Responsible AI

All AI initiatives are classified into four risk levels (Unacceptable, High, Medium, Low), aligned with the EU AI Act and the legal frameworks of the geographies where EDP operates. A mandatory Purpose Assessment and pre-deployment readiness review ensure compliance, with additional approval for high-risk cases.  

EDP prohibits AI uses not compliant with regulation, including manipulative techniques, social scoring, biometric identification in public spaces, and emotion inference in sensitive contexts.  

Data privacy is safeguarded throughout the AI lifecycle, in compliance with applicable data protection legislation, including the General Data Protection Regulation and with EDP’s Personal Data Protection Policy. AI systems are deployed in secure, EDP-approved environments that meet cybersecurity, privacy and data governance standards. Generative AI tools are used only through approved models in private or controlled environments, supported by incident response and resilience mechanisms. 

Bias risks are assessed and mitigated across data, models and outputs, and mitigation measures are documented and periodically reviewed. Training, validation and test datasets are prepared to be relevant, representative and adequate for the system’s intended purpose.  

For high-risk systems, the use of sensitive personal data for bias detection is subject to a Fundamental Rights Impact Assessment (FRIA) and, where required, a Data Protection Impact Assessment (DPIA), under the oversight of the Data Protection Officer (DPO). 

AI does not make critical decisions independently, particularly those with regulatory, safety, legal or financial implications. Human oversight ensures the ability to review, intervene or override outcomes.  

Transparency is embedded by design. Users are informed when interacting with AI, and AI-generated content is clearly labelled in line with EDP’s internal guidance. Where AI supports decisions or generates content that may influence people, clarity is provided about its role and limitations.  

Employees, customers and other third parties affected by an AI-supported decision or outcome can seek clarification, request human review and contest the outcome through established Group channels: (i) the Speak Up channel for ethical concerns, misuse or non-compliance. Cases are triaged and resolved through the AIMS governance process, with outcomes documented and feeding back into model and process improvement, (ii) the Data Protection Officer (DPO) for matters involving personal data and privacy.

AI systems are continuously monitored to ensure performance and alignment with initial objectives. Periodic reviews address data drift and model degradation. Where inconsistencies, material changes or emerging risks are identified, a Risk Treatment Plan is defined with corrective actions and followed up through the governance process. 

For high-risk AI systems, comprehensive technical documentation is maintained in line with applicable legal requirements.  

A structured incident management process governs identification, escalation and resolution of AI-related issues, including regulatory reporting where required.  

Responsible AI criteria are integrated into software procurement, assessing vendors on transparency, fairness, accountability, security and data governance.  

In line with EDP's public Supplier Code of Conduct, suppliers, including those of AI and cloud-related services, are expected to account for and disclose or provide third-party verification of their GHG emissions, to address emissions aligned with the Paris Agreement targets, and to use energy and natural resources efficiently.  

ESG criteria are progressively integrated into digital and AI procurement processes. 

EDP manages the environmental footprint of AI and digital operations through its own operational controls - rightsizing, monitoring of usage patterns and shutdown of idle resources - applied across cloud workloads. These actions are supported by carbon footprint tools made available by EDP's main cloud providers (AWS, Google Cloud and Microsoft Azure), which provide visibility over consolidated emissions at subscription level (Scope 1, 2 and 3 where available). Scope 2 is calculated under both market- and location-based methodologies, in line with the GHG Protocol.

EDP ensures the responsible use of AI through a structured training and awareness framework embedded across the organization. Training is tailored to different audiences, including technical teams and general users. 

The AI upskill program combines e-learning, instructor-led sessions and hands-on training, with Responsible AI concepts integrated into broader AI and GenAI training, including guidance on ethical use, risk awareness and governance requirements. 

Capability building is monitored through training indicators. Currently, 60% of the total workforce has received GenAI training, reaching 70% among key roles. 

A dedicated Responsible AI e-learning is being deployed as mandatory for all employees, incorporating Golden Rules and practical use-case scenarios.

EDP's Artificial Intelligence Management System (AIMS) is subject to independent assurance by Internal Audit, an organizationally and functionally independent function reporting to the General and Supervisory Board, ensuring impartiality and absence of conflicts of interest. The 2025 review assessed governance, policies, processes, controls, roles and responsibilities, training and awareness, and supporting evidence of the ethical, secure and responsible use of AI.  

Conclusions were based on sufficient and verifiable evidence. Findings and recommendations were formally reviewed by the Executive Board of Directors, with remediation actions defined and monitored through established governance processes.