SOP-LIST-01-AI_AI-IRB-Governed-AI-SDLC

Comprehensive SOP List: AI-IRB Governed AI-SDLC

1. SOP-1000-01-AI: AI-Integrated Program/Project Management

   Purpose: Defines how program and project management activities integrate AI-IRB touchpoints, ensuring alignment with AI ethics, regulatory compliance, and stakeholder requirements.

   Key Points:

   • Clarifies roles and responsibilities for AI-related tasks.
   • Describes program charter creation, milestone tracking, risk management.
   • Establishes processes for obtaining AI-IRB approvals at critical points.
2. SOP-1001-01-AI: Document Governance and AI-IRB Compliance

   Purpose: Governs the creation, review, revision, and archiving of documents, ensuring AI-IRB compliance and alignment with regulatory requirements.

   Key Points:

   • Document control procedures (versioning, approval matrix).
   • AI-IRB mandated sign-offs for changes.
   • Secure document repository and retention rules.
3. SOP-1002-01-AI: Capacity Management (AI-Integrated)

   Purpose: Outlines methods to forecast, allocate, and manage compute and data capacity for AI solutions, factoring in ML model training and inference workloads.

   Key Points:

   • Resource usage tracking for training/inference.
   • Monitoring of AI load to ensure system reliability.
   • Threshold-based triggers for additional resources.
4. SOP-1003-01-AI: Configuration Management

   Purpose: Ensures consistent configuration of AI system components (models, data pipelines, supporting infrastructure).

   Key Points:

   • Baseline tracking of model versions, datasets, dependencies.
   • Version control guidelines for code, AI model artifacts.
   • Procedures for controlled changes and rollbacks.
5. SOP-1004-01-AI: Procurement and Purchasing for AI-Enabled Systems

   Purpose: Standardizes the acquisition process for AI hardware, software, external datasets, and consulting services.

   Key Points:

   • AI-IRB screening for potential ethical or compliance issues in new tools.
   • Vendor due diligence for bias and data privacy compliance.
   • Ensures budget approvals align with project scope.
6. SOP-1005-01-AI: AI-Integrated Release Planning

   Purpose: Integrates AI roadmaps and iteration cycles into the standard SDLC release planning.

   Key Points:

   • AI feature backlog refinement, prioritization, and gating by AI-IRB.
   • Roadmap alignment with data readiness and capacity constraints.
   • Triggers for re-validation if new models are introduced.
7. SOP-1006-01-AI: AI-IRB Engagement and Ethical Review Procedure

   Purpose: Provides the route for engaging with the AI-IRB to secure ethical clearances, especially for new or high-impact AI features.

   Key Points:

   • Formal submission for ethical risk reviews.
   • Communication channels for clarifications and re-approvals.
   • Records of IRB decisions and any mandated conditions.
8. SOP-1007-01-AI: AI Asset Management

   Purpose: Tracks and manages AI hardware, software licenses, pretrained model assets, and data assets across the organization.

   Key Points:

   • Lifecycle tracking from acquisition to retirement.
   • Warranty, licensing compliance, and usage monitoring.
   • Asset modifications or reassignments require version logs.
9. SOP-1008-01-AI: AI Incident and Escalation Management

   Purpose: Details how to handle real-time AI production incidents, anomalies, or emergent model misbehavior, including escalation to AI-IRB if ethics-related.

   Key Points:

   • Tiered incident severity definitions for AI anomalies.
   • Communication guidelines and immediate fix or rollback.
   • Post-incident root cause analysis to incorporate lessons learned.
10. SOP-1009-01-AI: AI Model Drift and Re-Validation Procedure

    Purpose: Ensures periodic checks for model drift (performance degradation or domain shifts) and triggers re-validation cycles.

    Key Points:

    • Metrics for drift detection.
    • Retraining or model retirement guidelines.
    • AI-IRB involvement if drift implicates fairness or ethics.
11. SOP-1010-01-AI: AI-SDLC Site Monitoring and Incident Management

    Purpose: Focuses on 24/7 site monitoring for AI-related production issues, bridging with general operations incident management.

    Key Points:

    • Real-time site monitoring for model performance metrics.
    • Coordinated escalation if system stability is threatened.
    • Maintains ongoing compliance with SLA targets.
12. SOP-1011-01-AI: AI Feature Decommissioning and Model Retirement

    Purpose: Lays out a structured approach to retire an AI feature or fully remove a model from production.

    Key Points:

    • Checklist for shutting down active inferences.
    • Handling dependent functionalities or user workflows.
    • Archival of associated data and code artifacts.
13. SOP-1012-01-AI: AI Model Explainability and Interpretability Procedure

    Purpose: Establishes mandatory steps to ensure each AI model includes interpretability features and relevant user/engineer documentation.

    Key Points:

    • Setting up model explainers (e.g., SHAP, LIME).
    • Auditable logs explaining decisions.
    • IRB checks for transparency levels required.
14. SOP-1013-01-AI: AI Model Post-Production Monitoring and Ongoing Validation

    Purpose: Mandates continuous monitoring of model KPIs and triggers re-validation if significant changes occur in performance or data distributions.

    Key Points:

    • Metrics and thresholds for performance, bias, or drift.
    • Automated alerts to responsible teams.
    • Frequencies for scheduled health checks.
15. SOP-1014-01-AI: Regulatory & Ethical AI Compliance Verification

    Purpose: Confirm compliance with relevant laws and internal policy for AI solutions (GDPR, CCPA, internal ethics charters, etc.).

    Key Points:

    • Checklists for privacy laws, disclaimers, user consent.
    • AI-IRB involvement for expansions of scope or new data usage.
    • Audit trail for all compliance checks.
16. SOP-1015-01-AI: AI Knowledge Transfer and Handover Procedure

    Purpose: Ensures structured knowledge transfer for new AI solutions from the development team to operational owners or support staff.

    Key Points:

    • Documented training sessions, including final readouts.
    • Code tours, pipeline diagrams, environment replication steps.
    • Final handover acceptance.
17. SOP-1020-01-AI: AI Model Lifecycle Management

    Purpose: Provides a meta-view of an AI model’s lifespan, from initial concept and prototyping to deployment, maintenance, and eventual retirement.

    Key Points:

    • Stage gates aligned with AI-IRB reviews.
    • Criteria for scaling up from proof-of-concept to production.
    • End-of-life triggers and data final dispositions.
18. SOP-1030-01-AI: AI-Ad Hoc Reporting Procedure

    Purpose: Governs how internal teams request quick-turnaround or one-time analysis from existing AI models or data sets.

    Key Points:

    • Quick security/privacy checks for new requests.
    • IRB oversight if the request expands original data usage.
    • Prompt escalation or revision if scope creeps.
19. SOP-1040-01-AI: Requirements Definition

    Purpose: Identifies how to capture functional and non-functional requirements for AI solutions, including data needs, acceptance criteria, and AI-IRB constraints.

    Key Points:

    • AI-IRB gating for sensitive data usage or high-risk features.
    • Clear alignment of acceptance test cases.
    • Cross-functional reviews for risk, compliance, feasibility.
20. SOP-1050-01-AI: AI Security Administration and Governance

    Purpose: Controls security measures around AI systems: data encryption, API access, key management, and vulnerability scanning for AI pipelines.

    Key Points:

    • AI platform security, software supply chain management.
    • Periodic vulnerability scans on AI code and dependencies.
    • Zero-trust posture, especially for privileged AI model endpoints.
21. SOP-1051-01-AI: Security Administration and Oversight

    Purpose: Provides an overarching approach to user account management, privileged account controls, and periodic reviews of access logs for the entire environment.

    Key Points:

    • Role-based access control, especially for data scientists with production data.
    • Security posture reviews by AI-IRB if emergent risk.
    • Master accounts and restricted user IDs tracked.
22. SOP-1052-01-AI: AI Model Lifecycle Oversight and Governance

    Purpose: AI-IRB overview ensuring all major steps in a model’s lifecycle comply with established ethical and regulatory frameworks.

    Key Points:

    • Aligns with SOP-1020 but focuses on IRB gating.
    • Triage critical or sensitive updates for immediate IRB review.
    • Mandates final sign-off at each milestone.
23. SOP-1053-01-AI: Ethical Risk Assessment & Mitigation

    Purpose: Mandates regular ethical risk assessment (diversity, bias, societal impact) for AI solutions and prescribes mitigation actions.

    Key Points:

    • Periodic ethical risk reviews.
    • Mitigation plan sign-off by AI-IRB.
    • Documentation of residual risk acceptance.
24. SOP-1054-01-AI: AI-Regulated Project Approvals and Sponsorship

    Purpose: Documents how AI-IRB obtains the necessary cross-functional approvals and sponsorship for regulated AI projects.

    Key Points:

    • Funding and oversight checkpoints.
    • Sponsor sign-off from Senior Management.
    • IRB-structured gating across project phases.
25. SOP-1055-01-AI: Computer System Controls

    Purpose: Ensures that all computing environments that host or serve AI models meet uniform control standards (SOX, HIPAA, ISO).

    Key Points:

    • Automated logging, compliance requirements, access restrictions.
    • Physical and logical security for server rooms / cloud.
    • Periodic control audits and recertifications.
26. SOP-1060-01-AI: Service Level Agreement

    Purpose: Stipulates minimum performance, availability, and support commitments for AI solutions.

    Key Points:

    • Defines KPIs such as inference latency and uptime.
    • Penalties or escalation for repeated SLA breaches.
    • Review schedule for SLA adjustments.
27. SOP-1061-01-AI: Incident Tracking

    Purpose: Comprehensive approach to log, categorize, and track incidents involving AI, from minor anomalies to critical outages.

    Key Points:

    • Triage rules for severity.
    • Root cause analysis must consider model aspects.
    • Post-mortem that can trigger new IRB reviews if changes are required.
28. SOP-1100-01-AI: Documentation of Training

    Purpose: Records job-related training for staff engaged in AI functions and compliance with policy or regulatory demands (AI-IRB included).

    Key Points:

    • Documents training events and curricula.
    • Ensures staff have required AI knowledge, including bias/fairness.
    • Central repository of training logs for audits.
29. SOP-1101-01-AI: Training and Documentation

    Purpose: Creates and maintains user instructions, training materials, knowledge base for newly delivered AI solutions.

    Key Points:

    • Trainer selection from Technical Support or SMEs.
    • Product documentation readiness and acceptance by QA.
    • Post-training surveys and feedback loops.
30. SOP-1200-01-AI: Development

    Purpose: Outlines coding, integration, unit test strategies specifically for AI components, referencing data pipelines and ML frameworks.

    Key Points:

    • Emphasizes code reviews, test coverage for ML logic.
    • Aligns with environment config from SOP-1003.
    • Tools, branches, merges, and iteration cycles.
31. SOP-1210-01-AI: Quality Function

    Purpose: Details test strategy, integration test plan, QA acceptance for both standard software and AI components (performance, bias, correctness).

    Key Points:

    • System test includes functional, load, and regression tests.
    • Model performance acceptance criteria.
    • QA gate sign-off required prior to release.
32. SOP-1220-01-AI: Deployment

    Purpose: Final rollout and push to production for AI solutions. Checks that AI-IRB’s final sign-off is present, and that relevant training is complete.

    Key Points:

    • Transition from QA/staging to production.
    • Monitoring for immediate post-release anomalies.
    • Post-deployment review and lessons learned.
33. SOP-1300-01-AI: AI-IRB Governance & Oversight

    Purpose: Defines the role, responsibilities, and authority of the AI-IRB to enforce ethical, regulatory, and operational checks.

    Key Points:

    • Composition, decision-making process, meeting intervals.
    • Mandated reviews for high-impact or ethically sensitive AI projects.
    • Documentation of all IRB judgments or waivers.
34. SOP-1301-01-AI: AI Bias & Fairness Evaluation

    Purpose: Mandates methods for detecting and mitigating bias within AI models, ensuring fairness across protected classes.

    Key Points:

    • Tools and metrics for measuring bias.
    • IRB audits for critical classes (e.g., race, gender).
    • Remediation steps and retesting.
35. SOP-1302-01-AI: AI Explainability & Model Transparency

    Purpose: Ensures that each AI model can be explained at an appropriate level to both internal stakeholders and external regulators/users.

    Key Points:

    • Tracking of model interpretability methods.
    • Documentation or instrumentation for real-time interpretability.
    • IRB sign-off for permissible black-box levels if truly necessary.
36. SOP-1303-01-AI: AI Data Protection & Privacy

    Purpose: Protects data used in AI systems from unauthorized access, ensuring compliance with relevant privacy laws (GDPR, HIPAA, etc.).

    Key Points:

    • Pseudonymization or anonymization approach.
    • Secure data pipelines, encryption at rest/in transit.
    • IRB data usage approvals or rejections.
37. SOP-1304-01-AI: AI Validation & Monitoring

    Purpose: Ongoing process to validate AI models’ correctness, reliability, and compliance after the initial deployment.

    Key Points:

    • Monitoring plan for performance, unexpected behaviors.
    • Automated triggers for re-validation.
    • AI-IRB audit logs for significant anomalies.
38. SOP-1305-01-AI: AI Ethical Risk & Impact Assessment

    Purpose: Formal assessment of the broader societal and ethical impacts of an AI initiative, ensuring that all relevant stakeholders and impacted parties are considered.

    Key Points:

    • Comprehensive methodology for risk identification and rating.
    • Stakeholder consultation (including vulnerable populations).
    • Documentation of mitigations and sign-off by IRB.
39. SOP-1306-01-AI: AI End-of-Life & Sunset Process

    Purpose: Provides a structured approach for decommissioning AI models that have outlived their useful or safe lifecycle.

    Key Points:

    • AI-IRB verification that all obligations and user impacts are addressed.
    • Data and model archiving or destruction.
    • Post-sunset review of lessons learned.
40. SOP-2002-01: Control of Quality Records

    Purpose: Governs management of all quality records and associated evidence for the entire AI-SDLC (including sign-offs, IRB documents, test logs).

    Key Points:

    • Retention schedules, versioning, authorized destruction.
    • Cross-referencing for audits.
    • Accessibility and security for critical records.