Management System Policies

This is a translation for convenience. The Spanish version is the authoritative text.

Mafer AI, S.L. operates an integrated management system (IMS) that brings together information security and artificial intelligence governance, in accordance with ISO/IEC 27001:2022 and ISO/IEC 42001:2023. On this page we publish, for free consultation by customers, partners, staff and other interested parties, the main excerpts of the policies that govern that system.

For any question about these policies, you can write to us through our contact page. Incidents or concerns about our AI systems can be reported to etica@mafer.ai.

Management system policy

Version 1 · 16/04/2026

Commitment and objectives of the management system

Mafer AI, S.L. adopts an integrated approach that brings together, in a single management system, its commitments on information security and on artificial intelligence governance, aligned with the organisation's strategic direction and with the expectations of its customers in the specialty chemicals sector, technology partners, staff and other interested parties.

Top Management recognises that information is an essential asset for the operation of the SaaS platform and for the trust placed in it by the fragrance, flavour, cosmetics, paints, agrochemicals, personal care, food and beverage companies that make up its target market. Accordingly, the organisation is committed to preserving the confidentiality, integrity and availability of all the information it manages, adopting a risk-based approach that makes it possible to identify, assess and treat threats in proportion to their potential impact.

The organisation undertakes to meet the legal, regulatory and contractual requirements applicable to its activity, including those arising from Regulation (EU) 2016/679 on the protection of personal data and from Regulation (EU) 2024/1689 with regard to artificial intelligence systems. This commitment also covers the requirements that Mafer AI, S.L. imposes on itself voluntarily and those established by the IMS reference standards.

Mafer AI, S.L. promotes continual improvement as a guiding principle of the IMS. The organisation periodically evaluates the effectiveness of its policies, processes and controls through management review, internal audits and the analysis of indicators, identifying opportunities for improvement and adapting the system to the evolution of its operational, technological and regulatory context.

This policy provides the framework for setting the IMS objectives, which cover both information security and artificial intelligence governance. These objectives are defined in measurable terms, communicated to the relevant levels of the organisation and reviewed at least once a year as part of the management review.

Consistency between the IMS policies

The organisation recognises that information security, the management of artificial intelligence and the protection of personal data are areas with significant intersections that require coordinated treatment. To avoid contradictions and strengthen the effectiveness of the IMS, Mafer AI, S.L. promotes alignment between the Information Security Policy, the Artificial Intelligence Policy and the Privacy System Policy, reviewing them jointly whenever changes are detected in the organisational context, in the applicable requirements or in the strategic direction.

In each management review, the Management System Manager identifies the areas in which the objectives relating to artificial intelligence systems influence the security and data protection policies, and vice versa, promoting the updates needed to keep the documentary framework consistent. This integration effort allows the organisation to manage cross-cutting risks in a unified way and to respond robustly to the expectations of its interested parties.

Communication of the policy

This policy is made known to all staff of the organisation and is included in the training and awareness plan, so that every member of the team understands its relevance to their duties. The organisation also makes it available to external interested parties by publishing it on the corporate website, guaranteeing free access to it. Any update is disseminated through the approved communication channels and managed as documented information of the IMS.

Specific commitments on artificial intelligence

Mafer AI, S.L. includes in its IMS policy distinct commitments relating to the responsible development, provision and use of artificial intelligence systems, in line with the principles of ISO/IEC 42001:2023 and with the obligations arising from Regulation (EU) 2024/1689.

The organisation seeks to ensure that its artificial intelligence systems operate under a sound ethical framework, based on the following principles:

Human oversight: no significant decision rests solely on an automated process; AI outputs are an input to a person's assessment, not a final verdict.
Transparency: people who interact with an AI system are informed of it, and model invocations are logged to ensure traceability.
Fairness and non-discrimination: AI systems are not used to assess, score or rank people, and those with a potential impact on individuals or groups undergo an assessment before being put into production.
Privacy by design and by default: the processing of personal data in the context of AI is minimised, pseudonymised or anonymised whenever feasible.
Security and robustness: specific controls are applied against threats particular to artificial intelligence, including data poisoning, model extraction and malicious prompt injection.

The organisation also promotes artificial intelligence literacy among all its staff, providing them with the training needed to understand the capabilities and limitations of the systems used.

These commitments are set out and developed in the Artificial Intelligence Policy, which establishes the detailed guidelines, the prohibited uses, the roles of the AI management system and the conditions for authorising systems in production. Both policies are reviewed in a coordinated manner to ensure their mutual consistency and their alignment with the applicable regulatory framework.

Information security policy

Version 1 · 16/04/2026

Information security objectives

Mafer AI sets information security objectives that are compatible with its strategic direction and with the context in which it operates. These objectives are measurable, communicated to all relevant functions and reviewed at least annually as part of the management review.

The organisation pursues the following strategic commitments:

Preserve the confidentiality, integrity and availability of the information managed on the SaaS platform and in internal systems, adopting a risk-based approach that prioritises the protection of the technical data of customers in the specialty chemicals sector.
Comply with the applicable legal, regulatory and contractual requirements, with particular attention to the obligations arising from the GDPR, ISO/IEC 27001:2022, ISO/IEC 42001:2023 and SOC 2, as well as the security commitments formalised with customers.
Strengthen the operational resilience of the cloud infrastructure and of critical services, ensuring availability levels aligned with the recovery point and recovery time objectives defined by the organisation.
Promote the awareness and competence of all staff in information security, privacy and the responsible use of artificial intelligence, through periodic training activities.
Reduce exposure to threats through the systematic identification, assessment and treatment of information security risks, including the specific risks associated with AI systems and with the technology supply chain.
Drive the continual improvement of the IMS through the measurement of indicators, internal audits, the analysis of incidents and the periodic review of policies and controls.

The Management System Manager monitors these objectives through the management system indicators and presents the results to Top Management for evaluation and for the adoption of the appropriate actions.

Fundamental information security principles

Mafer AI bases its approach to information security on a set of principles that guide all of its policies, procedures and controls, and that Top Management promotes as an integral part of the organisational culture.

Risk-based approach. The organisation adopts proactive security management based on the identification, assessment and treatment of the risks and opportunities that affect its information assets. The risk analysis considers both the general risks of the management system and the specific risks of information security and of AI systems, and is updated whenever there are significant changes in the internal or external context. Risks whose level exceeds the acceptance threshold defined by the organisation receive a treatment plan with measures proportionate to their likelihood and impact.
Shared responsibility. Everyone who accesses Mafer AI's information or systems takes responsibility for protecting the assets they use. Top Management establishes security roles and obligations, communicates them clearly and ensures that each role understands its contribution to protecting information. The Code of Conduct reinforces this commitment by linking ethical conduct to adherence to the information security policies.
Confidentiality, integrity and availability. Mafer AI directs its controls at preserving these three properties simultaneously. Information is classified according to its sensitivity, and the levels of protection for processing, transmission and storage are adjusted to that classification. Confidentiality agreements with employees and third parties extend this principle to external relationships.
Access control. The organisation grants access to information and systems in accordance with the principle of least privilege and role-based access control. Each user has only the permissions needed to perform their duties, and access rights are reviewed periodically to detect and correct deviations.
Protection of personal data. Mafer AI integrates the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality into the processing of personal data. The organisation acts as data controller and adopts the technical and organisational measures needed to demonstrate compliance with these obligations, in accordance with its Privacy System Policy. Retention periods and the criteria for the secure deletion of data are governed by its information retention and deletion policy.
Security in AI systems. The organisation's artificial intelligence systems are subject to the same security controls as the rest of the platform, including encryption, access control, event logging and segregation of environments. In addition, specific controls are applied to prevent threats particular to AI, such as prompt injection, model extraction and data poisoning. The Artificial Intelligence Policy develops the principles of human oversight, transparency, non-discrimination, privacy by design and control of model providers.
Incident management. The organisation has mechanisms that allow all staff to promptly report observed or suspected information security events. The incident management procedure governs the detection, classification, containment, eradication and recovery phases, as well as notification to the competent authorities and to customers within the established deadlines.
Acceptable use of information and resources. Mafer AI defines clear rules for the use of information and corporate technology resources, which all staff and external collaborators are required to know and comply with. These rules cover the formal assignment of assets, clear desk and clear screen rules, and the conditions for using generative AI tools.
Encryption. The organisation protects information at rest and in transit using recognised cryptographic standards, with defined criteria for the selection of algorithms and the life cycle of cryptographic keys.
Alignment with other organisational policies. This policy is coordinated with the Artificial Intelligence Policy, the Privacy System Policy and the Management System Policy, so that the security, privacy and responsible AI objectives are reviewed in a coordinated manner and the provisions of each policy are consistent with one another.
Continual improvement. Mafer AI promotes the continual improvement of the IMS through management review, internal audits, the analysis of indicators, the treatment of nonconformities and the feedback obtained from incidents and risk assessments.

Protection of off-premises assets

Mafer AI recognises that its information assets are frequently used outside the organisation's premises, since the team works remotely and from coworking spaces. The organisation is committed to extending its security controls to all external use scenarios, ensuring that the protection of information remains aligned with the classification of each asset and with the risk-based approach of the IMS.

Off-premises assets include, among others, corporate laptops used for remote work or while travelling, mobile devices, removable storage media handed to consultants or suppliers, and documentation transported for operational needs.

The organisation establishes the following commitments:

Custody and responsibility: each off-premises asset remains the responsibility of the person to whom it is assigned, who ensures that it is not left unattended in vehicles, on public transport, in hotel common areas or in coworking spaces. When travelling, assets are kept in locked places or in the safe of the accommodation.
Technical protection of devices: all corporate laptops have full-disk encryption and automatic locking, as well as remote wipe capability to be activated in the event of loss or theft.
Secure transport: information assets are transported in personal custody. Sending them by ordinary post or placing them in unsupervised luggage compartments is not permitted. Deliveries to third parties are made through trackable means.
Incident reporting: staff immediately report to the Management System Manager any loss, theft or damage of an off-premises asset. The report triggers the remote locking of the device, the revocation of access and the change of credentials, and the event is recorded and managed as an information security incident.
Return: at the end of the project, the trip or the employment relationship, assets are returned to the organisation through a formal record documenting their handover and receipt.

Artificial intelligence policy

Version 1 · 16/04/2026

Ethical principles

Mafer AI bases its approach to artificial intelligence on a set of ethical principles that guide all activities relating to the design, development, provision and use of its AI systems. These principles reflect the organisation's values and apply across the entire life cycle of each system.

Human oversight: the organisation ensures that every relevant decision supported or generated by an AI system is subject to meaningful human oversight. Human operators retain the ability to intervene in, correct or override the system's outputs when circumstances require it, so that no decision with an impact on people is taken in a solely automated way. The human oversight arrangement for each system is recorded in the internal register of authorised AI systems.
Transparency: Mafer AI informs people that they are interacting with an AI system when required by Article 50 of Regulation (EU) 2024/1689. It also provides users, customers and other interested parties with the necessary information on the purpose, capabilities, limitations and the way to report problems with each system. The level of detail is adapted to the profile of the recipient (direct user, B2B customer or supervisory authority). The organisation also informs the relevant interested parties of any AI incidents that affect them.
Fairness and non-discrimination: AI systems are designed, developed and operated avoiding unjustified biases that could lead to discrimination against individuals or groups. The organisation actively assesses the risks of bias, both in input data and in the outputs produced, and takes corrective action when it detects deviations.
Privacy by design and by default: the protection of personal data is built in from the earliest stages of the life cycle of each AI system. Default settings adopt the highest level of protection and apply the principles of data minimisation, purpose limitation and proportionality in processing. Whenever possible, personal data processed by AI systems is pseudonymised or anonymised. Its processing is governed by the Privacy System Policy and by Regulation (EU) 2016/679.
Security and robustness: AI systems are subject to the same security controls as the rest of the platform, complemented by specific controls against threats particular to machine learning, such as prompt injection, model extraction and data poisoning. The organisation seeks to make its systems resilient to anomalous inputs, changes in the operational context and attempts at adversarial manipulation.
Traceability: the organisation determines and maintains event logging for its AI systems, at least while they are in use. Every model invocation passes through a proprietary AI gateway, which logs it with its context. Human interventions that correct or override a system's output are logged as events. Design, development and deployment decisions are kept as documented information. These records make it possible to audit the operation of each system, analyse incidents and demonstrate human oversight throughout the entire life cycle.
Accountability: Mafer AI takes responsibility for the outputs generated or supported by its AI systems, both towards its customers and towards the competent authorities. Design, deployment and operation decisions are documented so that they can be explained and justified to any interested party.

Top management commitments

The top management of Mafer AI, S.L. actively drives and supports the AI management system (AIMS) and takes ultimate responsibility for its effectiveness. To this end, it integrates the requirements of the AI management system into the organisation's business processes, so that security, privacy and ethical considerations are incorporated from strategic planning through to the day-to-day operation of the SaaS platform. The governance structure sets out three levels of decision (strategic, operational and technical) that allow agile management without compromising the separation of duties.

This commitment translates into the allocation of the human, technological and financial resources that the AIMS requires: cloud computing infrastructure, tools for monitoring model performance and specialised training programmes. At the same time, Mafer AI promotes a culture of responsible artificial intelligence at all levels. It fosters AI literacy among all staff and awareness of the risks and ethical implications of AI systems, in line with the organisation's Code of Conduct.

The organisation ensures compliance with the applicable regulatory framework, in particular ISO/IEC 42001:2023, Regulation (EU) 2024/1689 and Regulation (EU) 2016/679, as well as with the contractual commitments made to customers. Top management maintains the established AI governance roles and the associated reporting lines. The AI Management System Manager presents, at least at each management review, a report covering:

the overall status of the AIMS;
the performance indicators of the AI systems;
the incidents recorded;
the results of the impact assessments;
progress on the AI objectives;
feedback from interested parties.

Mafer AI is committed to carrying out impact assessments of its AI systems at planned intervals and before any significant change. In them it documents the potential consequences for individuals, groups and society, and uses the results as input for AI risk management. As a B2B provider, the organisation also takes into account the expectations and needs of its customers. It provides them with adequate information on the operation, the limits of the scope of use and the risks of the AI systems supplied, so that each customer can manage the corresponding risks in its own context.

Top management ensures that this policy is consistent with the other IMS policies (information security, privacy, Code of Conduct and management system) and reviews their contents in a coordinated manner to preserve an integrated approach. The organisation drives the continual improvement of the AIMS through management review, internal audits, the analysis of indicators and the treatment of nonconformities and opportunities for improvement.

AI systems and risk classification

Mafer AI's AI systems are inventoried in an internal register of authorised AI systems and classified in accordance with Regulation (EU) 2024/1689. Their up-to-date list, including the authorised third-party AI tools, is kept in that register.

Mafer AI acts as the provider of these systems and as the deployer of the underlying language models. These models are supplied by third parties and are accessed exclusively through the AI gateway, via the provider's API or AWS Bedrock.

All systems are classified as minimal risk under Regulation (EU) 2024/1689: none falls within Annex III or constitutes a safety component of a product covered by Annex I. Consequently, the obligations of Chapter III (high-risk systems) do not apply to them. The transparency obligations of Article 50 and the AI literacy duty of Article 4 do apply to them.

The classification is a living control. It is reviewed at least once a year and immediately upon the introduction of a new system, a change of purpose or the publication by the European Commission of the guidelines provided for in Article 6.

AI objectives framework

This policy provides the framework for defining measurable AI objectives, consistent with Mafer AI's business strategy and with the ethical principles set out here. The objectives are set at the relevant levels and functions of the organisation and meet the following criteria:

They are consistent with this AI policy and with the other IMS policies.
They are measurable through quantitative indicators with explicit targets.
They take into account the applicable legal, regulatory and contractual requirements.
They are monitored quarterly through the management system indicators.
They are communicated to the relevant staff and updated when circumstances require it.
They are available as documented information.

For each objective, the organisation determines the necessary actions, the resources required, the people responsible, the deadlines and the criteria for evaluating results.

In the area of responsible development, the AI objectives guide the design and deployment processes of the systems. They include targets for model accuracy, coverage of risk and impact assessments, absence of serious incidents and technical competence of staff. The secure development procedure integrates these targets into the stages of the life cycle, from the conception of the system to its monitoring in production.

Limits on development, provision and use

Mafer AI undertakes not to develop, provide or use artificial intelligence systems in the following cases:

Practices expressly prohibited by Regulation (EU) 2024/1689, including systems classified as posing an unacceptable risk.
Applications that infringe people's fundamental rights, whether directly or through the cumulative effect of their outputs.
Uses intended for the covert manipulation of human behaviour, unauthorised mass surveillance or the social scoring of individuals.
Systems classified as high-risk that lack meaningful human oversight. None of the organisation's AI systems is currently classified as high-risk.

Regardless of their risk classification, AI is not used at Mafer AI to assess, score, compare or rank candidates in recruitment processes. Selection is carried out by people: applications are reviewed manually and every hiring decision is human. In a recruitment context, the use of a general-purpose assistant is limited to auxiliary tasks that do not express a judgement about a person, for example summarising or translating a document, clarifying terminology or drafting correspondence. This rule keeps all systems outside point 4(a) of Annex III of Regulation (EU) 2024/1689.

The following are also prohibited:

the use of an AI system outside its intended purpose and its permitted use cases;
access by one customer (tenant) to another's data through an AI system;
putting into production or using an AI system that has not been registered or authorised in accordance with AIMS governance.

Each system also has an explicit prohibited use case:

Questionnaire completion: sending the customer a generated questionnaire answer without prior human review.
Manufacturing flowcharts: using the generated flowchart as the sole source for declarations of conformity or safety decisions.
Document classification and extraction: deploying an extraction rule proposed by the system without verifying it against the regression corpus.
Email summarisation: triggering automatic actions on email based on the summary or categorisation without human intervention.

The organisation recognises that its status as a provider of AI services to the B2B sector entails the responsibility to communicate clearly the valid scope of use of each system, the risks identified and the conditions under which the customer assumes responsibility for the use of the service. Mafer AI provides its customers with adequate technical documentation and maintains support channels, so that customers can manage the corresponding risks in their own operating environment.

Life cycle and change management

An AI system only goes into production after it has been inventoried and authorised, with its purpose, its permitted and prohibited use cases and its human oversight arrangement defined. Changes to a system in production (a new purpose, new processing of personal data or a change of model with functional impact) are managed through the change management procedure and, where appropriate, give rise to a new impact assessment and to a review of the risk classification.

Prompts and model configurations are kept in a versioned catalogue with rollback capability. In this way, the instruction given to a model is a controlled artefact rather than a string scattered across the code.

Management of AI providers

Third-party language models are consumed exclusively through the AI gateway and are subject to this policy. The relationship with providers is governed by their contractual terms, verified in the procurement and third-party management process (incident notification, technical documentation and a prohibition on training with the organisation's data), and by the AIMS supplier assessment. No customer-facing module calls a model provider's SDK directly. This architectural rule is verified in continuous integration.

Training and competence (AI literacy)

In accordance with Article 4 of Regulation (EU) 2024/1689, all staff receive annual AI awareness training. This training covers what AI is, the ethical principles, this policy and the permitted and prohibited uses. Staff who develop or operate AI systems also receive specialised training.

Transparency towards users

When an AI system interacts directly with a person (currently, the chat assistant), that person is informed, in accordance with Article 50 of Regulation (EU) 2024/1689, that they are interacting with AI, of the system's purpose, of its limits and of how to report a problem. The chat assistant has a permanent notice and an "About this assistant" panel, active in all environments, including production.

Reporting AI incidents and concerns

Anyone, internal or external, can report an incident, a malfunction, a breach of this policy or an ethical concern about an AI system through the organisation's Ethics Channel (etica@mafer.ai). The channel is open to third parties, allows anonymous reports and guarantees confidentiality and protection against retaliation in accordance with Directive (EU) 2019/1937 and Spanish Law 2/2023. Reports are handled as established in the Ethics Channel and in the Code of Conduct.