Ethical AI statement

Statement of the principles governing how Storm ID Ltd. develops, deploys and uses artificial intelligence.

Introduction

Artificial intelligence (AI) offers real benefits to the organisations we work with and the people they serve. Used carelessly, it can also cause harm, including unfair outcomes, loss of privacy, decisions that cannot be explained, and systems that fail in ways nobody anticipated.

Storm ID is committed to developing and using AI responsibly, lawfully and with ethical integrity. This statement sets out the principles we follow and the steps we take to ensure the AI we develop, deploy and use is fair, transparent, accountable and secure.

About Storm ID

Storm ID Limited is a limited company registered in Scotland no. SC216070 based at Leith Assembly Rooms, 43 Constitution Street, Edinburgh, EH6 7BG. We are a technology company providing services to both private and public sector organisations. We design, build and deploy AI-enabled products and services, including systems we develop in-house and deploy into our clients' own infrastructure.

Scope

This statement applies to all AI systems developed, deployed or used by Storm ID, and to everyone involved in that work, including our employees, contractors, partners and suppliers.

Our approach

Storm ID interacts with AI in three ways, and our responsibilities vary according to that interaction.

AI systems we develop

• Design, build and test them in line with our AI systems design and development policy, applicable law and recognised good practice, including ISO/IEC 42001.

• Assess risks and impacts before deployment and whenever a system changes significantly, including the risks of bias, error and misuse.

• Validate performance and reliability before release, and document how each system works and its known limitations.

• Protect the data our systems use and secure them against misuse and unauthorised access.

Third-party AI we build into our services

• Assess suppliers for compliance with relevant law, including data protection legislation, before adoption.

• Agree responsibilities for operation, monitoring, incident response and suspension with clients.

Third-party AI tools we use internally

• Approve AI tools against our information security and data protection standards before they are used.

• Control what information can be shared with these tools and never share client or personal data with a tool that has not been approved for it.

• Ensure a named person remains accountable for any work or decision informed by AI output.

Our guiding principles

Transparency and explainability

• Document our AI systems so that their purpose, behaviour and limitations can be understood.

• Make it clear to clients, and where appropriate to end users, when they are interacting with AI or with content it has generated.

• Provide explanations appropriate to the use and its impact, documenting limitations, and restricting use where sufficient explanation cannot be provided.

Fairness and non-discrimination

• Assess training and input data for quality, representativeness and known sources of bias.

• Test for unfair or discriminatory outcomes before deployment and continue to monitor once systems are live.

Accountability and governance

• Assign clear ownership for every AI system we develop or deploy.

• Maintain an inventory of our AI systems and a defined process for assessing and treating AI risk.

• Record and review AI-related incidents through our incident management procedures, and act on the lessons learned.

Privacy and security

• Comply with UK GDPR and the Data Protection Act 2018 wherever AI processes personal data.

• Apply privacy by design and carry out data protection impact assessments where required.

• Assess AI systems for security risks, including unauthorised access, data leakage and attempts to manipulate a system's behaviour.

Human oversight

• Retain human accountability and require meaningful human review where consequences warrant it.

• Ensure people can review, challenge and override AI outputs.

Safety and robustness

• Test AI systems for resilience against failure and deliberate misuse.

• Design systems to fail safely, limiting the potential for harm to individuals and organisations.

• Monitor systems in use so that changes in performance are identified and acted upon.

Sustainability and social responsibility

• Assess whether the proposed use delivers a worthwhile benefit and whether its potential harms can be acceptably managed.

• Review accessibility, inclusion and understanding of the expected experiences of affected users.

• Consider the environmental impact of the AI we develop and use, including the energy demands of training and running models.

• Take account of ethical AI principles when selecting AI suppliers and partners.

Our policies

As part of our commitment to the ethical use of AI, we have implemented the following policies and procedures, which are available to all employees through our intranet:

• AI management policy

• AI systems design and development policy

• AI systems governance and use policy

• Model development best practices

• Information security and privacy policy

• Data protection policy

• Whistleblowing policy

Risk and compliance

We manage AI risk as part of our integrated management system, which is independently certified to ISO 9001, ISO 13485, ISO 14001, ISO 22301 and ISO 27001, alongside Cyber Essentials Plus. Our approach to AI governance is aligned with ISO/IEC 42001.

We monitor changes in AI law and regulation, including the EU AI Act where it applies to our work, and update our approach accordingly. If we find that an AI system, whether developed by us or supplied by a third party, does not meet the standards set out in this statement, we will act to correct it and, where necessary, withdraw it from use.

Embedding the principles

We continue to embed these principles through:

• Providing AI awareness training to all staff, which is reviewed and updated annually.

• Providing additional training for colleagues who design, develop or procure AI systems.

• Reviewing our AI systems and risks regularly through internal audit and management review.

• Encouraging colleagues, clients and partners to raise concerns about our use of AI and protecting those who do through our whistleblowing policy.

• As of 25th October 2026, 93% of colleagues have completed AI awareness training.

Raising a concern

If you have a question or concern about how Storm ID develops or uses AI, please contact dataprotection@stormid.com

This statement was approved by the board of directors of Storm ID Ltd and signed on their behalf by Tim Threlfall on 27 October 2026. We will review this statement annually, or sooner if changes in law or in our use of AI require it.