Cybersecurity and Privacy Protection at True

Cybersecurity and personal data protection are critical issues across all industries, but network and communication technology providers play a fundamental role in mitigating and safeguarding users from rights violations and online threats. Therefore, True must rigorously pursue cybersecurity and personal data protection efforts, including the establishment of control measures, audits, and continuous improvement of management practices to meet standards consistently. This also involves building internal staff capabilities, educating business partners, collaborators, and continuously educating users and consumers. This ensures the creation of a secure digital environment for everyone, reducing legal, financial, and reputational risks for the Company.

GOVERNANCE AND STRUCTURE

One of True’s missions is to prioritize the management of personal data security in accordance with the Personal Data Protection Act B.E. 2562 (PDPA), as well as international guidelines and standards, such as the ISO 27001 Information Security Management Standard, covering all business units, including TrueMove H, True Online, TrueVisions, and True Digital.

The company has established the IT & Security Division and the Business Security Department under the Chief IT and Security Officer (CISO). It reports the results of Information Security and Cyber Security operations to the Risk, Cybersecurity, and Finance Committee, as well as to the management committee. Additionally, a Data Protection Division has been established to specifically manage personal data protection issues. Its main responsibility is to control the personal data protection processes in accordance with the company’s policies and the PDPA. This division operates under the Chief Corporate Affairs Officer Group and reports progress and operational results to the Corporate Governance and Sustainability Committee and the management committee.

In general, the scope duties and responsibilities of the Risk, Cybersecurity and Finance Committee in relation to cybersecurity and privacy protection include:

Oversee risk policy framework and process for risk management of the Company, including all strategies, policies, rules and operational manuals to determine, evaluate, monitor and recommend cybersecurity risk, and data privacy risk to the Board of Directors;
Regularly review the policy framework and process for cybersecurity and data privacy risk and propose recommendation for revision to the Board of Directors and determine risk metrics of the Company’s business;
Promote and implement the policy by enhancing the level of cybersecurity risk awareness through the development of appropriate procedures and commitment of resources;
Support the monitoring of risks including cybersecurity risk and data privacy risk across the Company and regularly report to the Board of Directors;
Oversee and review the cybersecurity and privacy protection management and performance of the Company, including meeting regularly with management and commenting and giving opinions on any recommendations of management to the Board of Directors regarding long and short term strategies, expenses, etc.
Monitor and evaluate the cybersecurity and privacy protection performance of the Company against the Company’s budget

Mr. Vichaow Rakphongphairoj previously served as Group Chief Operating Officer of True Corporation Public from 2008 to 2016 overseeing network and technology operations including information technology and cybersecurity. He was subsequently appointed Deputy Chief Executive Officer from 2016 to 2017 and later served as Co-President from 2017 to 2019.

CYBERSECURITY & DATA PROTECTION POLICY

Cybersecurity and data protection are critical concerns globally, particularly in the telecommunications industry, which faces over 6 billion cyberattacks annually.

High ethical standards form the foundation of the Company’s business practices, applied to employees, business partners, and stakeholders across all regions and situations. Organizational integrity is seen as a key indicator of success and sustainable
growth.

At True, we are committed to upholding the highest standards of cybersecurity and data protection to safeguard customer, partner, and employee information. To reinforce our commitment to protecting data and maintaining a secure digital ecosystem, True has developed and implemented the True Information Security Policy, which provides a comprehensive framework for managing information security risks across our operations.

The policy outlines our strategic direction and operational approach to ensure business continuity, safeguard stakeholder trust, and comply with relevant legal and regulatory requirements. It covers a wide range of critical areas, including but not limited to:

Ensuring the integrity, confidentiality, and availability of data and IT assets
Establishing clear roles, responsibilities, and accountability for information security across all levels of the workforce
Defining information security requirements for third parties, including suppliers and service providers
Managing access control and protecting against unauthorized access, loss, or misuse of data
Promoting information security awareness and training to build a culture of vigilance
Supporting secure system development and changing management processes
Monitoring, detecting, and responding to information security threats in a timely and effective manner
Ensuring incident response procedures are in place to manage and mitigate potential breaches
Conducting audits and reviews to assess compliance and identify areas for improvement
Continuously improving information security systems through regular assessments and updates

This policy is reviewed regularly and integrated into True’s broader risk management and governance frameworks.

In addition, as part of our commitment to continuous improvement, True has appointed dedicated IT and Information Security personnel responsible for overseeing the performance and advancement of our security systems. Regular cross-functional meetings are conducted with relevant departments and management level to assess the status of IT operations and identify any security-related issues or opportunities for improvement. Through this structured engagement, key findings and proposed enhancements are escalated to management for timely review and decision-making.

IT & SECURITY STRUCTURE AND RESPONSIBLE PERSONNEL

The IT & Security Division and the Business Security Department both report to Chief IT and Security Officer (CISO). These units are responsible for overseeing data and cybersecurity operations and report their performance to various committees, including the Risk, Cybersecurity and Finance Committee, as well as the company’s Board of Directors.

The CISO has the following duties and responsibilities:

Establish procedures for controlling and auditing third parties and external agencies authorized to access the company’s data and assets, ensuring strict adherence to this policy.
Regularly review the company’s policies and practices related to information and cybersecurity, assess risks, and ensure that high-risk issues are recorded in the company’s risk register.

Additionally, the Head of Security was appointed with the primary responsibility of ensuring that data and asset security operations align with company policies and providing performance progress updates, including reports on any policy violation incidents.

True has Personal Data Protection Policy designed in accordance with the PDPA framework, which is enforced rigorously within the Company, including subsidiaries, business partners and those appointed to act on behalf of the Company. One key aspect of the policy is defining the Company’s role as a “Data Controller,” which entails the authority to determine the purposes and methods of processing personal data arising from business operations. This is considered the duty and responsibility of the Company as the Data Controller, requiring various measures to ensure effective and appropriate data protection under PDPA principles and using customer data only for the purposes for which consent has been provided.

Additionally, a Data Protection Officer (DPO) is appointed, tasked with providing guidance to management, employees, and relevant individuals on risks and best practices regarding personal data processing. The DPO reports non-compliance and policy violations to the Company’s management and operates independently to review the use of personal data within the Company’s internal activities without interference.

The policy includes other important aspects in line with the PDPA, such as:

Defining the responsibilities of employees or authorized personnel who access personal data, along with implementing controls and access limitations.
Clearly defining the duration of data retention, usage, and destruction, as specified in customer consent agreements, and strictly adhering to these guidelines.
Establishing procedures to control and audit partners and external entities authorized to access personal data from the Company, ensuring strict compliance with this policy.
Making personal data protection a focal point in internal audits across all business operations, reporting audit findings to the Audit Committee, and taking immediate corrective actions upon discovering violations or policy breaches.
Regularly reviewing policies, practices and assessing risks related to personal data, with high-risk issues being documented in the Company's risk register.
Establishing data storage and maintaining records of customer personal data.
Providing channels for complaints and reporting situations that may deviate from or violate policies and practices.
Enhancing employee understanding and capabilities through communication, knowledge training, and awareness-building initiatives.

The Company assesses and reviews its personal data sharing processes and practices with internal entities and third parties annually, conducted by both internal and external auditors to ensure privacy policy compliance.

IT & SECURITY MANAGEMENT PROGRAM

To ensure the integrity, resilience, and continuous improvement of our cybersecurity infrastructure, True has developed a comprehensive IT system and audit framework aligned with international standards and industry best practices. This framework is designed not only to protect data and digital assets but also to strengthen stakeholder confidence through transparency and accountability.

Key elements of our IT system and testing/audit program include:

Security Management Systems & Operational Procedures

True has established formal security management systems that integrate key components such as risk assessment, access control, data protection, and incident response. These are supported by:

A regularly tested Business Continuity Plan (BCP) to ensure operational resilience
- This process clearly outlines roles, responsibilities, and communication channels to promptly escalate incidents to appropriate response teams and management, ensuring timely containment, investigation, and resolution of security events A defined escalation process for managing security incidents
Clearly documented internal procedures, such as the “Information Security Incident Response Procedure” and “IT Risk Management Guidelines“
- These procedures provide step-by-step guidance for identifying, reporting, analyzing, and mitigating information security risks and incidents, supporting consistent and effective handling aligned with organizational policies and compliance requirements

Certification: ISO/IEC 27001

True has established a comprehensive cybersecurity and data protection framework aligned with international standards to safeguard sensitive information and maintain digital resilience.
The Company achieved ISO/IEC 27001:2022 certification, reflecting full compliance across all operations. In 2024, True successfully upgraded its ISO 27001 certification from 2013 to the 2022 version, covering all business operations and ensuring 100% compliance and keeping maintained with 2022 version.

3. Data Governance & Operational Safeguards

Data Classification & User Access Review:
- Annually conducted to categorize data based on sensitivity and manage access rights accordingly.
Data Loss Prevention (DLP):
- Annually Fully implemented DLP systems to prevent unauthorized data leaks.
Disaster Recovery Plan (DRP):
- DRP and Incident Response Plans are reviewed semi-annually for critical systems.

4. Penetration Testing, Vulnerability Scanning & Threat Response

Penetration and Vulnerability Testing:
- Includes simulated attacks and abnormal behavior detection using advanced analytics for real-time threat prevention.
- Performed annually to assess over 2,000 servers for system weaknesses and strengthen cyber defenses.
Vulnerability Analysis & Threat Management
- A regular vulnerability assessments and threat analysis activities is conducted to identify potential system weaknesses.

5. Employee Awareness & Capacity Building

Cybersecurity Awareness Training: 100% of employees participated in both online and on-site training sessions to promote a security-first mindset.
Security Personnel & Governance: A dedicated cybersecurity team and responsible officers—including the appointed Data Protection Officer (DPO)—oversee policy implementation, threat monitoring, and issue escalation to management.

PERSONAL DATA PROTECTION POLICY

The policy includes other important aspects in line with the PDPA, such as:

Defining the responsibilities of employees or authorized personnel who access personal data, along with implementing controls and access limitations.
Clearly defining the duration of data retention, usage, and destruction, as specified in customer consent agreements, and strictly adhering to these guidelines.
Establishing procedures to control and audit partners and external entities authorized to access personal data from the Company, ensuring strict compliance with this policy.
Making personal data protection a focal point in internal audits across all business operations, reporting audit findings to the Audit Committee, and taking immediate corrective actions upon discovering violations or policy breaches.
Regularly reviewing policies, practices and assessing risks related to personal data, with high-risk issues being documented in the Company’s risk register.
Establishing data storage and maintaining records of customer personal data.
The Company will only use personal data for marketing, promotional, or analytical purposes with the customer’s prior consent.
Customers have the right to withdraw their consent for specific data processing at any time.

Enhancing employee understanding and capabilities through communication, knowledge training, and awareness-building initiatives.
Providing channels for complaints and reporting situations that may deviate from or violate policies and practices.
Punitive measures in case of privacy policy violation by any employees, suppliers or business partners, the company will consider taking punitive measures according to our regulations and/or taking appropriate legal action.

During 2025, we fulfilled 100% of all customer requests for data access, correction, deletion, and
portability, while also handling 826 inquiries for Call Detail Records (CDR). Additionally, 71% of customer personal data is used for secondary purposes in accordance with the company’s policy with prior consent obtained from the customers.

HANDLING AUTHORITY REQUESTS FOR DATA DISCLOSURE

COMPLIANT REPORTING AND HANDLING, REMEDIATION AND PUNISHMENT

True provides channels for employees, customers, partners, and the general public to report complaints and situations that may violate or deviate from the company’s policies and practices regarding data security and customer data protection. These reports are handled through processes involving assessment, investigation, inquiry, mediation, and penalties for violations of the company’s Code of Conduct. The Compliance & Ethics Department oversees these processes. In the event of personal data breaches, the company has effective legal remedies in accordance with PDPA criteria and methods. If violations that contravene policies are identified, legal penalties will be considered. Additionally, if company employees violate policies and practices, they will face disciplinary action in accordance with the Code of Conduct and may be subject to legal penalties as prescribed by law.

e-mail: TruePrivacy@truecorp.co.th
CyberSOC@truecorp.co.th

True Call Center 1424
dtac Call Center 1678

Every Branch of True and dtac Shops

RESPONSIBLE ARTIFICIAL INTELLIGENCE (RAI)

True Corporation has embraced artificial intelligence as a core pillar of its strategic direction, using AI to modernize its network, protect its customers, and strengthen its communities. As AI adoption accelerates across the business including governance, processes, and culture needed to ensure that AI is developed and used responsibly.

Since the Responsible Artificial Intelligence (RAI) governance framework was formally established, True has moved quickly from policy design to enterprise-wide implementation across the organization, RAI governance and assurance process are now mandatory for every new AI use case, and Responsible AI training has been made compulsories for all employees. The sections below describe how this program works and the impact it has already had on delivery.

Policy and Commitments

Policy coverage

True’s Responsible AI Policy Statement, part of the Company’s broader corporate governance framework, commits True to the responsible development, deployment, and use of AI in a manner that supports good corporate governance, accountability, human oversight, data protection, security, and compliance with applicable laws and regulations. It establishes an AI governance framework that manages AI across its full lifecycle; acquisition, design, development, deployment, monitoring, and decommissioning, under a structured, risk-based approach, and is read together with the Company’s Corporate Governance Policy and its wider risk management, compliance, privacy, data protection, and security frameworks.

Governance structure

Responsible AI is not managed as a stand-alone function, it is embedded in True’s existing governance architecture and reinforced by two dedicated AI bodies at policy and operational level, so that oversight scales with the pace of AI adoption across the business.

Roles and Responsibilities

1. Board of Directors

Approves the AI Governance Policy, sets strategic direction, oversees key AI risks and controls, and promotes ethical AI use.

2. AI Governance Committee

Senior governance body responsible for AI policy-level matters and enterprise-wide governance standards.

3. AI Council Committee

Operational governance committee that reviews and approves new AI use cases and monitors live use cases, meeting on a biweekly cadence with priority given to high-risk items.

4. Data Protection Office (DPO)

Reviews every use case for data-privacy impact, issues a Data Privacy Impact Assessment (DPIA) where required, and prescribes mitigating controls before development proceeds.

5. Information Technology (IT) / Security

Manages secure AI infrastructure, implements and verifies cybersecurity and data-protection controls prior to launch, and monitors technology-related risk, including for externally hosted / vendor AI.

6. AI Developer / Use-case Owner

Ensures the AI system is accurate, secure, reliable, and traceable; completes the risk-screening, privacy, and deployment checklists; owns post-launch monitoring and remediation.

7. Employees Comply with the Policy, use AI responsibly, and report concerns or suspicious activity through designated channels; completion of mandatory RAI training is required of every employee.

True’s AI Charter

AI usage is comprising of 3 aspects:

1. Setting ethical goals,

2. Ensuring all employees have technology knowledge for the transition to a Data-First and AI-First organization, and

3. Prioritizing ethical principles in AI usage.

True has already drawn up “True’s AI Charter” to lay down AI governance guidelines for its internal use. This charter prescribes four following guidelines:

1. Good Intent: AI should only be used for the benefit of customers and not pose a threat to others.

2. Fairness and Bias Mitigation: AI must not lead to results that reflect discriminatory practices.

3. Data Privacy and AI Functionality: The outcomes of AI usage should adhere to privacy principles, respecting the level of access customers provide.

4. Transparency: Despite the complexity of AI operations, the results of AI processing must be explainable, considering “rights” where consumers are paramount.

True Corporation Reaffirms Its Position as a Thai Tech Company, Emphasizing That No Matter How Intelligent AI Becomes, It Must Be Used Ethically, with Respect for Human Rights, Transparency, and Accountability

In today’s fast-paced digital world powered by technology, Artificial Intelligence (AI) is rapidly playing a significant role in both business and society. With processing capabilities over 200,000 times faster than the human brain, AI can diagnose diseases with over 95% accuracy and support sustainability efforts, such as addressing climate change. However, on the other hand, AI can be a “double-edged sword.” Without ethical frameworks, it can lead to privacy violations, the spread of misinformation, and increased inequality due to biases hidden within the data used to train AI. As a technology organization that recognizes the importance of ethical AI development, True Corporation reiterates its commitment to supporting the ethical use of AI.

AI is a technology closely linked to personal data protection. As an organization committed to good governance principles, True places great importance on safeguarding customers’ personal data, which is another dimension of respecting human rights in the digital era. The company adheres to the principle of “Privacy and Security by Design,” ensuring that customer privacy is protected from the very beginning of the design process. True also evaluates the impact of every service involving personal data, especially those resulting from the use of AI technology.

1. Transparency – Providing clear and explainable information about AI processes and decision-making, based on factual evidence.

2. Respect for Human Rights – Upholding the dignity, privacy, and freedom of every individual, ensuring that AI does not harm humans.

3. Fairness and Inclusion – Ensuring that AI delivers equitable outcomes, free from bias and discrimination against any individual.

4. Human-Centered Design – Prioritizing the well-being, safety, and accessibility of all users.

True Corporation is the first organization in Thailand to implement a Responsible AI (RAI) policy in accordance with the GSMA’s framework at the organizational level. The company has integrated the RAI Framework into its internal processes and established guidelines for performance evaluation aligned with international standards. This ensures the safe, fair, and sustainable use of AI, in line with global best practices.

Prohibited practices and human rights

True’s Policy prohibits AI applications presenting unacceptable risk, including manipulative or deceptive systems that distort human behavior, exploitation of vulnerabilities, social scoring, prohibited biometric categorization, and unauthorized biometric surveillance aligned with the prohibited-practice provisions of the EU AI Act. AI systems are further required to be acquired, designed, developed, and used with consideration of fairness and non-discrimination, avoiding unfair impact on individuals or groups, consistent with human-rights principles.

Our Responsible AI Process

Policy commitments are operationalized through a mandatory pathway that every AI initiative, whether built in-house, customized from a vendor model, or procured from an external provider, must pass through. The pathway is organized into three stages, each anchored by a specific checklist and clear escalation points to the AI Council.

Development stage

Business case and prioritization: Every proposed AI use case begins with a value-assessment session to confirm business rationale and prioritization before any build work starts.
Risk screening: The use-case owner completes a 7-question risk-screening questionnaire covering, among other factors, whether the use case serves an internal or external population, the type of user (employee, business partner, or customer), and the level of autonomy / degree of human involvement in decision-making. The output classifies the use case as High, Medium, or Low risk.
Escalation for high-risk use cases: High-risk use cases must be reviewed and approved by the AI Council before development begins; Medium- and Low-risk use cases proceed directly into design and development, with proportionate oversight.
Privacy review: Before development starts, the DPO reviews the proposed solution for personal-data implications, including any transfer of data outside the Company or to third parties and where required, prescribes specific mitigating controls that must be built into the solution.
Council endorsement to proceed: The relevant internal committee confirms that the DPO’s recommended controls have been accepted before the use case is permitted to move from design into development.

Pre-launch stage

Before any AI use case is permitted to go live, it must complete the RAI Deployment Checklist, and an independent security review and privacy controls must be implemented as designed. The Deployment Checklist covers:

Model quality and reliability: For generative AI, hallucination and inaccuracy rates need to be tested against thresholds that scale with risk classification (tighter tolerances for High-risk use cases than for Medium- or Low-risk use cases); bias and predictive-performance metrics such as AUC and F1-score also need to be evaluated.
Bias and fairness testing: Structured testing is required before launch to identify harmful, discriminatory, or offensive outputs.
Human oversight: A human-in-the-loop or human-override mechanism appropriate to the use case’s risk level must be established.
Committee sign-off: The completed checklist, together with confirmed privacy and security control implementation, is to be reviewed by the AI Council, which grants (or conditionally grants, pending remediation of minor findings) approval to launch.

In-use stage

Documented post-deployment monitoring plan: Every use-case owner must define and document the monitoring frequency, the responsible individual for monitoring, and the performance and bias metrics/thresholds that will be tracked in production, tailored to that specific use case and maintained throughout the use case’s operational life.
Ongoing AI Council oversight: The AI Council meets biweekly to review both new and existing use cases, prioritizing High-risk use cases given the scale of True’s AI portfolio.
Detection and remediation of drift or degraded performance: Where monitoring identifies model drift, rising hallucination rates, or other deviations from the agreed thresholds, the finding is reported back to the AI Council, remediation is assigned to the use-case owner (via True’s internal service-request / ticketing process), and the fix is re-tested through the same privacy and deployment checklists before being reintroduced ensuring existing use cases are held to the same standard as new ones.
Transparency to users: The users shall be clearly informed when they are interacting with, or receiving content generated by, an AI system, and that AI-generated content is appropriately labelled.
Feedback channels: Every AI use case has a contactable responsible owner, so that internal users, business partners, or customers encountering an issue can escalate directly. Customer-facing AI within the True App is embedded with an in-app feedback mechanism that flows back to the responsible team for review.

Responsible AI in Practice: Selected Use Cases

The following examples illustrate how True’s governance framework and three-stage process translate into real safeguards and measurable outcomes across the business, from biometric access control to third-party infrastructure oversight, to flagship AI programs delivering environmental and social impact.

Facial recognition

For AI use cases involving facial recognition, True applies strict, role-based access segregation between the systems that process biometric or personal identifiers and the teams that consume the AI’s output. Access to the underlying facial and identity data is restricted to a small, designated back-end group responsible for managing the recognition model; front-end teams and downstream business users receive only the recognition result (e.g., a match / no-match or classification outcome) and do not have access to underlying personal image or identity detail. This access-limitation approach is a direct application of the Policy’s data-minimization, access-management, and “process confidential data only through company-approved, access-restricted AI systems” principles, and is documented, use case by use case, through the risk-screening and privacy-checklist process.

Third-party AI infrastructure and data centers

True’s AI workloads run on a mix of internally managed IT infrastructure and externally hosted facilities, including third-party data centers. Reflecting the Policy commitment that both internal and third-party AI data centers and models are required to optimize computational efficiency and minimize their ecological footprint. True has begun formally requesting security-control and environmental-performance information (including renewable-energy sourcing) from its external AI hosting and vendor partners, extending the same due-diligence standard already applied to internally hosted systems.

Flagship programs delivering measurable impact

Beyond internal governance, a number of True’s AI initiatives are already delivering quantified environmental and social outcomes. A high-level overview is provided below; more detail on the program are disclosed in True’s Sustainability Report.

Energy and GHG management

GENIE (Green Energy Network Intelligence): AI/ML-based optimization of energy use at mobile network base stations, saving more than 180 million Baht per year in energy costs while lowering carbon emissions.
One Network modernization: AI and machine learning support network consolidation and reduction of redundant towers, contributing to a 15–20% reduction in carbon emissions in line with the Company’s 2050 net-zero target.

Biodiversity

True Smart Early Warning System (TSEWS) Project: AI, 5G, and IoT-based monitoring of human–elephant conflict, developed with WWF Thailand, now covering 700 elephants and 23 villages in Kui Buri, and extended to five eastern provinces. Reported conflict incidents fell from 226 (2018) to zero (2024–2025).

Waste and paperless operations

Digital, AI-enabled approval workflows and e-Billing/e-Tax Invoice: Reduced paper usage by 347 million sheets per year (1,737 tons) and avoided an estimated 3,651 tonCO₂e per year, with a target of 100% automation of internal approvals by 2027.

Human rights and cybersecurity

True CyberSafe: Free, AI-powered threat-detection system protecting more than 60 million customers, built on a database of 300,000+ suspicious phone numbers and 100,000+ risky URLs.

Community — education

World Library: AI-powered educational content hub hosting over 12,000 items, reducing teachers’ workload in sourcing instructional materials.

Community — agriculture

True Smart Farmer and precision fertigation (with Netafim): AI-powered smart collars across 15 provinces drove a more than 50% increase in dairy yield and over 150 million Baht in annual economic value, while an AI-integrated fertigation system supports climate-resilient during production.

Building AI Capability

True treats AI literacy and responsible-use training as a foundation of “AI-First” strategic direction, not an afterthought. Responsible AI training has been mandatory for every employee, a compulsory course that all staff, without exception, must complete.

LEARNATHON: True’s enterprise upskilling initiative set a target of 45 hours of AI and digital upskilling/reskilling per employee actual performance exceeded the target, reaching an average of 51 hours per employee.
Digital and AI Foundations: Delivered through True Digital Academy, this comprehensive course combines online and hands-on learning with more than 90% of the workforce has completed it.
AI Proficiency Development Program (AI Users): A structured program across five specialized tracks; Process Improvement & Automation with AI, Data with AI, Business & Innovation with AI, Digital Marketing with AI, and Improving Customer Experience with AI, combining theoretical learning with hands-on, workplace-relevant AI projects. More than 200 participants graduated from the program in 2025, selected from across all business units.

Together, these programs ensure that the employees closest to each AI use case, not just a central governance team, to understand how to build, deploy, and monitor AI responsibly.

Way Forward

True upgraded its information-security certification from ISO/IEC 27001:2013 to ISO/IEC 27001:2022. Building on this, True is working to align its AI governance framework with the ISO/IEC 42001:2023 standard for AI Management Systems (AIMS), using it as an implementation framework to help ensure that the integration of AI technology across the organization remains secure, transparent, accountable, and fair.

True’s Responsible AI program is deliberately designed to mature over time. Priorities for the year ahead include:

Continuing to align True’s AI Management System with ISO/IEC 42001:2023 as an implementation framework and evaluating next steps for external verification.
Extending environmental due diligence (including renewable-energy sourcing data) to other third-party AI hosting and vendor partners, building on the engagement already underway with external data-center providers.
Formalizing a company-wide AI feedback / escalation channel that complements existing use-case-level ownership and in-app feedback mechanisms.
Continuing to close out legacy (pre-framework) high-risk use cases against the full risk-screening, privacy, and deployment checklist standard now applied to all new AI initiatives.