// governance_protocol · responsible_ai
$ Principles governing the design, deployment and operation of every AI system in the TTPSEC Group.
> preamble.load()
The TTPSEC Group develops and operates artificial intelligence applied to critical-infrastructure cybersecurity. We adhere to the OECD AI Principles, to UNESCO’s Recommendation on the Ethics of Artificial Intelligence and to the European Union Artificial Intelligence Regulation (AI Act). The articles that follow are binding on our team and collaborators.
// articles · 08 clauses
We clearly communicate when an AI system takes part in an analysis, a recommendation or a decision. We document the purpose, the training data where applicable, and the known limitations of every model we put into operation.
[ref] OCDE, Principios de IA 1.3
No AI system executes irreversible actions on critical infrastructure without competent human validation. We keep an identifiable owner for every deployment, with the effective capacity to intervene, correct or halt the system.
[ref] UNESCO Rec. §35 · AI Act Art. 14
We build AI applied to cybersecurity in order to protect. We neither develop nor operate capabilities designed for indiscriminate harm, illegitimate mass surveillance or coercion of individuals.
[ref] UNESCO Rec. §26
We collect only the data required for the stated purpose. We apply anonymization and bounded retention to threat telemetry, and we separate research data from any personally identifiable information.
[ref] OCDE, Principios de IA 1.2 · AI Act Art. 10
We subject our models to adversarial testing before and during operation. We treat AI as an attack surface in its own right: prompt injection, data poisoning and evasion are part of our threat model.
[ref] OCDE, Principios de IA 1.4 · AI Act Art. 15
We assess bias in systems that may affect people or organizations. We seek to avoid outcomes that discriminate by origin, sector or size, and we actively correct the imbalances we detect.
[ref] UNESCO Rec. §28 · AI Act Art. 10(2)
We keep traceability of AI-assisted decisions: logs, model versioning and a clear chain of responsibility. We answer for the effects of the systems we operate and we enable channels for redress.
[ref] OCDE, Principios de IA 1.5
We recognize that AI-assisted offensive security tooling can be misused. We restrict access, document its legitimate scope and prioritize coordinated vulnerability disclosure.
[ref] UNESCO Rec. §108 · AI Act Rec. 27
> status
IN FORCE since January 2026 · reviewed annually
Applies to TTPSEC Consulting, PurpleTeam Academy, TTPSEC AI, CISO Blog and TTPSEC Labs.
> report --misuse
Questions about this protocol or reports of misuse of our AI systems:
csirt@ttpsec.com