Artificial Intelligence (AI) is rapidly becoming a cornerstone of economic competitiveness, public service delivery, and national security. At the same time, it introduces new systemic risks to cybersecurity, privacy, and societal trust. This paper, developed under the Charter of Trust’s Principle 3 “Security by Default”, addresses this dual challenge: securing AI systems throughout their lifecycle while responsibly leveraging AI to strengthen cybersecurity.

Aligned with the Charter of Trust’s overarching goals—to protect data, prevent harm to people and infrastructure, and establish a reliable foundation for trust in a digital world—the paper outlines how Security by Default can operationalize Trustworthy AI. It positions security not as a reactive compliance exercise, but as an inherent, continuously enforced design principle that enables innovation while safeguarding resilience, transparency, and accountability.

Against a backdrop of increasing geopolitical competition, fragmented regulatory regimes, and accelerating AI adoption, the paper highlights the strategic importance of trust as a differentiator for organizations and societies alike. It examines key governance, technical, and regulatory risks surrounding AI, and underscores the need for coherent governance models that integrate cybersecurity, privacy, and ethical considerations from design through deployment and operation.

Building on the Charter of Trust’s prior work, the paper provides a high-level framework for embedding Security by Default across the AI lifecycle, aligned with emerging global regulations such as the European Union (EU) AI Act. It also demonstrates how AI, when securely designed and governed, can serve as a powerful enabler of cybersecurity—enhancing threat detection, incident response, and risk management.
Ultimately, the paper reinforces the Charter of Trust’s conviction that trust, security, and innovation must advance together. By embedding Security by Default and Trustworthy AI principles at the core of AI development and use, organizations can strengthen digital trust, improve resilience, and contribute to a safer and more reliable digital future.

Please download the full report below.

Artificial intelligence has become a critical component of modern industrial processes, cybersecurity operations, and digital infrastructure. As companies increasingly build and integrate their own AI capabilities, the need for secure, trustworthy, and compliant digital environments has never been more pressing.

In this paper, our AI Working Group provides a clear framework for organisations to navigate this landscape, marked by concentrated provider ecosystems, fragmented global regulations, and geopolitical supply chain risks, alongside the internal requirements necessary to build AI responsibly.

A key aspect is helping organisations prepare for the EU AI Act, based on the overarching principle that compliance cannot be treated as a simple checklist exercise, and should instead drive strategic transformation. Organisations are encouraged to ensure visibility over all AI systems in use, promoting alignment across technical, legal, and business functions. Strengthening governance is equally critical. Executive level oversight, supported by operational teams, should lead to consistent, iterative risk assessment throughout the AI lifecycle, ensuring that performance, ethical, legal, and operational risks are identified and addressed early.

Companies must also balance compliance investments against the financial and reputational risks of non compliance. The penalties under the AI Act are substantial. However, proactive preparation not only reduces exposure, it can also create a competitive advantage by enabling faster innovation, strengthening customer relationships and regulator trust, and reducing uncertainty in product development.

Looking ahead, organisations should treat AI governance as a long term, adaptive discipline. Regulation and technology will continue evolving, and resilience depends on flexible policies, modular system architectures, and scalable governance processes.

Continuous monitoring of regulatory developments, active participation in standards setting activities, and sustained investment in skills are essential to fostering a responsible AI culture centred around a holistic understanding of compliance.

Please download the full report below.

Navigating Cybersecurity in an Era of Hybrid Threats

As hybrid threats continue to evolve, cybersecurity has never been more critical. The latest Charter of Trust report, launched at the Munich Security Conference, presents exclusive insights from leading CISOs and CSOs across our Partner network. This report provides a comprehensive analysis of the shifting threat landscape and the strategic actions necessary to enhance global resilience.

Key Insights from the Report

- The Growing Threat Landscape: Cyber adversaries are emerging across the globe, leveraging increasingly sophisticated tactics. Advanced threat detection and multi-layered defense strategies are no longer optional but essential.

- Breaking Down Security Silos: Cyber threats are constantly evolving—organizations cannot afford to wait. A proactive, collaborative approach is critical, fostering open dialogue across industries and sectors.

- Leadership in Collective Defense: Multinational corporations have a unique responsibility to lead in both technical defense and talent development, while also advancing zero trust architectures to mitigate risks effectively.

Collaboration as the Foundation of Cyber Resilience

The experiences of Charter of Trust partners highlight the importance of collective action in addressing the complexities of hybrid threats. Operating in high-stakes environments, these organizations provide valuable lessons for improving industry-wide preparedness.

A Call for Unified Action

Hybrid threats do not recognize national or industry boundaries—our response must be equally interconnected. As both prime targets and key defenders, multinational corporations are uniquely positioned to drive unified, strategic action. Initiatives like the Charter of Trust serve as a model for global collaboration, strengthening the cybersecurity ecosystem and paving the way for a more secure future.

We extend our gratitude to the CISOs and CSOs who contributed their expertise to this publication, including: Kyle Oetken (AES), Haydn Griffiths (Allianz), Paul Bayle (Atos), Christoph Peylo (Bosch), Morten Pors Simonsen (Danfoss), Koos Lodewijkx (IBM), Raphael Otto (Infineon), Natalia Oropeza (Siemens), Norbert Vetter (TÜV SÜD)

Navigate the Cybersecurity Regulation Maze with Ease

The Charter of Trust is here to simplify the complexity and guide you through the ever-evolving regulatory landscape.

In today's digitized world, cybersecurity plays a pivotal role in maintaining global stability, economic resilience, and individual privacy. Various regulations have been implemented to safeguard individuals, businesses, and infrastructure from ever-evolving cyber threats. Each regulation, while differing in scope and focus by region, aims to protect against breaches, data leaks, and other malicious activities that could disrupt operations and compromise sensitive information.

At the heart of the Charter of Trust lies a commitment to sharing best practices. Our Security by Default Working Group has meticulously analyzed vast amounts of regulatory texts to provide a clear and concise overview of security by default adoption across key global regions.

Stay Ahead of Cyber Risks with Expert Insights

Our latest report is a vital resource for organizations aiming to effectively manage cybersecurity risks and protect their assets. Covering major regulations from the European Union, India, Japan, People's Republic of China, Singapore, the United Kingdom, and the United States, this report offers valuable insights into compliance requirements worldwide.

The principle of Security by Default, as advocated by the Charter of Trust, provides a universal standard for organizations to meet compliance requirements effectively. By embedding security measures from the outset, organizations can ensure compliance with regulations, foster trust with customers, safeguard their operations, and strengthen their market position. This approach not only helps organizations meet their legal obligations but also enhances their reputation and competitive advantage.

Strengthen Compliance, Build Trust, and Gain a Competitive Edge

By embedding security measures from the outset, businesses can:
- Ensure compliance with international regulations
- Build and maintain trust with customers and stakeholders
- Safeguard operations from cybersecurity threats
- Strengthen their market position with a proactive security approach

The publication shows that regulators worldwide have taken different approaches to pursuing common cybersecurity goals, leading to varied and sometimes conflicting regulatory frameworks. This complexity can make it challenging for organizations to navigate the cybersecurity landscape and ensure compliance with all relevant regulations.

This document serves as a roadmap to better navigate this complex landscape, thereby highlighting the benefits of aligning current cybersecurity regulations worldwide. It supports the Charter of Trust's mission to create a secure digital environment for innovation. By following the guidelines outlined in this document, organizations can effectively manage their cybersecurity risks, protect their assets, and contribute to a more secure digital world.

Don't get lost in the regulatory jungle — get the clarity you need today and download the full report below

In response to rising cyber threats, governments are enacting new cybersecurity laws and regulations, with some, like the United States (US), moving from voluntary public-private partnerships to more stringent regulatory approaches, while others, like the European Union (EU), are updating existing regulations (e.g. the Network and Information Security (NIS) Directive 2, or NIS 2) and creating new ones (e.g., Cyber Resilience Act, CRA). These efforts often set precedents for other nations, but the lack of international coordination in cybersecurity regulation remains a challenge. This fragmentation, coupled with shortages of cybersecurity talent, risks diverting resources from essential cyber defense to compliance, potentially increasing costs, complexity, and undermining resilience and innovation. Some solutions include reciprocity agreements, adopting international standards, and leveraging third-party assessments to streamline regulations and improve global alignment.

To read the full publication, see the download link below.

The Charter of Trust presents this Manifesto as a call to action for Policymakers to join forces in the pursuit of a secure and resilient digital environment. As a collective of leading technology, cybersecurity, and industry stakeholders, we believe that a united and collaborative approach is essential for effectively combating cyber threats that endanger the security, privacy, and prosperity of our societies.
Our vision is to establish a strong, secure, and resilient digital Europe that fosters innovation, economic growth, and social progress while protecting individual rights and safeguarding the values of a democratic society.

This document highlights the significance of caution and due diligence in relation to cyber risks when processes and value chains are supported by digital technology to improve efficiency. As digitalization progresses, such risks exist in products which are combined to systems and networks in the IT but also in the OT world. The intent of this document is to offers practical guidance to risk management based on the experience and expertise of the members of the Charter of Trust P3 Task Force.

The purpose of this document is to provide additional information on a step-by-step approach for achieving secure development lifecycle, in addition to the Phase 1 and Phase 2 baseline requirements. The document aims to provide a deep dive into the topic of secure development lifecycle and define best practices for achieving the same. This includes the following steps: identifying the basic steps for a development lifecycle model and developing best practices for a secure development lifecycle.

How can companies increase the cybersecurity awareness of their employees? AES shares their take on implementing new and innovative training model that drives engagement.

How can companies ramp up their cybersecurity capacities and upgrade skills to provide a confident response to incidents? IBM shares their take on how they trained their customers to be proactive responders in a new Charter of Trust Principle Use Case.

How can companies cooperate to improve their supply chain security? Mitsubishi shares their take on developing a joint approach among partners to establish common cybersecurity awareness practices in a new Chater of Trust Principle Use Case.

What are the main challenges and opportunities of Threat Intelligence sharing? Atos shares their take on bringing together experts from various partners and why this is a smart move.