DATAPACT: COMPLIANCE BY DESIGN OF DATA/AI OPERATIONS AND PIPELINES

Project Information

DataPACT

Grant agreement ID: 101189771

DOI

10.3030/101189771

EC signature date 8 November 2024

Start date 1 January 2025

End date 31 December 2027

Funded under

• Digital, Industry and Space

Total cost

€ 11 176 030,00

EU contribution

€ 9 999 998,50

Coordinated by

SINTEF AS
Norway

Periodic Reporting for period 1 - DataPACT (DATAPACT: COMPLIANCE BY DESIGN OF DATA/AI OPERATIONS AND PIPELINES)

Reporting period: 2025-01-01 to 2025-12-31

Summary of the context and overall objectives of the project

DataPACT develops novel tools and methodologies that enable efficient, compliant, ethical, and sustainable data/AI operations and pipelines. DataPACT delivers a transformative approach where compliance, ethics, and environmental sustainability are not afterthoughts but foundational elements of data/AI operations and pipelines. DataPACT contributes to the design, implementation, and management of data/AI operations and pipelines by embedding compliance, privacy, and environmental sustainability at their core design. It delivers compliance by design for data/AI operations and pipelines by developing innovative technical tools (DataPACT Compliance Toolbox) and tool-supported methodologies (DataPACT Compliance Framework) for compliance assessment and realization of data/AI pipelines designed, deployed and executed through a set of pipeline management tools and techniques (DataPACT Compliance-aware Data/AI Pipeline Toolbox).
DataPACT validates its core results through a strong selection of seven complementary use cases offered by SMEs, large companies, and public sector organizations in relevant areas, including media and entertainment, healthcare, smart cities, law enforcement and security, customer relationship management, manufacturing, and public data. DataPACT helps them ensure straightforward and cost-effective compliance with existing and emerging regulations and guidelines, shorter time-to-market for compliant data solutions, fair and unbiased data-driven systems, respect for privacy and other fundamental rights, and lower and transparent environmental impact for intensive data/AI pipeline operations.
DataPACT gathers a balanced consortium of 18 partners from 16 countries, consisting of two large companies, two public sector organizations, four SMEs, two research centers, and seven universities, covering relevant aspects related to legal, ethical, social, environmental, and technical compliance of data/AI operations and pipelines.

Work performed from the beginning of the project to the end of the period covered by the report and main results achieved so far

During the first reporting period, the work towards achieving the project’s objectives focused on identifying requirements, mapping existing tools to the DataPACT use cases, and establishing the foundations for the DataPACT toolboxes and frameworks. Activities covered the state-of-the-art analysis, market assessment, user story and use case definition, and architecture design.
Main achievements include:
- Establishment of the Data Management Plan (Deliverable D1.4) as a living document guiding data management throughout the project.
- Development of the state-of-the-art overview for expected results, identifying key challenges and knowledge gaps (part of Deliverable D1.1).
- Consolidated identification and mapping of technical, market, and use case requirements (Deliverables D1.1 and D5.1).
- Gathering requirements through AS-IS and TO-BE interviews, user stories, and survey.
- Cataloguing of relevant tools and mapping them against expected results and user stories.
- Identification of relevant legislation and national transpositions, forming the basis for automated compliance solutions and the first iteration of the Compliance Framework (Deliverable D4.1).
- Definition and documentation of the DataPACT architecture (Deliverable D1.2).
- Release of the first integrated compliance-aware data/AI pipeline lifecycle toolbox, incorporating tools from the PipelineR, GreenR, and AppleyR collections (Deliverable D2.1).
- Release of the first version of the Compliance Toolbox, delivering early results across the PolicyR and TrustR toolsets (Deliverable D3.1).
- Establishment of the project’s exploitation strategy with a phased workflow and identification of Key Exploitable Results (Deliverable D6.1).

Progress beyond the state of the art and expected potential impact (including the socio-economic impact and the wider societal implications of the project so far)

Throughout the first reporting period, DataPACT advanced significantly toward its goal of enabling compliance-by-design for data and AI operations and pipelines. The main progress areas include developments in the Compliance-aware Pipeline Toolbox, the Compliance Toolbox, and the overarching Compliance Framework.
- Technical and market requirements were consolidated, and regulatory, ethical, societal, and sustainability considerations translated into shared architectures, interoperable tools, and compliant data models.
- The first version of the Compliance-aware Pipeline Lifecycle Toolbox was released, allowing data/AI pipelines to be designed, executed, and monitored with embedded compliance, traceability, and environmental awareness.
- The toolbox integrates functionality such as policy-aware operation definition, pseudonymisation, pipeline simulation, compliance monitoring, and energy and emissions tracking, supporting evidence generation and automated compliance assessment.
- The first integrated version of the Compliance Toolbox was developed, operationalising compliance-by-design principles through tools addressing privacy, consent, access control, contracting, trust, fairness, robustness, and explainability.
- The PolicyR and TrustR tools enable machine-readable policy specification, dynamic consent management, automated negotiation, trust and reputation modelling, bias inspection, fairness assessment, and transparent AI decision-making.
- The first version of the DataPACT Compliance Framework was established, providing the legal, ethical, and social foundations for compliance assessment across the entire pipeline lifecycle.
- The framework aligns with key EU regulations, including GDPR, the DGA, the Data Act, and the AI Act, and introduces AssessR tools that connect regulatory knowledge, LLM-based compliance assistants, and certification mechanisms with operational toolchains.
Together, these developments establish a baseline approach that embeds compliance and ethical considerations into data and AI pipelines, improving their reliability and sustainability