Activities
Artificial Intelligence
Guide businesses on AI challenges.
Objectives
The mission of this group is to address and provide guidance to businesses on how to manage the complexities triggered by AI and its impact on cybersecurity and trust.
Artificial Intelligence (AI)
AI is transforming the cybersecurity landscape for businesses, offering both unprecedented opportunities and complex challenges. On the positive side, AI enhances cybersecurity by automating threat detection, improving response times, and predicting potential security breaches through advanced analytics and machine learning algorithms. These capabilities enable businesses to proactively defend against cyber threats, minimize vulnerabilities, and enhance overall security posture.
However, the integration of AI also introduces new cybersecurity risks. AI systems can themselves become targets for cyberattacks, potentially being manipulated or exploited by malicious actors. Additionally, the complexity and opacity of some AI algorithms can make it difficult to identify and mitigate biases and vulnerabilities, leading to security gaps.
The Charter of Trust Partners aim to establish clear guidelines that promote AI innovation while ensuring security and compliance with evolving AI regulations.
Our way of working
Our AI workstream focuses on the implementation of the AI Act among other cybersecurity challenges and opportunities brought by these technologies. The work of our Partners in structured around the following topics:
BANNED PRACTICES
Support in assessing Partners’ AI systems, identifying information required for governance compliance and inform internal AI Governance Entity.
GPAI RULES
Work in 2025.
MINIMUM LITERARY REQUIREMENTS
Basic AI concepts, Ethical considerations and potential risks of AI, Data governance and privacy, Human oversight and the role of humans in AI systems, specific requirements for high-risk AI systems.
INTERNAL GOVERNANCE AND TRUST LABEL
Ongoing work.
Our latest activities
Latest news, publications, events
What we have been up to
Artificial Intelligence
Webinar: Out of the Shadows: Can We Make Shadow AI Secure by Default?
AI is already part of everyday work. Employees use it to summarize documents, write code, translate text, and analyze information. Much of that use is legitimate and useful. Problems arise when employees turn to tools that sit outside approved corporate environments, leaving organizations with limited visibility over what is being used, what data is being shared, and what those tools can access or do.
On November 5, the Charter of Trust brought together experts from cybersecurity, enterprise risk, and technology to discuss how companies can manage Shadow AI without shutting down useful AI adoption.
Moderated by Friso Jankowsky (Atos), the panel featured Sudhir Ethiraj (TÜV SÜD), Tony Fergusson (Zscaler), Haydn Griffiths (Allianz Commercial), Scott Kannry (Axio), and Andy Schneider (Palo Alto Networks).
A clear message emerged: Shadow AI is often driven by unmet business demand. If approved tools are too limited, slow, or difficult to use, employees will look for alternatives.
The discussion highlighted four priorities:
- Make secure AI the easier option. Blanket bans can push AI use further into the shadows.
- Control data, access, and actions. AI agents should only see the information and perform the functions they need.
- Build security in from the start. Security by Default means clear guardrails, protected data flows, and defined recovery mechanisms.
- Prepare for faster incidents. AI can increase the speed and scale of both attacks and operational failures, making resilience and crisis preparedness more important.
The conclusion was not to slow AI adoption to a halt, but to make it safer through trusted tools, clear boundaries, and better preparation.
Thank you to everyone who joined the discussion. A recording of the webinar can be found at the bottom of this page.
On November 5, the Charter of Trust brought together experts from cybersecurity, enterprise risk, and technology to discuss how companies can manage Shadow AI without shutting down useful AI adoption.
Moderated by Friso Jankowsky (Atos), the panel featured Sudhir Ethiraj (TÜV SÜD), Tony Fergusson (Zscaler), Haydn Griffiths (Allianz Commercial), Scott Kannry (Axio), and Andy Schneider (Palo Alto Networks).
A clear message emerged: Shadow AI is often driven by unmet business demand. If approved tools are too limited, slow, or difficult to use, employees will look for alternatives.
The discussion highlighted four priorities:
- Make secure AI the easier option. Blanket bans can push AI use further into the shadows.
- Control data, access, and actions. AI agents should only see the information and perform the functions they need.
- Build security in from the start. Security by Default means clear guardrails, protected data flows, and defined recovery mechanisms.
- Prepare for faster incidents. AI can increase the speed and scale of both attacks and operational failures, making resilience and crisis preparedness more important.
The conclusion was not to slow AI adoption to a halt, but to make it safer through trusted tools, clear boundaries, and better preparation.
Thank you to everyone who joined the discussion. A recording of the webinar can be found at the bottom of this page.
Read more
November 6, 2026
Artificial Intelligence
AI Policy Paper
Artificial intelligence has become a critical component of modern industrial processes, cybersecurity operations, and digital infrastructure. As companies increasingly build and integrate their own AI capabilities, the need for secure, trustworthy, and compliant digital environments has never been more pressing.
In this paper, our AI Working Group provides a clear framework for organisations to navigate this landscape, marked by concentrated provider ecosystems, fragmented global regulations, and geopolitical supply chain risks, alongside the internal requirements necessary to build AI responsibly.
A key aspect is helping organisations prepare for the EU AI Act, based on the overarching principle that compliance cannot be treated as a simple checklist exercise, and should instead drive strategic transformation. Organisations are encouraged to ensure visibility over all AI systems in use, promoting alignment across technical, legal, and business functions. Strengthening governance is equally critical. Executive level oversight, supported by operational teams, should lead to consistent, iterative risk assessment throughout the AI lifecycle, ensuring that performance, ethical, legal, and operational risks are identified and addressed early.
Companies must also balance compliance investments against the financial and reputational risks of non compliance. The penalties under the AI Act are substantial. However, proactive preparation not only reduces exposure, it can also create a competitive advantage by enabling faster innovation, strengthening customer relationships and regulator trust, and reducing uncertainty in product development.
Looking ahead, organisations should treat AI governance as a long term, adaptive discipline. Regulation and technology will continue evolving, and resilience depends on flexible policies, modular system architectures, and scalable governance processes.
Continuous monitoring of regulatory developments, active participation in standards setting activities, and sustained investment in skills are essential to fostering a responsible AI culture centred around a holistic understanding of compliance.
Please download the full report below.
In this paper, our AI Working Group provides a clear framework for organisations to navigate this landscape, marked by concentrated provider ecosystems, fragmented global regulations, and geopolitical supply chain risks, alongside the internal requirements necessary to build AI responsibly.
A key aspect is helping organisations prepare for the EU AI Act, based on the overarching principle that compliance cannot be treated as a simple checklist exercise, and should instead drive strategic transformation. Organisations are encouraged to ensure visibility over all AI systems in use, promoting alignment across technical, legal, and business functions. Strengthening governance is equally critical. Executive level oversight, supported by operational teams, should lead to consistent, iterative risk assessment throughout the AI lifecycle, ensuring that performance, ethical, legal, and operational risks are identified and addressed early.
Companies must also balance compliance investments against the financial and reputational risks of non compliance. The penalties under the AI Act are substantial. However, proactive preparation not only reduces exposure, it can also create a competitive advantage by enabling faster innovation, strengthening customer relationships and regulator trust, and reducing uncertainty in product development.
Looking ahead, organisations should treat AI governance as a long term, adaptive discipline. Regulation and technology will continue evolving, and resilience depends on flexible policies, modular system architectures, and scalable governance processes.
Continuous monitoring of regulatory developments, active participation in standards setting activities, and sustained investment in skills are essential to fostering a responsible AI culture centred around a holistic understanding of compliance.
Please download the full report below.
Read more
February 10, 2026
Artificial Intelligence
3rd CyberTrust Talk - Digital Omnibus & Trust - What it Means for Business in Europe?
Join us for a timely and dynamic edition focused on “Digital Omnibus & Trust: What It Means for Business in Europe” kindly hosted by the Representation of the Free State of Bavaria to the EU on November 20, 2025 at 11:00 AM (Central European Time) for a lunch event filled with insightful discussions on cybersecurity and trust in the digital age.
With the European Commission unveiling its landmark Digital Omnibus Package just one day before, this event is your exclusive opportunity to be among the first to explore its real-world impact on business and the digital economy across Europe.
What to Expect:
Opening remarks by:
Dr. Armin Hartmuth, Director, Representation of the Free State of Bavaria to the European Union
Dr. Sumit Chanda, COO, Atos Group Security & Business Lines CISO, and Co-Chair of the Charter of Trust.
Keynote Address:
Despina Spanou, Deputy Director General for Cybersecurity and Trust, European Commission (DG CNECT), will share first-hand insights into the objectives and expected impact of the Digital Omnibus Package.
Expert Panel Discussion featuring:Moderated by Sudhir Ethiraj, Global Head of Cybersecurity Office, CEO Business Unit Cybersecurity Services, TÜV SÜD.
Despina Spanou, Deputy Director General for Cybersecurity and Trust, European Commission (DG CNECT)
Kia Slæbæk Jensen, Cyber Advisor, Permanent Representation of Denmark to the EU
Suzanne Button, Field CTO EMEA, Elastic
Tomas Jakimavicius, Director European Government Affairs, Microsoft
Yana Humen, AI and Cybersecurity Policy Manager, Government and Regulatory Affairs, IBM
Interactive Q&A: Bring your questions and join the conversation on regulatory coherence, innovation, and the future of digital governance in Europe.
Closing remarks by Maria del Pino Gonzalez-Junco, Director of the Charter of Trust
Networking Lunch: Connect with peers, policymakers, and industry leaders in an informal setting.
Why attend?
Gain first-hand insights into the EU’s Digital Omnibus Package—straight from the policymakers and experts shaping it.
Understand the immediate implications for your business and how to navigate upcoming changes.
Be part of a strategic dialogue that could influence the future of digital regulation in Europe.
With the European Commission unveiling its landmark Digital Omnibus Package just one day before, this event is your exclusive opportunity to be among the first to explore its real-world impact on business and the digital economy across Europe.
What to Expect:
Opening remarks by:
Dr. Armin Hartmuth, Director, Representation of the Free State of Bavaria to the European Union
Dr. Sumit Chanda, COO, Atos Group Security & Business Lines CISO, and Co-Chair of the Charter of Trust.
Keynote Address:
Despina Spanou, Deputy Director General for Cybersecurity and Trust, European Commission (DG CNECT), will share first-hand insights into the objectives and expected impact of the Digital Omnibus Package.
Expert Panel Discussion featuring:Moderated by Sudhir Ethiraj, Global Head of Cybersecurity Office, CEO Business Unit Cybersecurity Services, TÜV SÜD.
Despina Spanou, Deputy Director General for Cybersecurity and Trust, European Commission (DG CNECT)
Kia Slæbæk Jensen, Cyber Advisor, Permanent Representation of Denmark to the EU
Suzanne Button, Field CTO EMEA, Elastic
Tomas Jakimavicius, Director European Government Affairs, Microsoft
Yana Humen, AI and Cybersecurity Policy Manager, Government and Regulatory Affairs, IBM
Interactive Q&A: Bring your questions and join the conversation on regulatory coherence, innovation, and the future of digital governance in Europe.
Closing remarks by Maria del Pino Gonzalez-Junco, Director of the Charter of Trust
Networking Lunch: Connect with peers, policymakers, and industry leaders in an informal setting.
Why attend?
Gain first-hand insights into the EU’s Digital Omnibus Package—straight from the policymakers and experts shaping it.
Understand the immediate implications for your business and how to navigate upcoming changes.
Be part of a strategic dialogue that could influence the future of digital regulation in Europe.
Read more
November 5, 2025
