Corporate Policy on Development and Responsible Use of Artificial Intelligence

Introduction

The Board of Directors of Human Affinity Platform S.L. (hereinafter, “Kymatio” or the “Company”) is responsible for designing, evaluating, and permanently reviewing the Company’s Policy System and general strategies.

This Corporate Policy on Development and Responsible Use of Artificial Intelligence (AI) aims to establish Kymatio’s commitment to the responsible, transparent, secure, and reliable development and use of AI, aligning its practices with current regulations and corporate values, as well as with the highest standards of security and privacy.

The development and implementation of AI tools are essential elements for creating sustainable value, as well as for Kymatio’s strategy of innovation and digital transformation.

For this reason, Kymatio recognizes the importance of promoting responsible use of AI in line with values and principles based on ethics and commitment to sustainability.

Definitions

For the purposes of this Corporate Policy on Development and Responsible Use of Artificial Intelligence, the following definitions shall apply:

• Personal Data: Any information that identifies or makes an individual identifiable, either directly or indirectly. This includes obvious data such as name, identification number, email, phone number, as well as less visible data such as IP address, biometric data, images, voice, geolocation, or browsing habits.
• Artificial Intelligence (AI): A branch of computer science dedicated to designing systems capable of performing tasks that traditionally require human intelligence, such as reasoning, natural language understanding, pattern recognition, learning from data, and decision-making.
• AI Tool: Software, platform, or system that uses AI algorithms to perform specific functions such as language processing, data analysis, predictions, or content generation.
• Inputs: Data, instructions, or content provided by the user to an AI tool for processing (e.g., text, images, code, voice).
• Outputs: Results generated by the AI tool after processing inputs (e.g., text responses, summaries, predictions, images, automated decisions). Outputs must be critically evaluated by the user, as they may not always be correct, impartial, or ethically appropriate.
• AI Tool Usage Procedures: Steps, guidelines, or protocols to ensure responsible, safe, transparent, and ethical AI use.
• AI Regulation: Refers to Regulation (EU) 2024/1689 of the European Parliament and Council of June 13, 2024, establishing harmonized rules on AI.
• Data Processing: Any operation performed on personal data, automated or not, including collection, organization, storage, modification, use, disclosure, or deletion.
• User: Any individual interacting with an AI tool for services, content generation, or assisted decision-making, either personally or on behalf of an organization.
• Responsible for AI Tools Use: The designated person or entity ensuring proper, lawful, and ethical AI use within the organization.
• AI Transparency: Making AI systems’ operations and results understandable, accessible, and verifiable for stakeholders.

Purpose of the Policy

The purpose of this Corporate Policy is to establish a regulatory and ethical framework guiding the development, implementation, and use of AI tools and systems at Kymatio.

The policy seeks to:

• Ensure AI use respects fundamental rights, promoting fairness, inclusion, and non-discrimination.
• Comply with applicable regulations on data protection, privacy, and AI-specific rules.
• Promote transparency, traceability, and explainability in AI systems.
• Define clear roles and responsibilities for AI use, oversight, and control.
• Foster user training and awareness about risks, limitations, and best practices.
• Prevent negative impacts from misuse or unethical AI applications.
• Encourage AI as a strategic tool for improving processes, products, and services within an ethical and sustainable framework.

This policy applies to all employees, departments, and business units that use, develop, or integrate AI tools, either directly or through third parties.

Scope and Regulatory Framework

This Policy applies to all Kymatio entities and workers, binding both internal and external personnel involved in AI-related projects.

It is based on the European Union’s AI Regulation (EU 2024/1689 of June 13, 2024), which sets a complete regulatory framework centered on risks associated with AI use, aiming to ensure responsible development and implementation while protecting fundamental rights, privacy, and safety.

General Principles of Responsible AI

Kymatio commits to ensuring the highest ethical standards for acquiring, using, and developing AI. AI use must always comply with Kymatio’s ethical principles.

AI usage procedures will be governed by principles of:

• Respect for human autonomy
• Prevention of harm
• Fairness
• Explainability
• Training and awareness

Principle of Respect for Human Autonomy

Kymatio ensures freedom and individual autonomy in all AI developments, whether internally created, purchased, or through collaboration. AI systems aim to enhance human capabilities and always involve human oversight.

Principle of Prevention of Harm

AI systems must not harm people or negatively impact their dignity, physical, or mental well-being. Systems must be technically safe, not used for malicious purposes, and potential risks must be prevented or mitigated.

Principle of Fairness

AI development and use must be fair, ensuring equitable distribution of benefits and avoiding unjust bias or discrimination. Kymatio will take steps to prevent bias and allow users to challenge AI-driven decisions.

Principle of Explainability

AI processes must be transparent and understandable, with clear communication of system goals and capabilities.

Principle of Training and Awareness

Developers must be trained on legal, ethical, behavioral, and security aspects to ensure safe AI use by end users.

Artificial Intelligence Tools

Corporate AI Tools

• Must be approved by the Internal Committee on Information Security and AI.
• Provided by Kymatio exclusively for professional use.
• Personal/private use is prohibited.
• Use must occur only from approved devices.

Selection and Approval

The Committee evaluates and approves AI tools based on compliance, ethics, and alignment with Kymatio’s mission.

Communication and Disclosure

Decisions on approved AI tools will be communicated to professionals, and a registry of authorized tools will be maintained.

Associated Risks

Users must understand risks regarding IP, privacy, cybersecurity, trade secrets, and competition. Any doubts on legality or ethics of AI-generated outputs must be reported to the Committee.

Personal AI Tools

Use of personal AI tools for professional purposes requires prior approval from the Committee. Kymatio does not assume responsibility for unapproved personal tools or outputs.

Governance Model

Kymatio has established a governance model for AI, overseen by the Internal Committee on Information Security and AI, reporting directly to the Board of Directors.

The Committee’s functions include:

• Ensuring AI initiatives comply with this policy and regulations.
• Supervising AI development throughout its lifecycle.
• Maintaining an updated inventory of AI-related initiatives.
• Providing legal and ethical advice.
• Ensuring transparency about AI capabilities and limitations.
• Guaranteeing traceability and auditability, especially in critical applications.
• Engaging stakeholders throughout the AI lifecycle.
• Promoting training and awareness on Responsible AI.

The Board of Directors sets overall AI strategy and guidelines through this policy and related regulations.

Monitoring, Interpretation, and Review

Monitoring

The Committee supervises compliance with this Policy, conducting audits and periodic reviews. Incidents affecting AI systems’ functioning or security must be immediately reported.

Non-compliance may lead to legal consequences and actions by Kymatio.

Interpretation

The Committee resolves questions about interpretation or application of this Policy.

Review and Update

This Policy will be reviewed periodically to adapt to technological, regulatory, or organizational changes. Updates require Board approval and will be communicated to staff.

Dissemination

This Policy will be published on Kymatio’s corporate website for full accessibility.

Additionally, Kymatio will carry out communication, training, and awareness initiatives to facilitate understanding and correct application of this Policy and its updates.

All professionals and users must periodically review the Policy, as ignorance of its content does not exempt them from compliance.