AI Transparency Statement

Introduction

At NTT DATA, we recognize the transformative power of Artificial Intelligence (AI) to drive innovation, improve productivity, enhance service delivery, and create value for our customers, employees, and society. As a global leader in business and technology services, we are committed to harnessing AI responsibly and ethically, while fostering trust and ensuring transparency in our AI technologies to benefit society and the environment.

We understand that while AI can unlock new opportunities, it also presents risks and challenges that must be managed correctly. Accordingly, we apply governance, risk management, security, privacy, and compliance processes throughout the AI lifecycle to ensure that AI technologies are used in a manner that is safe, secure, ethical, reliable, and aligned with applicable legal, regulatory, contractual, and organisational requirements. This statement outlines our principles, practices, and commitments regarding the safe and ethical development, deployment, use and governance of AI technologies.

Our AI principles

We adhere to 6 core AI principles which we apply throughout the development, deployment, use and governance of AI technologies:

Sustainable Development: We aim to positively impact society through responsible innovation and enable sustainable development for people, society, and the planet, and are committed to the responsible use of AI technologies.
Human Autonomy: We do not replace human oversight and accountability with AI technologies, and we incorporate human monitoring, verification, and intervention proportionate to the risk level of the AI technology.
Fairness and Openness: We implement processes to identify, test for, and mitigate bias, and provide clear, transparent and accessible information about our AI technologies, including their capabilities, limitations, intended purposes, and conditions of use.
Security: We apply robust security measures aligned to industry best practices and maintain a comprehensive vulnerability management program to identify, manage, and mitigate risks, including those arising from AI-enabled threat vectors.
Privacy: We prioritize privacy and data protection by embedding privacy by design principles, throughout relevant stages of the AI lifecycle including data minimization, purpose limitation, retention, access controls privacy assessment, maintaining records of data sources, data categories processed, and retention periods, and applying appropriate safeguards that comply with global privacy and data protection laws.
Communication and Co-creation: We collaborate with diverse stakeholders to foster the growth and adoption of AI technologies that are inclusive, responsible, and trusted by all.

These principles are complemented by detailed internal policy requirements that govern how our people use AI technologies responsibly.

Our approach to AI governance and risk mitigation

NTT DATA's approach to AI governance and risk management is deeply rooted in our commitment to ethical innovation, and compliance with applicable laws and requirements in client contracts.

Our AI governance framework is designed to align with recognized international standards and regulatory frameworks, including ISO/IEC 42001:2023 (AI Management System), ISO/IEC 27001:2022 and ISO/IEC 27701:2019, the NIST AI Risk Management Framework, and applicable requirements of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689) and applicable data protection laws. We classify AI technologies on a risk basis consistent with the EU AI Act tiers and assess our responsibilities according to our role in relation to the AI technology.

To manage AI-related risks effectively, we have established comprehensive risk policies that define key risks, mitigation actions, and governance structures across NTT DATA. This is complemented by detailed policies, internal guidelines and training which define expected and prohibited behaviour for development, deployment, and use of AI technologies, as well as controls proportionate to the risk classification of AI technologies. We maintain governance registers for AI technologies, which records approved technologies, their permitted uses, usage conditions, restrictions, and risk ratings. Additionally, we have established multi-disciplinary AI governance teams, comprising legal, data privacy, security, risk, compliance, technology, and business stakeholders, which play a pivotal role in assessing and evaluating AI technologies within both customer-facing and internal systems, and documenting relevant purposes, data sources, controls, owners, and risk levels. These functions operate through defined roles to ensure that AI-related risks are assessed, prioritised, and managed consistently.

We do not use AI in any manner prohibited by applicable law, and do not deploy AI technologies that employ subliminal or manipulative techniques beyond a person's consciousness, exploit the vulnerabilities of specific groups (including on the basis of age, disability, or social or economic situation), perform social scoring, engage in real-time remote biometric identification in publicly accessible spaces, perform individual predictive policing based solely on profiling or personality traits, create or expand facial-recognition databases through the untargeted scraping of facial images, infer the emotions of individuals in workplace or educational settings, or categorize individuals on the basis of biometric data to deduce protected characteristics, except, in each case, where strictly required and authorised by law.

We further prohibit the use of AI to create malware or phishing materials, to compromise systems or data, to bypass safety guardrails (including through prompt injection), or to extract credentials or restricted data, except as part of expressly approved security testing.

We implement safeguards designed to protect the fundamental rights, dignity, and autonomy of individuals affected by our AI technologies that we develop, provide, integrate, or use. We also design and operate these technologies to prevent harm and to support the well-being of the individuals, customers, and partners who interact with them.

We also recognize the importance of leadership in governing and managing AI-related risks. Our executives are actively involved in shaping governance and risk strategies that align innovation with our AI principles, appropriate standards, as well as compliance with applicable laws. Designated senior leaders maintain accountability for AI governance outcomes, and our governance framework includes defined roles, responsibilities, escalation procedures, and reporting lines for AI-related risk decisions.

Our commitment to continuous improvement and innovation

We are committed to advancing responsible AI through continuous improvement and innovation. NTT DATA actively invests in research, fosters collaboration with industry leaders and academic institutions, and empowers our people through ongoing education and training on AI technologies, ensuring that all users understand their responsibilities for responsible, lawful, and ethical AI use.

We maintain ongoing monitoring of developments in the regulatory, cybersecurity, technology, and AI landscape, including risks associated with advanced frontier AI systems. We apply a model-agnostic, technology-neutral, and risk-based governance framework designed to manage AI-related and non-AI-related risks consistently across our enterprise risk management, information security, and operational resilience programmes. Our policies and governance frameworks are updated periodically to address emerging risks arising from frontier AI capabilities and evolving regulatory responses.

How we use AI

NTT DATA leverages AI technologies to enhance service delivery, improve operational efficiency, personalize client experiences, and support innovation. Use of AI technologies is strictly governed by internal policies, applicable laws, and the specific requirements outlined in client contracts. We may use AI in the following circumstances:

Productivity and collaboration, including word processing tools, grammar and proof-reading assistants, meeting transcription, summarisation, time management assistants, content and image creation.
Document and knowledge management, including document classification, metadata tagging, contract analysis, clause extraction, translations, summarisation, and enhanced search capabilities).
Security, risk and compliance monitoring, including threat detection, behavioural analysis, data loss prevention, anomaly detection, audit trail generation and automated compliance checks.
Intelligent automation and workflow optimisation, including automation for repetitive rule-based tasks, ticket routing, integrating cross-functional processes, task prioritization and intelligent scheduling, and low-code/no-code automation tools.
Analytics, reporting and decision support, including predictive analytics for forecasting, trend analysis and capacity planning, anomaly detection in performance and operational metrics, automated dashboard generation, business intelligence platforms, scenario modelling and simulation tools.
IT service management, including incident monitoring and alerting systems, predictive analytics for prevention and capacity planning, root cause analysis, auto-remediation, and testing.
AI powered service delivery, including AI assistants for drafting technical documentation, conversational agents or chat bots for internal help desks and support, and interfaces for querying databases and systems.
Software development, user interface and user experience design, including coding tools, code review, behaviour analytics, and user testing.

NTT DATA may incorporate and use third-party products with AI technologies, including general-purpose AI (GPAI) models such as large language models. We thoroughly evaluate third parties and AI technologies to identify and manage any associated risks, applying criteria that include technical capability, data protection practices, training data provenance, copyright compliance, and alignment with NTT DATA's AI principles. We implement measures to limit the use of client data for model training and require contractual commitments from third parties to maintain appropriate safeguards. This includes conducting regular governance-based impact assessments to ensure third parties and AI technologies meet appropriate standards, as well as compliance with applicable laws. We monitor ongoing third-party compliance through periodic reviews and require disclosure of material changes to AI models or data practices.

We do not use inputs or outputs that infringe or misappropriate the intellectual property, confidentiality, or contractual rights of NTT DATA or any third party. We process client, confidential, and personal data only in AI technologies approved for that data type and use.

Our commitment to transparency and upholding individual rights

NTT DATA is committed to providing relevant, accurate, and accessible information about our AI systems to enable customers, users, affected individuals, regulators, and other interested parties to understand the purpose, capabilities, limitations, risks, and impacts of AI technologies used within our services and operations. We aim to provide clear and accessible information about AI technologies and upholding individual rights as required by applicable laws. This includes information relating to the intended purpose of the AI system, its role in decision-making processes, applicable human oversight measures, known limitations, and any significant considerations that may influence the interpretation or use of AI-generated outputs and, where applicable, resources explaining the data inputs that influence AI-driven outputs, to help our customers and partners understand and trust the reasoning behind AI-driven outcomes. Where AI technologies make or assist in making decisions that produce legal effects or similarly significant effects on individuals, we will inform affected individuals of the existence of such automated decision-making; provide meaningful information about the logic involved, its significance, and envisaged consequences; and provide a means to obtain human intervention, express a point of view, and contest the decision, in accordance with applicable law.

Where individuals interact with AI (such as a chatbot or conversational agent), we take steps to ensure they are informed that they are interacting with AI rather than a human. Where AI technologies are used to generate or substantially modify content (including text, images, audio, or video), we take appropriate steps to disclose the AI-generated nature of such content in accordance with applicable laws.

We maintain an AI incident response protocol for identifying, triaging, and addressing situations where AI technologies cause or are suspected of causing harm, produce unsafe outputs, or exhibit unexpected behaviour. Reports are reviewed through established governance, risk management, privacy, security, and incident response processes, and are used to support corrective action and continual improvement of our AI management system.

If you would like to know more about NTT DATA's AI technologies, or if you encounter harmful, unsafe, or incorrect AI behavior, please contact us at AIGovernance@nttdata.com.

If you would like to know more about how personal data is used, please contact us at PrivacyOffice@nttdata.com.

This statement forms part of NTT DATA's broader artificial intelligence management system and is reviewed at least annually, or more frequently where material changes occur in NTT DATA's AI practices, applicable laws, or regulatory guidance.