Introduction

At Youverify, we help businesses verify identities, detect fraud, and meet compliance requirements. AI is one of the tools we use to do this effectively. We design our systems to operate with appropriate governance, oversight, and accountability.

With the use of AI comes a clear responsibility, to the businesses we serve, to the individuals whose data we process, and to the communities in which we operate.

This page outlines our AI governance framework, the principles that guide us, and the measures we take to support safe, fair, and trustworthy AI systems.

Key Highlights

We operate an AI Management System aligned with ISO/IEC 42001:2023
We conduct bias assessments before deployment and at defined intervals
We maintain human oversight for identity verification and compliance workflows
We aim to acknowledge all inquiries within 5 business days and respond within 15 business days
We contractually prohibit third-party AI providers from using customer personal data to train their models

Our AI Principles

Our approach to AI is grounded in seven core principles, embedded across the full lifecycle of all AI systems at Youverify.

Fairness

We are committed to ensuring that our AI systems deliver fair, non-discriminatory outcomes. Bias assessments are conducted before deployment and at defined intervals thereafter. Findings are documented, and remediation actions are tracked through our governance processes.

Transparency

We document the purpose, capabilities, and known limitations of our AI systems. We communicate clearly with our customers on how AI is used within our products, including in decisions that may significantly affect individuals.

Human Oversight

Our AI systems are designed with appropriate levels of human oversight, proportionate to the risk and potential impact of each system. For decisions that may significantly affect individuals, outcomes can be reviewed, challenged, and corrected where necessary.

Privacy and Security

We apply technical and organisational measures to protect sensitive data processed by our AI systems, including identity and biometric data. Our practices are aligned with applicable data protection laws, including the Nigeria Data Protection Act (NDPA) and the General Data Protection Regulation (GDPR).

Accountability

Each AI system has a clearly defined owner and operates within a formal governance structure with senior management oversight. Responsibilities are assigned, documented, and actively exercised.

Robustness and Reliability

Our AI systems are verified and validated before deployment and monitored in operation. We test for performance degradation, data drift, and unexpected behaviour, and we have defined processes to detect and respond to failures.

Continual Improvement

We continuously monitor and improve our AI systems, incorporating insights from internal audits, incident reviews, and stakeholder feedback. Our governance processes are designed to evolve alongside our AI capabilities and the regulatory environment.

Our AI Governance Framework

Youverify operates a formal Artificial Intelligence Management System (AIMS) aligned with ISO/IEC 42001:2023. It reflects our structured implementation of the standard's requirements as part of our ongoing commitment to responsible AI governance.

This framework governs the full lifecycle of our AI systems, from design and development through to deployment, monitoring, and decommissioning , and includes:

AI risk assessments and impact assessments, conducted before deployment and at defined intervals
Bias, accuracy, and reliability testing throughout the AI system life cycle
Human oversight controls, calibrated to the risk level of each system
Incident detection, response, and post-incident review processes
Performance monitoring and regular reporting to senior management

Our AI governance framework is subject to bi-annual review by senior management to assess its ongoing effectiveness.

AI and Identity Verification

Our products use AI for identity verification processes including document verification, facial recognition, liveness detection, and risk scoring. We recognise that these processes can significantly affect individuals, in particular, incorrect outcomes can impact a person's ability to access services.

To manage these risks, we take the following measures:

Accuracy and fairness: We prioritise accuracy, fairness, and reliability in the design and operation of our verification systems.
Confidence thresholds: We apply confidence thresholds so that low-confidence AI decisions are referred for human review.
Human review: We incorporate human review mechanisms where automated decisions are uncertain or where an individual requests a review.
Right to challenge: We provide mechanisms for individuals to challenge, request review of, and where appropriate correct AI-driven outcomes.
Disaggregated testing: We conduct disaggregated performance testing to check that our systems perform fairly across different groups, including by nationality and document type.

Third-Party AI Components

Youverify uses a combination of proprietary AI models and carefully selected third-party AI components, including computer vision libraries and large language models for specific, defined use cases.

Before integrating any third-party AI component, we conduct a security and compliance assessment in accordance with our supplier assessment process. This assessment covers the provider's security controls, certifications, data processing terms, and incident response obligations.

We contractually prohibit our third-party AI providers from using customer personal data to train their models. Our data processing agreements include explicit restrictions on the use of customer data for model training purposes.

Third-party AI suppliers who handle customer data are monitored on an ongoing basis, with high-risk suppliers reassessed at least annually.

Data Protection and Information Security

Our AI systems operate within a broader framework of data protection and information security. We align our practices with:

ISO/IEC 27001: for information security governance and risk management
ISO/IEC 27018: for protection of personally identifiable information in cloud environments
SOC 2 (Security Trust Services Criteria): for independent validation of our security controls
Nigeria Data Protection Act (NDPA): for data protection within Nigeria
General Data Protection Regulation (GDPR): for processing of personal data relating to individuals in the European Union

Where we process personal data in other jurisdictions, we assess and apply the relevant data protection requirements for those regions.

Where our AI systems make or inform automated decisions about individuals, such as identity verification outcomes, we maintain records of the decision-making logic, support the right to request human review, and ensure individuals are informed of this right.

Our Commitments

We commit to the following standards in the governance and operation of our AI systems.

Transparency

We document the purpose, capabilities, and known limitations of every AI system. This documentation is maintained and updated when systems change.

Fairness

We test AI systems for bias before deployment and at defined intervals thereafter. Findings are documented and remediation actions are tracked to completion.

Human Oversight

We maintain human oversight mechanisms for identity verification and compliance workflows, proportionate to the risk and potential impact of each decision.

Data Protection

We protect personal and biometric data processed by our AI systems in accordance with NDPA, GDPR, and other applicable frameworks. We support individuals' data protection rights, including the right to request human review of automated decisions.

Responsiveness

We aim to acknowledge all inquiries and adverse impact reports within five business days and provide a substantive response within 15 business days. If we are unable to fully resolve a matter within 15 days, we will communicate progress and a revised timeline.

Robustness

We monitor our AI systems in production for performance degradation, unexpected behaviour, and data drift. We have defined processes to respond when systems do not perform as expected.

Continual Improvement

We improve our AI governance through regular internal audits, incident reviews, and stakeholder feedback. Our governance framework is reviewed by senior management at least twice a year.

Legal and Compliance

Youverify is committed to ensuring its AI systems are developed and operated in accordance with applicable laws, regulations, and recognised industry standards.

We maintain internal policies, procedures, and controls to support compliance, including:

AI governance and risk management frameworks, including a formal AI Policy and AI Risk Assessment and Treatment Methodology
Data protection and privacy controls
Information security controls aligned with ISO/IEC 27001
Monitoring, internal audit, and management review processes

Regulatory Scope and Limitations: Our AI systems are designed to meet applicable regulatory requirements based on their intended use, deployment context, and jurisdiction. As regulatory frameworks continue to evolve, references to regulatory alignment reflect our commitment to implementing applicable requirements and best practices. They should not be interpreted as formal certification or regulatory approval unless explicitly stated.

Reporting Adverse Impacts

If you believe you have experienced an adverse impact as a result of one of our AI systems, whether an incorrect verification outcome, a potentially discriminatory result, or any other harm , we encourage you to report it.

Please use the contact details below. All reports are logged, investigated, and responded to. You will receive:

An acknowledgement of your report within five business days of receipt
A substantive response detailing the outcome of our investigation within 15 business days
An update with a revised timeline if the investigation cannot be completed within 15 days

We do not retaliate against individuals or organisations who raise good-faith concerns about our AI systems.

If you are unsatisfied with our response, you have the right to raise your concern with the relevant data protection or regulatory authority in your jurisdiction.

Questions and Contacts

For questions, concerns, or requests related to our AI systems and governance, please use the appropriate contact below.

AI-related inquiries and adverse impact reports: security@youverify.co
Data protection rights and automated decision-making requests: privacy@youverify.co
General compliance and legal inquiries: legal@youverify.co

Ongoing Commitment

Youverify operates an AI Management System aligned with ISO/IEC 42001. Our approach to responsible AI is reviewed regularly and updated when there are material changes to our AI systems, governance framework, or the regulatory environment.

This document describes Youverify's AI governance approach and principles as of the date of last review. It does not constitute legal advice, a warranty, or a guarantee of specific system performance. For contractual commitments regarding AI systems, please refer to the relevant service agreement.