/propagation.
• High‑risk (examples): account suspension/compliance holds; fraud detection; credit/underwriting; content moderation affecting market access; automated KYC/identity verification.
• Limited‑risk: chatbots/assistants; recommendation/ranking; AI content generation without material rights impact (must inform users and allow opt‑out where feasible).
• Low‑risk: non‑personal analytics/insights or internal aids without rights impact.
• Record classification and rationale in AIIA/approval docs.
• External models (API/hosted) must be risk‑assessed by use context, not provider name.
• Re‑classify before use if context changes (e.g., applied to eligibility/credit decisions).
• Check obligations in regulated regions (e.g., EU AI Act roles as Provider/Deployer) and comply accordingly.
• Risk level changes require AI Ethics Committee approval.

4) Governance and Roles

• AI Ethics Committee (CTO, CLO, DPO, Head of AI/ML, Trust & Safety, external reps as needed): approves/blocks high‑risk AI; reviews quarterly or upon major events.
• Model owner/steward: accountable for maintenance, Model Card, explanations/appeals.
• Legal/Compliance/DPO: contracts/data rights; DPIA/AIIA; cross‑border transfer; Provider/Deployer role duties.
• Security/Trust & Safety: guardrails; red‑team/pentest; incident playbooks.
• Data Office: data minimization/retention/quality; access control.
• Leadership/Board: receives material AI risk reports at least annually; approves core policies.
• Reporting cadence: Committee quarterly; Board at least annually; Enterprise customers (if agreed) receive drift/bias/incident summaries quarterly or per SLA.
• All roles complete annual (or pre‑access) training on AI ethics/safety/law; violations may trigger discipline/contract remedies.
• Record meetings/approvals/denials for audit.

5) Lifecycle and Impact Assessment (AIIA)

• Use AIIA for High‑risk and any use impacting rights/safety/access to financial services. Steps: (1) Purpose/scope/affected users; (2) Data: source/quality/minimization/rights/contracts; (3) Model: training/testing, metrics, limits, explainability; (4) Bias & Fairness: protected groups, tests/mitigations; (5) Privacy & Security: DP, pseudonymization, access control, attack resistance; (6) Human Rights & Societal/Environmental Impact; (7) Monitoring/rollback/fallback; (8) Comms/labeling/appeals.
• Review AIIA pre‑release and after major incidents or drift. Retain AIIA for the model’s lifecycle plus legal/contractual periods.
• High‑risk requires Human‑in‑the‑Loop/On‑the‑Loop as appropriate.
• If law mandates (e.g., EU AI Act Title III), prepare technical docs, logging, post‑market monitoring, and serious incident reporting.
• Deployers complete FRIA/DPIA where required (e.g., EDPB/ICO guidance).
• For new markets, rerun AIIA/DPIA if legal/risk profile differs.
• Use harmonized controls (ISO/IEC 42001, NIST AI RMF) to demonstrate conformity.
• Assign owners/timelines for assessment actions.
• Use standard templates (AIIA/Model Card/Incident Playbook) for consistency and audit readiness.

6) Data and Training

• Lawful purpose, consent where needed, and respect for rights (access, erasure, objection) per Privacy Policy/DPA.
• Data minimization; prefer anonymized/pseudonymized data when possible.
• Ensure legal rights to data sources (copyright/contract); avoid violating use/distribution limits.
• Apply leakage protections (e.g., Differential Privacy for sensitive sets) and defend against inversion/membership inference.
• Control access to training data/models/artifacts via RBAC/ABAC and log access.
• Follow Data Retention Policy and regional legal requirements for retention/deletion.
• Vet third‑party/partner data for accuracy, quality, and usage rights.
• If using synthetic data, ensure it does not expose real data or amplify bias.
• Scrutinize data relating to children/vulnerable groups; use only under applicable legal frameworks.
• Retain evidence of consent/withdrawal when personal data is used to train/tune models.

7) Transparency, Notices, and User Rights

• Disclose AI use or AI‑generated content at clear touchpoints (“AI‑generated”/“AI‑assisted”).
• Maintain Model Cards with purpose, limits, metrics, oversight, and prohibited uses.
• Provide appeal/explanation channels for decisions affecting rights (e.g., account suspension, transaction denial, ranking affecting market access).
• Support data subject rights (access, deletion, objection, restriction) with defined SLAs.
• Allow user/merchant controls to adjust or disable AI features where safe/legal.
• Offer reporting/remediation for AI profiles/content; enable corrections where feasible.
• Automated decisions with legal/significant effects require human review and clear appeals.
• Disclose key third‑party models/providers if they materially affect users.
• Notify significant changes (e.g., core model/provider changes) via dashboard/email (durable medium).
• Where specific legal notices are required (e.g., EU AI Act transparency, CPRA Do Not Sell/Share), display them in relevant products.

8) Human Oversight, Testing, and Robustness

• High‑risk use: Human‑in‑the‑Loop/On‑the‑Loop with defined override criteria.
• Pre‑release testing: accuracy, safety, bias/fairness, adversarial, penetration aligned to system risk.
• Post‑release monitoring: drift detection, performance decay, bias re‑checks, anomaly detection, retrain plans.
• Guardrails for GenAI: prompt/output filtering, safety/NSFW/PII detection, rate limiting.
• Provide fallback/rollback if models fail or raise safety/fairness concerns.
• Log inferences/decisions sufficiently for audit/appeal (respecting data laws).
• Red‑team/adversarial testing periodically (at least annually for high‑risk) and after major updates.
• Maintain AI incident playbooks (policy‑violating output, harmful content, erroneous decisions).
• Set model SLOs/SLAs and notify when SLOs are breached.
• Check model supply chain (dependencies, embeddings, third‑party APIs); maintain SBOM/Model BOM if used.
• Set drift/bias re‑check cadence (e.g., monthly for high‑risk, quarterly for limited‑risk) and log results.
• Strictly segregate sandbox/test vs. production; use synthetic/pseudonymous data in non‑prod; do not pull production personal data into test without minimization and approval.
• For Foundation/GenAI, adopt transparency/watermarking/content provenance (e.g., C2PA) where feasible; record source model/version and tools used for watermarking/metadata, noting known limitations.

9) Incidents, Reporting, and Mitigation

• AI incidents (policy‑violating outputs, harmful bias, model data leaks, successful prompt injection) must be reported via incident channels within 24 hours of awareness.
• Incident Response/AI Ethics Committee assesses severity and decides rollback/pause per playbook SLAs.
• If law requires (e.g., “serious incident” under EU AI Act when effective), report to regulators within required timelines and notify affected users if mandated.
• Communicate via durable medium with incident summary, mitigations, and recovery timeline.
• Perform post‑incident review/lessons learned with owners, deadlines, and updates to models/processes/policies.
• If personal data is involved, follow Data Breach Policy and statutory breach‑notice rules (PDPA/GDPR/CPRA).
• Retain logs/evidence for legally/contractually required periods.
• Update AIIA/Model Card/docs after material incidents.
• Provide complaint/appeal channels for affected users.
• Investigate partners/suppliers if external components caused the incident and enforce contractual remedies.
• For EU AI Act “serious incidents” (once effective), report to the national authority “without undue delay” and no later than 15 days after becoming aware, and adjust SLA/reporting formats to match implementing acts when finalized.