Hiroshima AI Reporting Framework

The Hiroshima AI Reporting Framework is open to organisations across the AI value chain, including developers, deployers, and providers of advanced AI systems. Participants are invited to report on their practices for managing risks and advancing trustworthy AI. Participation strengthens transparency, contributes to a shared understanding of organisational practices, and enables organisations to demonstrate their approaches to trustworthy AI.

RATP: G7 Hiroshima AI Process (HAIP) Transparency Report

Publication date: Oct 2, 2026, 07:33 AM GMT+2

Reporting period: Q2 2026

Download

Section 0 - Your role in the AI system lifecycle

Responding as (please select all that apply):

Model developer (/provider)
Application developer (/provider)
Deployer

If any of the fields above are selected, please indicate your organization size:

Large enterprise: 250 or more employees

Section 1 - Risk Identification and Evaluation

1. How does your organization define and/or classify different types of risks related to AI?¹

Other (please specify): Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024, and related guidelines

How does your organization define thresholds at which severe risks, unless adequately mitigated, may be considered "unreasonable"? Please describe the framework(s) most relevant to your organization's role and context. If your organisation does not use formal thresholds, you may describe instead the policies, decision criteria, or governance processes you apply when assessing severe AI risks. You may also describe: • Specific examples of contexts in which your models or systems could, in your assessment, pose unreasonable or intolerable risk; • How mitigations are graduated by capability or propensity level; • How your organisation considers the specificities of different AI technologies, such as generative AI and agentic AI, including any specific risk assessment or governance mechanisms applied to agentic AI capabilities.

The organization is fully aligned with the various risk levels defined by the (EU) 2024/1689 regulation. These levels are considered to strike a proper balance between unlocking value creation and AI risk handling.

Some risks are not taken into account in the EU regulation, and correspond to adverse long term impacts of AI use by a company's workforce. At this point in time, internal policies are in the process of being created in order to handle these secondary risks.

2. Both before and after deployment, what practices does your organization use to identify and evaluate vulnerabilities, incidents, emerging risks and misuse throughout the AI system lifecycle?

Structured techniques to explore the behavior or performance of a model and/or application, such as model elicitation or bottleneck assessments
Qualitative assessments (e.g., expert judgment, narrative scoring)
Impact assessments such as personal data protection assessment and fundamental rights impact assessments

Please briefly describe your organization’s decision-making process for deploying an AI model or system including: who has decision authority; what evidence and criteria are required (e.g., performance, safety/security, robustness, fairness, privacy, compliance, independent external testing, evaluation, validation and verification (TEVV) or assurance); contextual caveats or limitations required in interpreting risk evaluation metric results; what approvals/sign-offs are needed; and what safeguards (e.g., mitigations, monitoring, or phased release) must be in place to move into deployment.

A gated validation funnel is being set up whereby all use cases are placed under the scrutiny of a committee where all stakeholders are represented : legal, ethics, cybersecurity, etc.

In order to be able to start the build phase, the model or system must be qualified with respect to the AI act's requirements, and this qualification must be validated by the committee

In order to be able to enter service the committee must meet the requirements defined at the previous gate.

Once in run phase, a sampling will be done to check for potential drift of operating conditions with respect to requirements.

Following deployment, how do you use incident reports — including those shared by other organizations — to identify emerging issues, update risk assessments, and trigger corrective actions.

For the time being, no such process is in place

3. Does your organization have mechanisms to receive and/or share reports of risks, incidents or vulnerabilities by/with third parties?

4. If your organization has programs to incentivize risk(s) disclosure, incidents and systemic vulnerabilities, please share what type of programs you use?

Not applicable

5. Does your organization use or contribute to the development of international technical standards, best practices or tools for the identification, assessment, and evaluation of risks?

6. Does your organization collaborate with relevant stakeholders across sectors to assess and adopt risk mitigation measures to address risks that could have broad and potentially cascading socio-economic impacts? Please indicate which stakeholders you collaborate with, and whether collaboration is on a standing basis (Always-on), activated based on context (Ad hoc/as relevant), or there is no current collaboration.

	Always-on	Ad hoc / as relevant	No current collaboration
Relevant employees (security, legal/compliance, etc.)	✓
Public authorities / regulators / AI safety institutes / other public sector bodies and inter-governmental coordination structures	✓
Industry partners or industry fora		✓
Users (end users, enterprise customers, developers using APIs)		✓
Business customers / deploying organizations (if different from “users”)		✓
Supply-chain partners (cloud, data providers, etc.): Vendors		✓
Academia / researchers			✓
Independent auditors			✓
Standards bodies / multi-stakeholder initiatives (OECD.AI; ISO/IEC; IEEE; AIID etc.)			✓
Independent civil society organizations (e.g., for evaluations, audits, or policy review)			✓
Media / general public (people or communities indirectly impacted)			✓
Other(s) (please add any other relevant stakeholder groups):			✓
Not applicable			✓

Please describe examples of how your organization collaborates. Examples may include: participating in multi-stakeholder or industry initiatives; partnering with academia, civil society, or the public sector; establishing internal or joint governance structures with external experts or in partnership with other efforts to share knowledge and jointly address risks.

Information exchange with peers is done on an opportunistic basis.

Any further comments and implementation documentation.

No answer provided

Section 2 - Risk Management and Information Security

7. Across the AI system lifecycle, what steps does your organization take to manage risks and vulnerabilities? Please indicate which specific practices, tools or metrics your organization uses at each lifecycle stage. You may refer to tools or metrics present in the OECD.AI Catalogue of Tools and Metrics or suggest additions. Respondents may complete only the lifecycle stages relevant to their organisation's role. Stages that do not apply may be left blank.

GiskardCode Carbon

Plan and design

Collect and process data

Build, integrate and interpret model

Verify and validate

Deploy

Operate and monitor

Please provide a consolidated description of your organisation's approach to risk management across the AI system lifecycle, including how the practices identified above operate together and any cross-cutting governance, review or escalation processes. Please also indicate how often these practices are reviewed and what types of events trigger reviews and updates. Where relevant, please distinguish between different types of AI systems (e.g. generative or agentic AI).

When building a generative AI system, systematic tests are designed to evaluate the ability of the system to generate accurate and non-misleading results. A Greenhouse Gas Emissions calculator (CodeCarbon/Ecologits) is used to assess the product's overall environmental footprint. When in production, projects use the Giskard app/service to assess the product's AI compliance and its alignment with the organization's values.

Please describe any measures used to ensure data quality and fairness across the data collection and curation stage (e.g., dataset audits, filtering training data to remove harmful content or personal information, fine-tuning on curated data, use of moderation tools, assessment of limitations to model generalisability).

Not applicable

8. What security measures are used in testing AI systems?

Isolation of staging environments (from production / operational environments)
Human-in-the-loop controls for higher-risk test cases
Access controls, including roles-based permissions
Audit logging and monitoring
Isolated and secure test environments
Network isolation from external access
Locally hosted testing environments
Restrictions on outbound Internet or API access, including a list of permitted domains or APIs
Controlled environments for red-teaming and adversarial testing
Containment measures for prompt-injection and jailbreak attempts
Controlled security vulnerability testing
Rate limits and resource caps
Disabling, restricting or simulating high-impact capabilities during testing
Use of “AI-safe” test-data, as appropriate
Use of synthetic, anonymized, or dummy data, as appropriate

8.A. Please indicate, if relevant, the team or role responsible for overseeing secure testing and whether this responsibility is shared across multiple teams and/or functions.

The IT department is ultimately in charge of testing AI products. Other stakeholders are associated as part of existing internal legal and compliance processes.

9. How does your organization protect intellectual property, including copyright-protected content?

9.A. Safeguards that promote lawful data use and transparency in AI training:

Other(s) (please specify): Company rules guarding against IP violations.

9.B. Safeguards that reduce the risk of dissemination of outputs that may infringe copyright:

Not applicable

10. How do you protect privacy and prevent your systems from disclosing confidential or sensitive data across the AI lifecycle?

Other(s) (specify): Implementation of a privacy by design process for all use cases
Make information about data privacy, practices, and controls accessible to a diverse set of stakeholders

Describe key privacy measures and data-protection standards applied.

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

11. How does your organization assess cybersecurity risks and implement policies to enhance the cybersecurity of advanced AI systems across the AI system lifecycle? Respondents may complete the checkbox subsections in 11.A–11.D or describe their overall approach under 11.E.

11.A. Governance, policy and assessments

Other(s) (specify): Undisclosed

11.B. Technical and operational controls

Other(s) (please specify): Undisclosed

11.C. Protection of sensitive or high value AI assets

Other (please specify): Undisclosed

11.D. Insider risk protection detections

Other (please specify): Undisclosed

11.E. Please describe the main security measures your organization applies and indicate which are specific to particularly sensitive AI assets, where relevant.

Undisclosed

12. What is your organization's vulnerability management process? Does your organization take actions to address identified risks and vulnerabilities, including in collaboration with other stakeholders?

Investigation of reported or identified risks and vulnerabilities
Internal vulnerability disclosure receipt and tracking processes
Bug bounty or incentive programs for external reporters
Development of patches or other mitigations for confirmed risks or vulnerabilities
Testing of patches or other mitigations
Scanning for and mitigation of similar risks or vulnerabilities
Collaborative vulnerability sharing (e.g., with partners, industry groups)
Reporting to regulators / authorities when relevant
Recognition of external finders of confirmed risks or vulnerabilities
Defined escalation criteria and follow-on actions for identified vulnerabilities (e.g., for external reporting or information sharing)

13. What post-deployment practices does your organization use to monitor and respond to vulnerabilities, incidents, emerging risks and misuse of advanced AI systems?

Conduct post-deployment monitoring
Perform root-cause analysis and apply lessons learned to improve future development and/or deployment practices
Monitoring and emergency controls specific to agentic AI systems (e.g., ability to interrupt autonomous action sequences, override tool-use permissions, or revoke delegated authority)

Giskard

14. Do you develop or deploy agentic AI systems (systems that can autonomously plan/act or use tools)?⁴

Please provide any further comments and implementation documentation.

No answer provided

Section 3 - Transparency Reporting on Advanced AI Systems

15. Does your organization publish public reports and/or technical documentation related to the capabilities, limitations, and domains of appropriate and inappropriate use of advanced AI systems? Are these clear and understandable by non-technical audiences?

16. How does your organization share information with a diverse set of stakeholders (other organizations, governments, civil society and academia, etc.) regarding the outcome of evaluations of risks and impacts related to an advanced AI system?

Not applicable

Describe how evaluation results are shared and with which stakeholders (e.g. other organizations, governments, civil society and academia, etc). You may also indicate whether non-technical or plain-language summaries are provided for broader audiences.

N/A

17. Does your organization publish public privacy policies addressing the use of personal data, user prompts, and/or the outputs of advanced AI systems?

18. How does your organization provide information about the sources of data used for the training of advanced AI systems, as appropriate, including information related to the sourcing of data annotation and enrichment?

Not applicable

Please provide links to any publicly available information.

N/A

19. Does your organization demonstrate transparency related to advanced AI systems through any other methods?

20. Does your organization publish statistical insights derived from anonymised, aggregated usage data to advance understanding of AI adoption and its economic impacts in areas including occupations and tasks by region, sector and country? To this end, do you contribute to international cooperation efforts?

Please estimate the total staff time and annual expenses associated with conducting compliance activities and include any further comments and implementation documentation (optional).

Compliance activities are handled by a group of ca. 100 people who all dedicate a fraction of their time to the subject. The estimated corresponding FTEs is between 10 and 15

Section 4 - Organizational Governance, Incident Management, and Transparency

21. How has AI risk management been embedded in your organization's governance framework?

Governance council or committee
Executive oversight
Senior management oversight

Please describe how AI risk management is integrated into governance structures, including: which roles or bodies have advisory versus decision-making authority; which roles or bodies have final accountability for AI risk-related decisions; and how often policies are reviewed or updated (e.g., following major incidents, regulatory changes, or material updates to systems).

Undisclosed

22. Are relevant staff trained on your organization's governance policies and risk management practices?

Yes

If yes, describe training methods (e.g., onboarding modules, regular sessions, and confidential channels to report concerns).

Ad-hoc training was given to the experts in charge of designing the compliance process. Regular sessions are in the making for the wider audience, together with focused per-project training where needed.

23. Are steps taken to address reported incidents documented and maintained internally?

24. Does your organization share research and best practices on addressing or managing risk?

25. Does your organization use international technical standards or best practices for AI risk management and governance policies?

Any further comments and implementation documentation.

No answer provided

Section 5 - Content Authentication & Provenance Mechanisms

26. What mechanisms, if any, does your organization put in place to allow end-users, where possible and appropriate, to know when they are interacting with an advanced AI system developed by your organization?

User disclosure (e.g., text notice, verbal statement, or system label)

Provide any additional details or context on how or when users are informed they are interacting with advanced AI systems (e.g. if such mechanisms are planned, in testing, or applied only to certain products).

No answer provided

27. Does your organization use content provenance detection, labeling or watermarking mechanisms that enable users to identify content generated by advanced AI systems?

Any further comments and implementation documentation.

No answer provided

Section 6 - Research & Investment to Advance AI Safety & Mitigate Societal Risks

28. Does your organization advance research and investment in the following areas?

Security
Safety

If yes, please describe key research or investment initiatives in the areas selected above (e.g., dedicated safety teams, funding of research programs, contributions to open-source safety tools, publishing research, partnerships and collaborative research initiatives). You may also indicate whether related outputs are publicly shared, shared with partners or within consortia or not publicly disclosed.

No answer provided

29. Does your organization pursue research or investment related to socio-economic or environmental considerations in the development and deployment of AI?

Not applicable

Any further comments and implementation documentation.

No answer provided

Section 7 - Advancing Human and Global Interests

30. Does your organization support any digital literacy, education or training initiatives to improve user awareness and/or help people understand the nature, capabilities and limitations of advanced AI systems?

Yes

If yes, describe any digital literacy or training initiatives your organization supports (e.g., user education, public AI-education programs, school or university partnerships, community workshops). You may also indicate whether these efforts include or prioritise underserved or underrepresented communities.

In the context of the France 2030 "Compétences et Métiers d'Avenir" nation-wide education and training plan, and together with its professional organization (UTPF), the organization is part of the "Transformeurs" project to deliver its own workforce and others training in order to enhance digital litteracy, in particular in the fields of Data and AI.

31. Does your organization pursue AI projects that aim to deliver societal or public benefits, including through partnerships with civil society and community groups?

Any further comments and implementation documentation.

No answer provided

Back to reports