Kyriba’s Responsible AI Policy

We're huge believers in what artificial intelligence can do for treasury and finance teams: faster forecasts, sharper fraud detection, smarter working capital decisions. But innovation only means something if it's built on trust. As the global leader in liquidity performance, we handle some of the world's most sensitive financial data, and we take that responsibility seriously every single day. That's where this policy comes in: it's Kyriba's Responsible AI Policy, our roadmap for building, deploying, and governing AI so it's ethical, transparent, and accountable from the ground up. 

1. Introduction

At Kyriba, we are committed to the responsible, ethical, and transparent use of artificial intelligence. As the global leader in liquidity performance, we are entrusted with some of the most sensitive financial data in the world, processing a significant volume of payments annually on behalf of over 4,000 customers. That trust extends fully to how we develop, deploy, and use Artificial Intelligence Systems (“AI Systems”). 

In support of Kyriba’s commitment to upholding ethical and responsible use of AI, Kyriba utilizes a comprehensive company-wide ethical framework for the development, deployment, use, or sale of AI Systems. This framework and this policy reflect our commitment to align with evolving global regulations, including the EU Artificial Intelligence Act (EU AI Act, Regulation 2024/1689) and the General Data Protection Regulation (GDPR, Regulation 2016/679), ISO/IEC 42001 as well as other applicable globally recognized standards. 

Kyriba is actively pursuing formal certification of its Artificial Intelligence Management System (AIMS) to the ISO/IEC 42001:2023 standard to obtain independent, accredited third-party validation of its governance framework. Prior to the finalization of this certification, the AI governance program enforces continuous operational alignment with the requirements of this standard, and this policy shall be systematically updated to reflect official certification status once obtained 

Kyriba’s AI Ethics principles are: 

1. Accountability and Responsibility
2. Human Oversight and Control
3. Transparency and Explainability
4. Fairness and Non Discrimination
5. Privacy and Data Protection
6. Safety and Security
7. Sustainability 

 

This framework applies across the full AI lifecycle, from the earliest stages of development to day-to-day use by our employees. This covers every team at Kyriba that builds, uses, or manages AI Systems. Responsible AI at Kyriba is not a design principle alone; it is a company-wide operating standard.

We capture this commitment in a single concept: Trusted AI, our approach to ensuring that AI at Kyriba is developed with transparency, deployed with accountability, and governed with robustness, fairness, and human oversight.

2. Purpose and Objectives

Kyriba believes that AI presents significant opportunities for treasury and finance professionals to manage liquidity more effectively, reduce risk, and make better decisions. 

Like all powerful technologies, AI Systems can also carry the potential for unintended consequences if not governed and used responsibly. Kyriba is committed to the development, deployment, and use of AI that is relevant, reliable, and responsible.

This policy governs the development, deployment, operation, and use of AI systems at Kyriba. It establishes clear principles, responsibilities, and governance mechanisms that apply across the full AI lifecycle and to all individuals involved in any phase of that lifecycle. 

3. AI Risk Classification:

The EU AI Act sorts AI systems into four risk tiers, with obligations that scale with the level of risk: unacceptable risk (banned outright), high risk (subject to conformity assessment, technical documentation, human oversight, post-market monitoring, and EU database registration before going to market), limited risk (subject to transparency and disclosure requirements), and minimal risk (no specific obligations beyond the general ban on unacceptable practices). Kyriba has assessed all of its AI Systems against this framework. 

All Kyriba AI Systems are currently classified as either minimal risk or limited risk. Kyriba's AI serves enterprise treasury and finance teams in a business-to-business. Kyriba does not develop or deploy any AI Systems that fall within the Prohibited Practices. These risk classifications are subject to change as AI Systems evolve and as regulatory frameworks are updated.

4. How Kyriba Builds and Deploys AI

Kyriba AI Systems include those built and maintained by Kyriba, whether or not commercially deployed, as well as AI capabilities that incorporate third-party foundational models. Kyriba-built systems currently include 1) use cases enabled by machine learning to identify patterns and make predictions for cash and liquidity forecasting, payment anomaly detection, and invoice payment date prediction; 2) TAI enabled by Generative AI to generate responses, summaries, and recommendations. TAI incorporates a General Purpose AI (GPAI) large language model developed by a third-party provider, which operates entirely within Kyriba's secure infrastructure under Kyriba's governance and control. In all such cases, the third-party provider operates as a sub-processor under Kyriba's Data Processing Agreement.

In all cases, Kyriba is the accountable party to customers for the performance, security, and compliance of all AI capabilities delivered through its platform. Details of third-party sub-processors are available at kyriba.com/legal-pages/contracts.

5. Terms and Definitions

AI Literacy: The knowledge, competencies, and skills enabling individuals to understand the capabilities, limitations, impacts, and risks of AI systems, as required by Article 4 of the EU AI Act. AI literacy training at Kyriba is role-proportionate and mandatory for all personnel involved in the AI lifecycle.

Artificial Intelligence (AI) System: For purposes of this policy, an “AI System” has the same meaning as an “AI Feature” under Kyriba’s AI Terms of Use: any Kyriba feature, functionality, or component that incorporates, uses, depends on, or employs AI Technology or other machine learning. This is consistent with how the EU AI Act defines an AI system: technology that uses machine-based methods to process inputs and generate outputs, such as predictions, content, or recommendations, that can influence real or virtual environments.

This applies whether the AI System is deployed externally in Kyriba’s products and services or used internally to support Kyriba’s business operations, and includes, without limitation:

• Customer-facing AI capabilities governed by Kyriba's AI Terms of Use and offered as part of Kyriba's Trusted AI portfolio within its Online Cloud Services
• Internal AI tools used by Kyriba employees to support business operations, decision-making, workflow automation, drafting, summarization, and analysis, and
• Experimental or non-commercialized AI systems under research or active development by Kyriba, whether or not commercially deployed.

An AI System within scope of this policy may be:

1. Kyriba-developed: Built by Kyriba, whether or not commercially deployed;
2. Supplier-embedded: Built by a third-party supplier and integrated within Kyriba's platform or services;

General Purpose AI (GPAI) Model: An AI model trained on large amounts of data that displays significant generality and is capable of performing a wide range of distinct tasks. Large language models (LLMs) are a common example. Whenever Kyriba integrates GPAI models into its platform, they are subject to the principles outlined in this policy

Personal Data: As defined in Kyriba’s Data Processing Agreement ("DPA"). 

Data Processing: As defined in the Data Processing Agreement ("DPA"). 

Minimal Risk AI

AI systems that pose little to no risk to individuals' rights or safety and are not subject to specific legal obligations under the EU AI Act beyond the prohibition on unacceptable practices.

Limited Risk AI: AI systems that are subject to specific transparency obligations under the EU AI Act, including the obligation to inform users when they are interacting with an AI system.

ISO/IEC 42001: The international standard for Artificial Intelligence Management Systems (AIMS), providing a framework for responsible AI risk management, accountability, data governance, and continuous improvement. 

AI Ethics 

The application of ethical principles and values to the design, development, deployment, and governance of AI systems. At Kyriba, AI ethics refers to our commitment to ensuring that AI is fair, transparent, accountable, human-centric, and respectful of individuals' rights. 

Responsible AI 

The practice of developing and deploying AI systems in a manner that is ethical, lawful, transparent, and aligned with the interests of users, customers, and society, encompassing both legal compliance and voluntary commitments that go beyond minimum legal requirements.

AI Ethics Committee 

Kyriba's cross-functional governance body with overarching responsibility for the governance of AI across the organization. The Committee oversees this policy, reviews AI risk, monitors compliance with applicable law, and ensures Kyriba's AI practices reflect our values and commitments to customers. It reports to the Executive Committee.

Human-in-the-Loop

A design principle requiring that a human is actively involved in reviewing, approving, or overriding AI-generated outputs or recommendations before they result in a significant action.

Explainability 

The ability to describe, in accessible and meaningful terms, how an AI system reached a particular output, recommendation, or decision.

Transparency: means openness and clarity across the development, implementation, and use of AI Systems. It requires that the rationale for using AI is sound and justifiable, that information about how AI works is accessible and understandable, and that outcomes influenced by AI are interpretable by those affected.

Users: Any natural person interacting with an AI system in any capacity, including Kyriba customers, their authorized end-users, and Kyriba employees using AI tools in the course of their professional activities.

High-Risk AI System: An AI system that the EU AI Act classifies as high-risk because of its potential impact on people’s safety or fundamental rights. High-risk AI systems must undergo a conformity assessment and maintain technical documentation, logging, human oversight measures, and post-market monitoring, and must be registered in the EU database before being placed on the market or put into service.

Prohibited AI Practices: AI practices that the EU AI Act bans outright because they pose an unacceptable risk to people. These include manipulating someone’s behavior in ways that cause harm, exploiting vulnerabilities such as age or disability, social scoring by public authorities, real-time facial recognition of people in public spaces by law enforcement, inferring emotions at work or school, using biometric data to infer sensitive personal traits, and scraping images to build facial recognition databases. Kyriba does not develop, deploy, or procure any system that engages in these practices.

Data Protection Impact Assessment (DPIA): A structured risk assessment we complete before deploying an AI system that’s likely to pose a high risk to individuals’ rights and freedoms under GDPR. DPIAs are reviewed periodically and repeated after any material change to the system, and our Data Protection Officer is consulted on the outcome.

Post-Market Monitoring System: A systematic process for high-risk AI systems that continuously collects and reviews data on an AI system’s performance, safety, accuracy, and compliance after deployment. The monitoring plan is approved before deployment and updated following material changes. .

Serious Incident: Any incident or malfunction of an AI system that directly or indirectly causes death or serious harm to health, damage to property or the environment, or a significant impact on someone’s fundamental rights..

Conformity Assessment: The process by which a provider of a high-risk AI system demonstrates, before placing it on the market or putting it into service, that it meets the EU AI Act’s requirements. Depending on the type of high-risk system, this may involve an internal assessment or a review by an accredited third-party notified body.

6. Ethical AI at Kyriba

Any individual involved in any phase of the AI lifecycle at Kyriba must ensure that AI systems are designed, developed, deployed, operated, and used in compliance with the ethical principles specified in this policy. Adherence to these principles is essential to maintaining the trust of our customers, regulators, and the public.

Principle 1: Accountability and Responsibility 

AI systems cannot be held morally or legally accountable. Responsibility always rests with the people and organizations that develop, deploy, and use them.Kyriba's AI systems must not be used in ways that cause harm to individuals, organizations, or society. Kyriba ensures that accountability is clearly defined and enforced across the full AI lifecycle.

• Kyriba does not develop or deploy AI that falls within the prohibited practices of EU AI Act Article 5. These practices are absolutely prohibited and include all the Prohibited AI Practices. Any proposed AI use case that could fall within these categories must be escalated immediately to the AI Ethics Committee prior to any development, procurement, or deployment activity.
• AI systems must not be developed or deployed to discriminate against individuals or groups, or to exclude any party from equal access to Kyriba's capabilities.
• AI systems must not be used to deceive customers or users about the nature of the outputs they receive.
• The context and environment of each AI system are analyzed, and appropriate measures are taken to prevent misuse or unintended harm.
• Each AI system has a named owner accountable for its compliance and performance throughout its lifecycle.
• Individual employees are accountable for adhering to the principles of this policy in their work with AI Systems.
• Kyriba maintains a register of all AI Systems, classified by risk level, periodically reviewed by the AI Ethics Committee.
• Employees involved in AI development and deployment receive ongoing training in ethics, privacy, and regulatory compliance.

Principle 2: Human Oversight and Control

AI systems should support human decision-making, not replace it. Kyriba ensures that humans remain in meaningful control of AI systems and their outcomes throughout the AI lifecycle.

• Our customers remain in control of their financial decisions at all times.
• AI surfaces insights, recommendations, and analysis; final decisions always rest with the customer and their authorized personnel.
• Sensitive actions require explicit human approval before execution.
• Customers can review, override, or contest any AI-generated output at any time.
• AI operates strictly within the permissions already granted to each authorized user.
• Full audit trails are maintained for all AI-assisted actions, ensuring every decision is traceable and accountable.
• No AI system may operate in a fully autonomous manner in contexts that carry material risk without explicit approval from the AI Ethics Committee

Principle 3 Transparency and Explainability 

Customers have the right to know when AI is involved and to understand the reasoning behind AI-generated outputs.

• Kyriba makes sure that AI-generated content and recommendations are always clearly identified as such. Customers are never misled about the origin of an insight or action.
• The reasoning behind AI-assisted actions is visible and traceable to authorized users.
• Kyriba provides clear information about how its AI Systems work, what data they use, and how outputs are produced.
• Customers may request a plain-language explanation of any AI-generated output that materially affects their operations.
• Any Kyriba AI system designed to interact directly with natural persons discloses its AI nature at the earliest possible point of interaction, unless this is obvious from the context. Kyriba does not deploy AI systems that impersonate a natural person in a way that could reasonably mislead users.
• Where personal data is processed by an AI system, data subjects shall receive clear and accessible information at the point of data collection regarding: the logic involved in automated processing; the significance and consequences of such processing t; and their right to contest automated decisions. This information is provided within Kyriba's privacy notices and product documentation.

Principle 4: Fairness and Non-Discrimination

Kyriba's AI systems are designed, developed, deployed, and delivered with reasonable effort to support consistent treatment and mitigate unintended bias that could lead to unequal or unfair outcomes for customers and their authorized users.

• Where relevant, fairness considerations are assessed as part of Kyriba's AI development and governance process, and are reviewed periodically. Where issues are identified, corrective measures are applied.
• Kyriba's AI systems comply with applicable accessibility standards as part of our product development commitments.
• Customers and their authorized users may review AI-generated outputs at any time and may raise concerns if they believe a result is inaccurate or unfair. Where such concerns are validated, Kyriba will take appropriate corrective action.

Principle 5: Privacy and Data Protection

The development, deployment, and utilization of all AI systems must adhere to relevant Data Protection and Privacy Laws. Kyriba safeguards personal data across the full lifecycle of its AI systems, in keeping with GDPR and other applicable privacy laws, Kyriba's Data Protection Agreement, and internal privacy policies. 

• Before processing personal data, Kyriba establishes a documented legal basis and applies extra care when sensitive data categories are involved.
• AI systems use only the data necessary for their purpose; data is not repurposed for model training or fine-tuning without appropriate justification and, where needed, consent.
• Higher-risk AI systems will undergo a privacy impact assessment, reviewed by Kyriba’s AI Ethics Committee before deployment.
• Where automated decisions meaningfully affect individuals, people can request human review, voice their perspective, and contest the outcome.
• Individuals can exercise their data rights (access, correction, deletion, restriction, portability, and objection), and Kyriba fulfills these requests promptly.
• Where AI training, inference, or related processing involves cross-border transfers of personal data, appropriate transfer mechanisms (e.g. adequacy decisions, Standard Contractual Clauses) must be in place prior to transfer. All AI-related sub-processors are bound by equivalent obligations under Kyriba's Data Processing Agreement.
• Kyriba maintains records of the origin and licensing of data used to train and operate its AI models 

Principle 6: Safety and Security

AI systems at Kyriba are held to the same rigorous security standards as every other component of the platform.

• All AI systems undergo thorough pre-deployment testing, including performance validation, adversarial testing, and security review before reaching customers.
• AI-specific security risks, including prompt injection, data poisoning, and model manipulation, are assessed and mitigated as part of the standard development process.
• Kyriba's AI infrastructure is governed under its enterprise ISMS, aligned with ISO/IEC 27001.
• Fallback and continuity mechanisms ensure that if an AI system behaves unexpectedly, critical financial operations are protected.
• In the event of a security incident involving personal data, Kyriba follows breach notification obligations as outlined in the applicable Kyriba’s Data Protection Agreement. 

Principle 7: Sustainability

The development and use of AI at Kyriba is conducted with awareness of its environmental impact. Kyriba monitors and seeks to reduce the carbon footprint of AI training and inference workloads.

7. Governance

Governance processes are in place to ensure that AI Systems at Kyriba adhere to the ethical standards set in this policy. The Kyriba AI Ethics Committee oversees, guides, and promotes the responsible and ethical development, deployment, and use of AI within Kyriba. The Committee serves as the central body responsible for ensuring that AI initiatives align with this policy, our legal obligations, and commitments to our customers, while promoting transparency, fairness, accountability, and respect for individual rights.

• Each AI system or use case is assessed at inception using an AI Impact Assessment to evaluate its ethical, privacy, and security implications before development begins.
• AI systems are classified by risk level in accordance with the EU AI Act framework. The risk classification determines the level of oversight, documentation, and review required.
• A periodic evaluation of each AI System's performance, safety, and adherence to this policy is conducted. The frequency of review is proportionate to the risk classification of the AI System.
• All AI systems are monitored post-deployment for performance drift, fairness degradation, and unexpected behavior.
• Material changes to an AI system trigger a review and, where applicable, a new impact assessment.

Incident Reporting, Corrective Measures and Feedback

Kyriba takes corrective action promptly whenever an AI system is found to be non-compliant with this policy or applicable law, or when a serious issue arises. Depending on the severity, this may include retraining, reconfiguring, suspending, or decommissioning the affected system. For serious issues, Kyriba escalates to the AI Ethics Committee, investigates the incident, conducts a root-cause analysis, and notifies the relevant regulators as required by law. The AI Ethics Committee oversees the response and ensures a corrective action plan follows.

Customers or End Users who wish to raise a concern about a Kyriba AI system's compliance with this policy may do so through their dedicated Customer Success Manager or anonymously through Kyriba’s Ethics Hotline.

Awareness and Literacy 

Everyone involved in building, deploying, or overseeing Kyriba's AI systems completes training appropriate to their role. Training covers how AI systems work and where their limits are, relevant legal and ethical obligations, Kyriba's own governance framework, and how to spot and escalate potential issues. The AI Ethics Committee oversees the training program and completion on an ongoing basis.

Post-Market Monitoring

Once an AI system is deployed, Kyriba continues to monitor its performance, fairness, and reliability over time, watching for signs of bias, degraded accuracy, or data drift. Clear thresholds determine when a system needs a deeper review or reassessment. The AI Ethics Committee approves the monitoring plan and reviews it periodically or whenever the system materially changes.

8. Supporting Documentation

This Responsible AI Policy is supported by and operates alongside the following Kyriba policies and standards:

• Kyriba Privacy Standard
• Kyriba Security Framework
• Kyriba Data Processing Agreement
• Kyriba AI Terms of Use
• Kyriba Employee Code of Ethics and Business Conduct