AI Charter

1Preamble and regulatory context

1.1 Purpose of the charter

This charter sets out the governance framework for artificial intelligence (AI) systems and models within Stratos. It applies to every project that develops, deploys, or uses AI, and aims to ensure compliance with:

• Regulation (EU) 2024/1689 (the AI Act) and its omnibus amendments (COM(2025) 87)
• Regulation (EU) 2016/679 (GDPR)
• Stratos's internal ethical guidelines

1.2 Operating context

Stratos is a builder-operator firm that designs, builds, and operates software, data, and AI products. On that basis, the AI Act concerns us from two angles:

• As a provider: we integrate or deploy AI components in our client projects.
• As a deployer/user: we use AI tools (code generation, analysis, and so on) in our internal processes.

2Scope and definitions

2.1 Scope of the charter

The AI charter applies to:

• All Stratos staff, on permanent or temporary contracts
• External service providers working on our projects
• Work-study students and interns
• Consultants and partners working with our teams
• All AI systems developed, integrated, or deployed by Stratos

2.2 Key definitions

2.3 Exclusions from scope

The following are exempt from certain obligations:

• Minimal-risk AI systems (spam filters, spell checkers)
• Industrial AI embedded in CE-certified products (post-Omnibus): only the mandatory registration applies
• Systems already compliant under a recognised third-party certification

3Guiding principles

Stratos commits to the following principles when developing and using AI. Generative AI is deployed as a cross-cutting accelerator of our practices (development, writing, analysis) and not as a substitute for human judgement, within a controlled framework of use.

3.1 Transparency and traceability

• Document every use of AI in our client projects and internal processes
• Inform end users when they interact with an AI (generated source code, chatbot, and so on)
• Keep a record of significant AI decisions and their rationale
• Publish clear documentation on the capabilities and limitations of our AI systems

3.2 Human oversight

• No critical decision affecting fundamental rights may be fully automated
• Qualified human review is mandatory before deployment in sensitive contexts
• Teams retain the right to contest or correct AI outputs
• A person accountable for each AI system is identified and answerable for the results produced

3.3 Data protection and confidentiality

• Comply with the GDPR and national personal-data laws
• Never send confidential, sensitive, or client data to non-contracted tools
• Ensure the security of data processed by our AI systems
• Document the processing of personal data in an AI impact assessment (AIA)

3.4 Non-discrimination and fairness

• Regularly assess our AI systems for systemic bias
• Document training data and its limitations
• Decline to deploy AI with demonstrated discriminatory effects
• Foster diversity in the teams responsible for AI

3.5 Security and robustness

• Assess the robustness of our systems against attacks and adversarial data
• Build cybersecurity into every AI project
• Run regular security testing
• Notify stakeholders of any security vulnerabilities discovered

3.6 Social responsibility

• Ensure that AI contributes positively to society
• Do not build AI presenting unacceptable risk
• Uphold the values of the European Union and fundamental rights

3.7 Digital sovereignty

• For client contexts subject to sovereignty or heightened security requirements (healthcare, regulated sectors), favour EU-hosted solutions or sovereign models (for example Mistral, self-hosted open-source tooling)
• Validate the choice of AI building blocks jointly with the client where the contractual context requires it
• Document the location of data and processing for each AI system

3.8 Eco-design and measured use

• Assess the environmental impact (carbon footprint) of heavy AI models, particularly on projects subject to an RGESN requirement (eco-design of digital services)
• Choose the model proportionate to the task rather than the most powerful by default (for example a lightweight model for code completion, an advanced model reserved for tasks that warrant it)
• Avoid redundant or looping usage (repeated regenerations, unnecessary requests) that consumes resources without added value
• Where relevant, favour reusing results already produced rather than systematic regeneration

3.9 Adoption and growing usage

• AI is a central accelerator of our development and production practices: this charter frames its use, it does not seek to restrict it by default
• Encourage teams to experiment with new AI tools and uses within a controlled process, via the procedure in section 5.3
• Share internally the AI best practices and use cases that have proven themselves on a project, to speed their adoption elsewhere
• The AI Lead acts as an adoption facilitator as much as a compliance guardian

4Risk levels and classification

4.1 Classification framework

All AI systems are classified according to the four risk levels defined by the AI Act.

GitHub Copilot is not a system subject to the AI Act, but its use triggers transparency obligations. Where the provider bears responsibility on behalf of the client, Stratos remains co-responsible for documentation.

5Permitted and prohibited tools

5.1 Tools permitted for internal use

Permitted without restriction (non-sensitive data)

• GitHub Copilot: code generation, completions
• Open-source tooling (LLaMA, Mistral): if self-hosted

Conditions

• Flag AI use in documentation or communications
• Do NOT submit confidential data, client secrets, or API keys

5.2 Prohibited or restricted tools

Prohibited without exception

• AI tools for social scoring or judgement of individuals (candidates, employees)
• Unsupervised facial-recognition tools
• AI-based employee-monitoring tools without explicit consent
• AI services whose terms of use allow data to be used for training without consent

Restricted, unless explicitly authorised by the CISO

• Image generators (Midjourney, DALL-E): copyright and training-data risk
• Consumer OpenAI models used on free tiers: data not contractually confidential
• Claude on a personal/free account or the public web version without a contract: non-retention of data cannot be guaranteed
• Any AI SaaS not under contract with Stratos

5.3 Procedure to add a new tool

1. Request: the project lead submits a request to the AI Lead, including tool name and provider; use case and data to be processed; terms of use and confidentiality (link).
2. CISO review: GDPR-compliance and cybersecurity check.
3. AI Lead validation: risk-classification and AI Act compliance check.
4. Decision: approval or reasoned refusal within five working days.
5. Recording: added to the register of authorised AI tools.

6Data usage rules

6.1 Data prohibited in any AI system

The following categories may never be submitted to an AI tool, even a permitted one:

Highly sensitive data

• Genetic or biometric data (outside specific cases) and health data
• Data revealing racial or ethnic origin
• Data revealing political opinions
• Data revealing religious or philosophical beliefs
• Trade-union membership data
• Judicial data (criminal records)

Proprietary strategic data

• Stratos trade secrets and intellectual property
• Client code not publicly disclosed
• Commercial strategies
• Internal financial data

Non-consented client/third-party data

• Client personal data without explicit agreement
• Third-party personal data without consent
• Access credentials (passwords, API tokens, private keys)

6.2 Data permitted with restrictions

6.3 Responsibilities for data quality

Developers / project leads

• Check that data submitted to AI meets the criteria
• Anonymise where necessary before submission
• Document the sources of training data

CISO (Chief Information Security Officer)

• Audit the data processed by critical AI systems
• Validate trust agreements for third-party data
• Put access controls in place

Data Protection Officer (DPO)

• Validate GDPR compliance of data uses
• Draft AI impact assessments (AIAs)
• Advise on consent and rights

7Transparency and labelling

7.1 Labelling obligation

For end users

AI-generated content must be clearly flagged when:

1. AI generates text (Level 3): chatbots, generated content. Example: "This response was generated by an AI assistant."
2. AI generates code (Level 3): GitHub Copilot, code suggestions. Example: "Code suggested by GitHub Copilot (review recommended)."
3. AI makes a decision affecting a right (Level 2): scoring, recruitment. Example: "This decision was AI-assisted; you may contest it."
4. AI generates images (Level 3): synthetic images. Example: "Image generated by AI (Midjourney)" or a visible watermark.

For client data

A transparency sheet is mandatory:

• Document the capabilities and limitations of each deployed AI system
• Specify the types of data processed
• State the model version and its update date

7.2 Internal documentation

Every AI system must have an AI transparency sheet including: system name; creation/update date; version; risk level; functional and technical description; data processed (type, estimated volume, server location, retention period); capabilities; limitations and risks; human-oversight process; accountable contact; and date and reason of last revision.

8Oversight and validation

8.1 Mandatory human-review rules

High risk (mandatory, 100%)

• CV screening or candidate evaluation: HR review before candidates are notified
• Credit scoring or access to services: business validation before implementation
• Judicial or administrative decisions: legal and business review
• Facial recognition: CISO validation and explicit consent

Timing: review within 24 hours before deployment.

Limited risk (validation required)

• Generated content (text, code): review before publication/commit
• Chatbots: user testing and integrated feedback before production
• Recommendations: validation that they are not discriminatory

Timing: validation before production.

Minimal risk (recommended)

• Occasional checks, not mandatory
• Good practices to apply (unit tests, and so on)

8.2 Standard validation process (high risk)

1. Development: the dev team builds the AI system; training and testing in a development environment.
2. Documentation: transparency sheet; AIA if personal data; documentation of training data.
3. Non-discrimination testing: bias assessment (age, gender, origin, and so on); training-data audit; testing on diverse populations; compliance report.
4. Business validation: demonstration to the business owner; validation of results (accuracy, fairness); approval signature.
5. Legal/compliance validation: GDPR check by DPO; AI Act check by AI Lead; validation of client contracts where applicable.
6. Controlled deployment: deployment to staging; active performance monitoring; A/B testing where applicable.
7. Production deployment: progressive rollout (canary or phased); continuous monitoring; rollback procedure in place.
8. Post-deployment monitoring: monthly performance monitoring; six-monthly bias audit; annual update at minimum.

9Roles and responsibilities

9.1 Stratos AI governance

9.2 Escalation points

10Compliance procedures

10.1 Mapping and register of AI systems

Obligation: a centralised register of AI systems must be kept permanently up to date.

Mandatory register for: all high-risk systems; all systems deployed to clients; all systems processing personal data.

Information to document, per system: ID; system name; category (client/internal); risk level (minimal/limited/high); AI Act domain (if applicable); data processed (types and volumes); provider/owner (internal or third party); go-live date; accountable person (name and email); compliance status (compliant/in progress/non-compliant); last revision; notes.

Revisions: at least annually; on any major system update; on any change to the data processed.

10.2 AI impact assessment (AIA)

Obligation:any high-risk AI system processing personal data must undergo an AIA.

Contents of the AIA:

1. System and context description: purpose; technical elements; deployment area.
2. Risk assessment: AI Act non-compliance risks; GDPR non-compliance risks; risks to fundamental rights; bias and discrimination risks.
3. Mitigation measures: technical, organisational, and contractual controls.
4. Conclusion: residual risks; authorisation by the AI Governance Board.

Owner: jointly drafted by AI Lead and DPO. Frequency: before deployment plus annual review.

10.3 EU registration (AI Act)

Obligation: all high-risk AI systems must be registered in the EU AI Act database.

Timeline: before 2 August 2026 for Annex III systems; before 2 August 2027 for Annex I systems.

Information to register: economic-operator identification data; AI system description; application domain and risks; compliance measures; support contacts.

Owner: AI Lead, coordinating with CISO and DPO.

10.4 Client-contract compliance

Obligation:where Stratos develops an AI system for a client, responsibilities must be clarified contractually.

Mandatory clauses for high-risk AI cover: intellectual property (who owns the model; who may use/reuse it); AI Act compliance (who is responsible; who pays for EU registration; documentation deadlines and deliverables); data (permitted data types; server location; retention period); liability (liability for AI failure; civil-liability insurance; mutual indemnification); audit and monitoring (client's audit right; AI performance reporting; update frequency); transparency (documentation provided to the client; information to end users; complaint handling); confidentiality (client-data protection; data-processing agreement; authorised sub-processors).

Owner: Legal and AI Lead validation before signature.

11Recording and documentation

11.1 Minimum documentation by level

Minimal-risk system

Basic description sheet; identified use cases.

Limited-risk system

AI transparency sheet; documentation of data processed; human-oversight plan.

High-risk system

Complete risk-management system; AIA (if personal data); non-discrimination assessment; complete technical documentation; human-control plan; incident register; declaration of conformity; proof of EU registration.

11.2 Audit and continuous compliance

Annual internal audit: review of all high-risk systems; discrimination testing (diverse test data); verification of human oversight; verification of reported incidents.

External audit (recommended every two years for critical systems): independent AI auditor; full compliance assessment; report with recommendations.

Owner: AI Lead and AI Governance Board.

12Sanctions and revisions

12.1 Non-compliance and internal sanctions

Stratos will apply the following measures in the event of non-compliance:

Disciplinary process: per Stratos HR policy (interview, training, progressive suspension).

12.2 Regulatory compliance and legal sanctions

AI Act sanctions by level:

Stratos's responsibility: as a provider, responsible for the compliance of its AI systems; as a deployer, co-responsible for the compliance of third-party systems; as a client, shared responsibility with the provider (clarified in the contract).

12.3 Updating and revising the charter

Mandatory revision: annually (minimum); on any major regulatory change; after any critical incident.

Revision process: analysis of regulatory developments (AI Lead); consultation of the AI Governance Board (validation of changes); general-management approval (signature); communication to all staff (email and training); version recording (history).

Version history

13Contacts and escalation

13.1 Points of contact

Contact is by function. Requests can be routed to the general inbox below; where a dedicated mailbox exists, it should be substituted.

13.2 Reporting procedure

To report a concern, incident, or question:

1. Contact the project lead or the AI Lead: email ia-lead@stratos.club; Slack #channel-ia-compliance (confidential).
2. Document the incident: what (description); which AI system; when (date/time); impact (data, people affected).
3. Escalate if needed: urgent, CISO or CTO immediately; serious (sensitive data), DPO immediately; standard, AI Lead within 24 hours.
4. Investigation and correction: timeline according to severity; incident report retained.
5. Prevention: recommendations implemented; training if necessary.

13.3 Resources and training

• Mandatory training: all staff must complete annual AI training (1–2 hours).
• Online resources: internal documentation plus CNIL and European Commission links.
• Certificate: available for staff who complete the training.
• Project coaching: AI Lead available to support new projects.

Annexes

Annex A: Glossary

Annex B: External resources

• Regulation: EUR-Lex (CELEX:32024R1689); CNIL AI Act Q&A (cnil.fr); European Commission (digital-strategy.ec.europa.eu)
• Tools and guides: EU registration platform; ISO 42001 (AI standard, recommended); EU voluntary code of conduct
• Internal training: Stratos internal AI training materials, available from the AI Lead

Annex C: AI compliance checklist

Before deploying an AI system, validate that:

• The system is classified by risk level (minimal/limited/high)
• An AI transparency sheet is written
• Processed data is verified (no prohibited data)
• Third-party contract terms are validated by Legal
• An AIA is written and approved (if high risk plus personal data)
• A non-discrimination assessment is completed (if high risk)
• Human oversight is planned and validated
• User signalling is in place (limited risk and above)
• The AI register is updated
• EU registration is planned (if high risk)
• Team training is completed
• AI Governance Board approval is obtained
• The client contract is signed (if a client project)

Annex D: AI transparency sheet template

A per-system form covering: system name, version, date, accountable person; AI Act classification (unacceptable/high/limited/minimal) with justification; functional description (what it does, inputs, outputs); data processed (types, server location, retention, estimated volume); system capabilities; known limitations and risks (identified bias, less-reliable use cases, risks to fundamental rights); human oversight (who validates, frequency, appeal process); user signalling (how users know AI is involved); GDPR compliance (AIA, DPA, consent or other legal basis); approvals and signatures (AI Lead, CISO, DPO, management/CTO) with last and next revision dates.

Charter approval

This charter has been approved by:

Effective from: July 2026

Next scheduled revision: July 2027

This charter is a living document and will be updated regularly to reflect regulatory developments and Stratos's practices.