OpenText: G7 Hiroshima AI Process (HAIP) Transparency Report

Deployment decisions require evidence from security testing, privacy reviews (DPIA where applicable), legal/compliance checks, and product approvals under OpenText governance (e.g., PSDL/SoP). Incident reports (internal and shared by others) inform updates to risk assessments and corrective actions.

OpenText uses a risk‑based, stage‑gated process to approve AI deployment, where solutions must pass defined checkpoints for advancing AI use cases through their lifecycle stages—from Proof of Concept to Pilot and ultimately to Production with evidence on performance, risk, and compliance, decision and consultation authorities scale from a centralized AI Office (low risk) to a governance committee (higher risk) with participations from relevant SME groups.

Progression to deployment requires validated results (e.g., performance and value realization against KPIs), completion of applicable security, privacy, legal, and vendor assessments, and confirmed risk mitigations.

Final production approval requires formal sign‑off - where appropriate, at management level-, defined ownership, and safeguards such as monitoring, controls, and a rollout plan, ensuring ongoing oversight and compliance.

After deployment, OpenText reviews relevant internal incident records and information from external sources to detect new or recurring risk signals. Where relevant to an AI-enabled capability, these insights are incorporated into updated risk assessments and may result in investigation, remediation, strengthened safeguards, changes to technical or governance controls, and escalation through established incident-management processes.

• Industry-led best practices or codes of conduct
• General Purpose AI Code of Practice

OpenText collaborates across internal and external stakeholders to support responsible AI deployment and to identify, assess, and mitigate risks associated with AI systems in enterprise environments.

From an external engagement perspective, OpenText participates in multi‑stakeholder and industry initiatives focused on AI governance, data protection, information security, and responsible innovation, including policy discussions, consultations, and working groups involving public authorities, international organizations, and industry forums. These engagements allow OpenText to share operational insights from an enterprise deployer perspective and to stay aligned with evolving regulatory and best‑practice expectations.

OpenText also engages with public sector bodies, regulators, and standards communities on an as‑needed basis, particularly in relation to transparency, incident management, cybersecurity, privacy, and compliance with emerging AI frameworks. Where appropriate, OpenText contributes feedback to consultations and participates in workshops or knowledge‑sharing sessions addressing AI risk management, governance, and deployment challenges.

Internally, OpenText maintains cross‑functional governance structures involving product engineering, security, privacy, legal, procurement, and compliance teams to ensure coordinated oversight of AI deployments. These structures enable internal knowledge sharing, escalation of emerging risks, alignment with legal and regulatory developments, and consistent application of safeguards across AI use cases.

In addition, OpenText collaborates with external subject‑matter experts, vendors, and assurance providers as part of due‑diligence, risk assessment, and security testing activities relating to AI‑enabled products. This includes vendor engagement on security, privacy, and contractual safeguards, as well as reliance on external intelligence such as public incident reports, government advisories, and industry guidance to inform ongoing monitoring and risk mitigation.

Through these combined internal and external collaborations, OpenText seeks to promote responsible AI deployment, share knowledge, and address systemic and operational risks in a way that is proportionate to its role as an enterprise application deployer.

OpenText manages risks and vulnerabilities across the lifecycle of AI-enabled capabilities through its established enterprise information security, privacy, and risk management framework, complemented by AI-specific application and platform controls where appropriate with the prime objective of maintaining its systems and data confidentiality, integrity and availability. 

Security and risk management practices are implemented through OpenText's Information Security Management System (ISMS), aligned to ISO/IEC 27001 and ISO27034 and supported by a defense-in-depth control model across identity and access management, infrastructure security, application security, monitoring, and incident response. 

AI-related risks are incorporated into product governance and lifecycle reviews across design, development, release, deployment, and operation. Reviews consider factors such as system functionality, data sensitivity, intended use, deployment context, and applicable legal or regulatory requirements. Where appropriate, application-level controls include authentication and authorization, encryption, retrieval constraints, content filtering, evaluation and observability, audit logging, human review, and business-specific policy enforcement. 

Where OpenText incorporates third-party models, AI services, or infrastructure, OpenText governs their selection, integration, and use through due diligence, security and privacy review, contractual requirements, and ongoing third-party risk management. This allows OpenText to maintain governance over the AI capabilities it delivers while assigning technical responsibilities to the party that controls each underlying layer. 

OpenText addresses data quality and fairness through a layered governance approach covering both the AI technologies selected for use and the controls implemented within OpenText products and services. 

Where OpenText incorporates third-party foundation models or AI services, OpenText may not control the large-scale datasets used by the provider to train the underlying model. OpenText nevertheless remains responsible for how those technologies are selected, integrated, governed, and used within OpenText solutions. Provider practices and safety capabilities are considered through vendor due diligence, security and privacy review, contractual requirements, and ongoing third-party risk management. 

Within OpenText products and services, controls may include appropriate use-case and data scoping, data classification and access controls, privacy review, content filtering, retrieval constraints, evaluation pipelines, human review, documented limitations, and operational monitoring. These measures are designed to help mitigate risks such as bias, inappropriate content, data leakage, hallucinations, and other unintended outcomes, while maintaining the needed transparency. 

This layered approach enables OpenText to address data quality and fairness through both direct application-level controls and governance of the external AI technologies incorporated into the solutions delivered to customers. 

• Not applicable

• Not applicable

OpenText protects privacy and helps prevent unauthorized disclosure of confidential or sensitive data through its established enterprise security and privacy framework, complemented by controls applied to AI-enabled applications and services. 

Controls include data classification, least-privilege access management, encryption in transit and at rest, secure development and deployment practices, logging and monitoring, privacy impact assessments, security risk assessments, and product governance reviews. 

At the AI application layer, OpenText applies controls where appropriate such as authentication and authorization, retrieval constraints, content filtering, audit logging, human review, evaluation, and business-specific policy enforcement. Where applicable, customers are provided with controls to configure access, retention, permissions, and data-handling settings within the relevant product or service. When designing and applying controls, OpenText takes into account data protection and AI related applicable laws and standards. 

Third-party AI services incorporated into OpenText solutions are also subject to appropriate security and privacy review, contractual data-protection requirements, and ongoing vendor governance. 

• Maintain or update security policies aligned with recognized standards (e.g., NIST CSF, ISO/IEC 27001, SOC 2, CIS Critical Security Controls), and review them regularly in response to emerging risks or regulatory guidance
• Maintain vulnerability management processes (scanning, channels for external reporting, patching, remediation)
• Implement incident response, disaster recovery, or business continuity plans, including escalation procedures for high-severity incidents
• Integrate cybersecurity AI risks into broader cybersecurity risk management activities
• Regularly review security measures and update them in response to emerging risks, incidents, or major releases
• Train staff on cybersecurity best practices and AI-specific threats, including how to recognize and respond to misuse or unintended outcomes of advanced AI systems
• These responsibilities are delegated contractually to model or infrastructure providers
• Other(s) (specify): OpenText governs AI-enabled capabilities through an integrated enterprise governance, policy, and risk management framework supported by its Information Security Management System aligned to ISO/IEC 27001 and informed by industry leading recognized cybersecurity practices. AI-related risks are incorporated into established product, security, privacy, and risk-governance processes rather than managed in isolation. Relevant assessments consider the capabilities being deployed, data sensitivity, intended use, security and privacy risk, deployment context, and applicable legal and regulatory requirements. Cross-functional teams spanning engineering, legal, compliance, security, privacy, and AI governance work together to identify, assess, and mitigate risks associated with AI-enabled capabilities. Where third-party models or infrastructure are incorporated, OpenText manages associated risks through due diligence, contractual controls, provider governance, and ongoing oversight. OpenText continues to evaluate emerging AI-specific frameworks, including the NIST AI Risk Management Framework and ISO/IEC 42001. These frameworks should not be represented as formally implemented or certified unless that status is established.

• Apply multi-factor authentication (MFA) and role-based access controls for advanced AI systems
• Encrypt AI assets (datasets, models, configurations) in storage and in transit as appropriate
• Monitor system activity and log access to detect anomalies or misuse
• Conduct secure AI development and/or deployment practices
• These responsibilities are delegated contractually to model or infrastructure providers
• Other(s) (please specify): AI-enabled capabilities are implemented within OpenText's established technical and operational security environment, including role-based access management, strong authentication, encryption, secure configuration standards, monitoring and logging, secure development and deployment practices, vulnerability management, and patching. These foundational controls are supplemented at the AI application layer, where appropriate, by authentication and authorization enforcement, content filtering, retrieval constraints, audit logging, evaluation pipelines, human review, and business-specific policy enforcement. OpenText also uses approved foundation models with provider safety capabilities as part of its model-selection approach. Where AI capabilities incorporate third-party models or infrastructure, OpenText governs the integration and associated risks through architectural controls, vendor due diligence, contractual requirements, and ongoing third-party risk management.

• Limit access to proprietary AI assets based on role or need-to-know
• Track and log access to sensitive AI resources
• Require NDAs or confidentiality agreements for staff and contractors with access
• These responsibilities are delegated contractually to model or infrastructure providers
• Other (please specify): OpenText protects sensitive and high-value AI assets according to the nature of the asset, its sensitivity, and OpenText's role in controlling or operating it. Deployment-layer AI assets - including sensitive customer data, prompts, configurations, integrations, logs, traces, credentials, access permissions, embeddings, and application components - are protected using established controls such as data classification, least-privilege access, encryption, monitoring and logging, confidentiality requirements, and secure development and deployment processes. Where models or AI components are packaged or otherwise controlled as part of OpenText products, applicable OpenText product and supply-chain security requirements are applied. Where third-party foundation model weights, training datasets, or infrastructure remain under the provider's control, OpenText governs those dependencies through provider selection, due diligence, contractual requirements, and third-party risk management.
• Use hardware security modules (HSMs) or trusted execution environments (TEEs) where feasible

• Conduct pre-employment screening or role-sensitive vetting
• Monitor for unauthorized internal access or suspicious activity
• Provide staff training on cybersecurity best practices and AI-specific threats
• Implement insider-risk escalation or response procedures
• These responsibilities are delegated contractually to model or infrastructure providers
• Other (please specify): Provide staff training on AI-specific threats. OpenText manages insider risk through established enterprise security and workforce governance processes, and those controls apply to systems, services, and sensitive assets supporting AI-enabled capabilities. Controls include pre-employment screening or role-sensitive vetting, role-based and least-privilege access controls, monitoring for unauthorized access or anomalous activity, cybersecurity and information-protection training, and established escalation and response procedures.

OpenText applies layered security measures to AI-enabled capabilities as part of its mature enterprise information security program. The program is aligned to ISO/IEC 27001 and ISO27034 and supported by a defense-in-depth approach across identity and access management, infrastructure security, application security, monitoring, vulnerability management, and incident response. 

These foundational controls are complemented, where appropriate, by AI application-level safeguards such as authentication and authorization, retrieval constraints, content controls, evaluation and monitoring, audit logging, human review, and policy enforcement. 

Where AI systems involve particularly sensitive data, configurations, integrations, or use cases, additional controls are applied proportionately, including enhanced access restrictions, monitoring, confidentiality requirements, and change governance. 

Where third-party AI technologies are incorporated, OpenText governs their selection and integration through security and privacy review, contractual requirements, and ongoing vendor risk management. This integrated approach combines OpenText's established enterprise security foundation with controls appropriate to AI-enabled products and services. 

• Constraints on the agent's action space (e.g., tool-use permissions, environment sandboxing, allowlists/blocklists of resources, scope limits per task)
• Human oversight or interruptibility mechanisms (approval requirements for sensitive actions, escalation paths, interruption interfaces)
• Monitoring (anomaly detection, multi-agent interaction monitoring)
• Logging of agent actions

Not applicable as above.

OpenText publishes a global Privacy Policy and maintains a public Privacy Center describing how personal data is processed across its products and services, including AI‑enabled functionality. In addition, OpenText provides product‑specific privacy and data‑handling disclosures for AI‑enabled offerings such as the Aviator portfolio, reflecting their deployment within customer‑controlled, enterprise environments.

https://www.opentext.com/about/privacy
https://www.opentext.com/about/opentext-privacy-center
https://www.opentext.com/aviator-ai/content-aviator

No applicable as noted above.

Governance structure and roles

AI‑related risks are overseen through a cross‑functional governance framework involving executive leadership, senior management, and dedicated governance forums.

Governance councils and cross‑functional committees (involving Legal, Privacy, Security, Product, Engineering, and Compliance) provide advisory oversight, review AI‑related risks, assess proposed use cases, and recommend safeguards, mitigations, or escalation where appropriate.

Senior management (including product 

and functional leaders) holds decision‑making authority for day‑to‑day AI risk matters, including approval of deployments, remediation actions, and operational controls.

Executive leadership has final accountability for AI risk‑related decisions and ensures that AI risk management is aligned with OpenText’s enterprise risk management, security, and compliance obligations.

This structure ensures that AI risk decisions are informed by multidisciplinary expertise while remaining accountable within established management hierarchies.

Integration into operational processes

AI risk management is embedded into existing workflows, including:

• product intake and design reviews
• security and privacy assessments (including DPIAs where applicable)
• vendor due‑diligence and third‑party risk management
• release approval processes under the Product Security Development Lifecycle

Policy review and update cadence

AI‑relevant policies, standards, and controls are reviewed on a regular basis as part of broader governance and compliance cycles and are updated on an event‑driven basis, including:

• following material system changes or new AI‑enabled functionality
• in response to security or privacy incidents or near‑misses
• when significant regulatory, legal, or authoritative guidance changes occur
• where post‑incident reviews identify the need for enhanced safeguards

This approach ensures that AI risk management remains dynamic, proportionate, and responsive to technical, regulatory, and operational developments, while leveraging OpenText’s existing enterprise governance structures.

Relevant OpenText staff are trained on governance policies and risk management practices through a combination of mandatory enterprise‑wide training and role‑specific training tailored to their involvement in AI‑enabled systems.

Training methods include:

• Onboarding and recurring mandatory training covering information security, data protection, code of conduct, and compliance obligations, which apply to all employees and form the baseline for responsible AI use.
• Role‑based training and briefings for employees involved in the design, deployment, operation, or oversight of AI‑enabled products, including product, engineering, security, privacy, legal, and compliance functions. These sessions address AI‑specific risks, governance expectations, privacy‑by‑design, security‑by‑design, and human‑in‑the‑loop requirements.
• Targeted sessions and communications led by Privacy, Security, Legal, or Compliance teams to address emerging AI risks, regulatory developments, or material updates to policies and systems.
• Internal guidance and documentation, including policies, standards, playbooks, and recorded materials, made available through internal knowledge platforms.
• Confidential reporting and escalation channels, including established ethics, compliance, and security reporting mechanisms, which allow employees to raise concerns related to safety, ethics, privacy, or policy compliance without fear of retaliation.

Training content and delivery are reviewed and updated periodically and refreshed on an event‑driven basis, including following significant regulatory developments, policy updates, or identified risk patterns.

OpenText maintains internal records of reported incidents and the steps taken to address them through established enterprise incident management, security, privacy, and compliance processes.

How incident records are kept:

• Reported incidents are logged in internal incident tracking systems appropriate to the nature of the issue (e.g., security, privacy, operational).
• Records typically include incident details, assessment notes, actions taken, remediation status, and closure outcomes.
• Where relevant, root‑cause analysis and post‑incident review documentation are prepared to identify underlying causes and control improvements.

Use of incident records for follow‑up:

• Incident records are used to track remediation actions, verify resolution, and confirm that appropriate safeguards have been implemented.
• Lessons learned from incidents or near‑misses are fed back into governance, risk assessments, technical controls, training, or documentation updates, as appropriate.
• Patterns or recurring issues inform continuous improvement of controls and risk management practices.

Escalation thresholds:

• Escalation thresholds are defined based on severity, impact, and risk, including potential effects on security, privacy, compliance, customers, or service availability.
• Higher‑severity incidents are escalated to senior management and executive leadership in line with established enterprise incident response and governance procedures.
• External notification or engagement is assessed and handled in accordance with contractual requirements and applicable legal or regulatory obligations.

This approach ensures that incident handling is consistent, auditable, and proportionate, and that incident records actively support governance oversight and ongoing AI risk management.

OpenText does share research and best practices on managing risk, including AI‑related risk, through:

• participation in industry and policy initiatives (e.g., OECD, G7, voluntary codes)
• public thought leadership, white papers, blogs, and conference contributions on AI governance, privacy, security, and responsible AI
• customer‑facing guidance and implementation materials on secure and responsible deployment of AI capabilities, including Aviators
• engagement with standards‑aligned practices, including ISO and NIST‑aligned security and privacy approaches.

• ISO/IEC standards (e.g., ISO/IEC 27001, ISO/IEC 42001)
• NIST AI Risk Management Framework (AI RMF)
• OECD AI Principles

OpenText aligns its AI risk management and governance practices with internationally recognised frameworks, including ISO/IEC information security standards, NIST‑aligned security and privacy frameworks, and the OECD AI Principles, applying them in a risk‑based and proportionate manner appropriate to its role as an enterprise AI deployer.

OpenText informs users when they are interacting with AI‑enabled functionality through clear in‑product disclosures, feature naming (e.g., Aviator branding), and supporting documentation and FAQs that explain when and how AI is used. These mechanisms are applied selectively and proportionately, depending on the product and use case, and are designed to provide transparency without overstating system autonomy.

Aviator capabilities operate with human‑in‑the‑loop controls and within user‑initiated workflows, and are not meant to act autonomously or execute actions on a user’s behalf. As such, disclosures focus on informing users of AI assistance rather than continuous provenance or automated‑action indicators.

OpenText invests in mitigating socio‑economic risks associated with AI through a combination of product design choices, workforce initiatives, and governance programs.

Examples include the design of AI‑enabled capabilities (such as the Aviator portfolio) with human‑in‑the‑loop controls, role‑based access and safeguards, and clear limitations on autonomous behaviour, ensuring AI augments rather than replaces human judgment. OpenText also invests in AI literacy, workforce training, and internal awareness programs to support responsible adoption, reduce skills gaps, and promote fair and appropriate use of AI across roles and functions.

These efforts are complemented by cross‑functional AI governance and review processes that address fairness, bias, access, and appropriate use, and by customer‑facing guidance that supports responsible deployment of AI in enterprise contexts. Collectively, these initiatives focus on improving productivity, access, and inclusion while avoiding socio‑economic harms associated with unchecked automation.

As an enterprise AI deployer, OpenText does not conduct or control large‑scale AI model training and therefore does not undertake AI‑specific environmental impact research or measurement, which primarily resides with infrastructure and model providers.

OpenText supports AI literacy, education, and training initiatives for both employees and customers. This includes mandatory baseline training on privacy, security, and ethical use, role‑specific AI governance and risk awareness training. We provide AI foundation trainings for all employees and targeted briefings on the capabilities and limitations of AI‑enabled systems.

In addition, OpenText provides customer‑facing documentation, FAQs, and enablement materials that explain when and how AI is used, the role of human‑in‑the‑loop controls, and appropriate use of AI‑enabled features in enterprise environments.