Skip to content

Cloud Legion policies

Artificial Intelligence Policy

Approved by Cloud Legion’s General Management

Purpose

This policy sets out the governance framework under which Cloud Legion develops, implements, manages and uses artificial intelligence (AI), based on the principles of transparency, privacy by design, proportionality, comprehensive security and continual improvement. Senior management promotes the responsible and ethical adoption of AI and provides the resources needed to manage it within our security and privacy frameworks.

Its objectives are:

  • Transparency and traceability: clear processes to understand how AI systems work and the criteria they use to decide, making audits and reviews easier.
  • Reliability and security: minimize risks and ensure systems work as intended, protecting data and the robustness of models against attacks or failures.
  • Ethics and legal compliance: respect people’s rights, including privacy, non-discrimination and human rights.
  • Performance and efficiency: continuously monitor and improve system performance.
  • Data-driven decisions: support informed, accurate decisions that create value.
  • Innovation and continual improvement: update systems as technology and the market change.
  • Social responsibility: ensure the use of AI benefits society, builds trust and minimizes negative impacts.

Scope and reference framework

It applies to all Cloud Legion areas and team members who interact with AI technologies or take part in the life cycle of the data they use, including consulting, maintenance, operation, support and implementation services for technology solutions, including AI-based ones, for public and private organizations. It covers the AI systems we provide and use throughout their life cycle, from design and development to deployment, monitoring and retirement.

Our Artificial Intelligence Management System (AIMS) is certified under ISO/IEC 42001:2023 and integrated with our security (ISO/IEC 27001) and privacy (ISO/IEC 27701) systems. We comply with the legislation of each country where we operate, in particular Law 25,326 in Argentina and the LGPD in Brazil, and we use the European Union’s Artificial Intelligence Act (Regulation (EU) 2024/1689) as a reference where relevant.

Governance

Cloud Legion has a multidisciplinary AI Ethics and Governance Committee, made up of:

  • Chief AI Officer (CAIO): primarily responsible for the AIMS and for compliance with this policy.
  • Chief Information Security Officer (CISO): integrates security and cybersecurity principles into AI systems.
  • Chief Privacy Officer (CPO): ensures AI activities comply with privacy standards.
  • Legal: advises on regulatory and ethical compliance.
  • Services area: aligns AI services with strategic objectives.

The Committee sets the strategic guidelines for the use of AI; assesses, prioritizes and approves every AI project or service before it goes into production; oversees its ethical, regulatory and transparency compliance; and manages its risks. Every AI system undergoes an ethical and risk impact assessment before development and again before deployment, covering bias, data protection, transparency and impact on people. An annual internal audit reviews the security, privacy and effectiveness of the systems in use.

Management commitment

Management commits to promoting security and privacy roles and responsibilities in the AIMS, providing the necessary resources, raising awareness, requiring compliance with the policy and the law, considering ethical and privacy risks in its decisions, overseeing privacy by design and by default, promoting the explainability of systems, and continuously monitoring their ethical and privacy impacts.

Ethical use

  • Non-discrimination: we design and train systems to avoid unfair bias based on gender, ethnicity, religion, sexual orientation, disability or other protected characteristics, and we assess bias regularly.
  • Human rights: AI must respect people’s privacy, freedom of expression and dignity, and is not used for purposes that compromise their safety or freedom.
  • Privacy: training data follows the principle of minimization and is managed under our Privacy Policy; it is anonymized and encrypted where appropriate, and sensitive data is not used without proper consent.
  • Prohibited uses: using AI to manipulate information, for non-consensual invasive surveillance or for any harmful purpose or one contrary to our values is prohibited.
  • Oversight: the Committee oversees the ethics of all systems, and every violation or incident is reported and managed.

Transparency and human oversight

  • We build explainable systems where their use requires it, so that their results can be understood.
  • We clearly inform clients and team members when they are interacting with an AI system, what data it processes and how it makes decisions.
  • We disclose the use of personal data in AI systems, and data subjects can exercise the rights granted to them by applicable law.
  • Automated decisions that directly affect people can be reviewed by a human, and our clients can ask for an explanation and a review of those decisions.
  • We communicate the risks and benefits of using AI to stakeholders.

Data privacy and security

AI systems follow the guidelines of our Privacy Policy. Before developing or deploying an AI system that uses personal data, we carry out a privacy impact assessment. We collect only the data needed and review annually that its use remains necessary and proportionate; we apply anonymization and, where that is not possible, pseudonymization; we encrypt data at rest and in transit, control access by role and apply secure retention and deletion policies. If a security incident occurs, we activate our response plan, with timely notification to those affected and to the competent authorities, and we have backup and disaster recovery in place.

Risk management

We maintain a specific framework to identify, assess and mitigate AI risks throughout the life cycle, aligned with privacy and security by design. We pay particular attention to algorithmic bias, incorrect or unexplainable decisions, privacy violations and social and ethical impact. Each risk is assessed by likelihood and impact in a risk matrix, and for each one we define mitigation plans, such as additional controls, ethical reviews, data balancing techniques and rigorous testing before production.

Secure development and validation

  • Data: we use relevant, reliable data reviewed to reduce bias, with minimization and periodic reviews of its quality and source.
  • Training: in secure, monitored environments, with separate training, validation and test sets, and bias reduction techniques.
  • Testing: accuracy and robustness testing with adverse or unexpected data, measured with metrics such as precision, sensitivity, specificity and error rate, plus security and penetration testing of the systems that interact with the model.
  • Pre-deployment audit: verifies compliance with security, privacy and accuracy requirements and with applicable law.
  • Deployment and monitoring: deployment under security controls and continuous tracking with performance indicators.

AI cybersecurity

  • We simulate adversarial attacks during testing and train models to withstand malicious inputs.
  • We monitor production systems to detect suspicious input patterns, with automatic alerts.
  • We protect the integrity of the data feeding the models with encryption and integrity checks.
  • We restrict access to models and data with role-based access control and multi-factor authentication in development and production, log activities and review permissions periodically.

Compliance and audits

We carry out periodic internal or external audits of our AI systems’ compliance with applicable laws and standards, and review our systems and policies when regulations change. We maintain our ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certifications through the audits each standard requires.

Training and awareness

We continuously train staff who develop, operate or oversee AI systems in secure development, data management, risk mitigation, applicable regulations and ethical use, and run awareness campaigns for all staff, with internal channels to raise questions or report misuse or bias.

Social and human rights impact assessment

Before deploying an AI system we assess how it could affect different groups, including the risks of exclusion, discrimination and impact on employment, and we analyze human rights risks in systems that affect people. When we identify significant risks, we mitigate them before deployment, for example through human oversight or greater transparency.

Reporting and whistleblowing channels

We document and monitor the development and operation of AI systems, including audit results. Team members have a confidential internal channel managed by the AI Committee, and clients and third parties can confidentially report any issue they believe affects their rights or the principles of this policy by writing to grc@cloudlegion.com.ar.

Accountability and continual improvement

The AI Committee oversees the AIMS, and each area involved appoints someone responsible for compliance. Any failures detected lead to corrective actions. This policy is reviewed at least once a year, or sooner in the face of emerging risks or regulatory changes, with input from security, privacy, legal and development, and changes are communicated to team members, suppliers and partners. We promote responsible innovation: every new AI solution goes through an ethical review before it is adopted.