Policy Exception Process

[All Actors]
1. Operate a formal, documented exception workflow: all deviations from policy must be raised, risk-assessed, approved at the appropriate level, recorded, and time-boxed.

2. Define clear eligibility criteria for when an exception can be requested (e.g., emergency patch, experimental feature, urgent business need).

3. Perform a risk assessment and specify mitigating controls; confirm the exception will not violate security, privacy, or compliance requirements.

4. Log rationale, approvals, expiry dates and compensating controls in a system accessible for audit and review.

5. Notify all affected stakeholders (security, legal, business owners, external partners if relevant) and coordinate any downstream impacts.

6. Review exceptions on a schedule or when context changes; retire or renew them to maintain alignment with policy, regulation and organisational risk appetite.

1. Policy Examination
a. Verify that a formal, documented exception process exists for deviations from organization's policies related to AI infrastructure, platform configurations, or customer-facing AI services (e.g., model hosting, API rate limits, data handling constraints).
b. Confirm that the exception process is incorporated into or referenced by the organization's broader governance framework, including internal compliance programs or risk management procedures applicable to AI services.

2. Policy Assessment
a. Verify that the exception process includes documented approval workflows, justification requirements, expiration timelines, and conditions under which exceptions must be renewed or reviewed.
b. Confirm that the exception process covers deviations from organization’s internal operational policies, including scenarios such as bypassing encryption enforcement, extending AI model access beyond standard SLAs, or overriding resource usage limits.
c. Assess whether approved exceptions are communicated to relevant internal teams (e.g., service owners, platform compliance) and documented in a central tracking system for auditability.

3. Review Process Evaluation
a. Determine whether the organization has implemented controls to prevent unauthorized policy deviations (e.g., configuration checks, exception flags in orchestration systems).
b. Confirm that an appropriate governance body (e.g., platform risk team, service compliance board) periodically reviews approved exceptions and monitors adherence to the exception process.

4. Implementation Validation
a. Review a sample of approved exceptions related to CSP-operated AI infrastructure or services to validate that they meet approval, justification, and expiration requirements.
b. Examine recent changes to CSP-managed AI systems (e.g., infrastructure scaling for specific clients, API access changes, or emergency patches) and confirm that appropriate exceptions were documented and approved when deviations from policy occurred.

From CCM:
1. Examine the policy and/or procedures to determine if the policy exception process has been established.
2. Identify and confirm that exceptions to policies are tracked, authorized, and evidenced.
3. Confirm a review of policy exceptions takes place on a periodic basis by appropriate management.