DATAPACT: COMPLIANCE BY DESIGN OF DATA/AI OPERATIONS AND PIPELINES

Informazioni relative al progetto

DataPACT

ID dell’accordo di sovvenzione: 101189771

DOI

10.3030/101189771

Data della firma CE 8 Novembre 2024

Data di avvio 1 Gennaio 2025

Data di completamento 31 Dicembre 2027

Finanziato da

• Digital, Industry and Space

Costo totale

€ 11 176 030,00

Contributo UE

€ 9 999 998,50

Coordinato da

SINTEF AS
Norway

Periodic Reporting for period 1 - DataPACT (DATAPACT: COMPLIANCE BY DESIGN OF DATA/AI OPERATIONS AND PIPELINES)

Periodo di rendicontazione: 2025-01-01 al 2025-12-31

Sintesi del contesto e degli obiettivi generali del progetto

DataPACT develops novel tools and methodologies that enable efficient, compliant, ethical, and sustainable data/AI operations and pipelines. DataPACT delivers a transformative approach where compliance, ethics, and environmental sustainability are not afterthoughts but foundational elements of data/AI operations and pipelines. DataPACT contributes to the design, implementation, and management of data/AI operations and pipelines by embedding compliance, privacy, and environmental sustainability at their core design. It delivers compliance by design for data/AI operations and pipelines by developing innovative technical tools (DataPACT Compliance Toolbox) and tool-supported methodologies (DataPACT Compliance Framework) for compliance assessment and realization of data/AI pipelines designed, deployed and executed through a set of pipeline management tools and techniques (DataPACT Compliance-aware Data/AI Pipeline Toolbox).
DataPACT validates its core results through a strong selection of seven complementary use cases offered by SMEs, large companies, and public sector organizations in relevant areas, including media and entertainment, healthcare, smart cities, law enforcement and security, customer relationship management, manufacturing, and public data. DataPACT helps them ensure straightforward and cost-effective compliance with existing and emerging regulations and guidelines, shorter time-to-market for compliant data solutions, fair and unbiased data-driven systems, respect for privacy and other fundamental rights, and lower and transparent environmental impact for intensive data/AI pipeline operations.
DataPACT gathers a balanced consortium of 18 partners from 16 countries, consisting of two large companies, two public sector organizations, four SMEs, two research centers, and seven universities, covering relevant aspects related to legal, ethical, social, environmental, and technical compliance of data/AI operations and pipelines.

Lavoro eseguito dall’inizio del progetto fino alla fine del periodo coperto dalla relazione e principali risultati finora ottenuti

During the first reporting period, the work towards achieving the project’s objectives focused on identifying requirements, mapping existing tools to the DataPACT use cases, and establishing the foundations for the DataPACT toolboxes and frameworks. Activities covered the state-of-the-art analysis, market assessment, user story and use case definition, and architecture design.
Main achievements include:
- Establishment of the Data Management Plan (Deliverable D1.4) as a living document guiding data management throughout the project.
- Development of the state-of-the-art overview for expected results, identifying key challenges and knowledge gaps (part of Deliverable D1.1).
- Consolidated identification and mapping of technical, market, and use case requirements (Deliverables D1.1 and D5.1).
- Gathering requirements through AS-IS and TO-BE interviews, user stories, and survey.
- Cataloguing of relevant tools and mapping them against expected results and user stories.
- Identification of relevant legislation and national transpositions, forming the basis for automated compliance solutions and the first iteration of the Compliance Framework (Deliverable D4.1).
- Definition and documentation of the DataPACT architecture (Deliverable D1.2).
- Release of the first integrated compliance-aware data/AI pipeline lifecycle toolbox, incorporating tools from the PipelineR, GreenR, and AppleyR collections (Deliverable D2.1).
- Release of the first version of the Compliance Toolbox, delivering early results across the PolicyR and TrustR toolsets (Deliverable D3.1).
- Establishment of the project’s exploitation strategy with a phased workflow and identification of Key Exploitable Results (Deliverable D6.1).

Progressi oltre lo stato dell’arte e potenziale impatto previsto (incluso l’impatto socioeconomico e le implicazioni sociali più ampie del progetto fino ad ora)

Throughout the first reporting period, DataPACT advanced significantly toward its goal of enabling compliance-by-design for data and AI operations and pipelines. The main progress areas include developments in the Compliance-aware Pipeline Toolbox, the Compliance Toolbox, and the overarching Compliance Framework.
- Technical and market requirements were consolidated, and regulatory, ethical, societal, and sustainability considerations translated into shared architectures, interoperable tools, and compliant data models.
- The first version of the Compliance-aware Pipeline Lifecycle Toolbox was released, allowing data/AI pipelines to be designed, executed, and monitored with embedded compliance, traceability, and environmental awareness.
- The toolbox integrates functionality such as policy-aware operation definition, pseudonymisation, pipeline simulation, compliance monitoring, and energy and emissions tracking, supporting evidence generation and automated compliance assessment.
- The first integrated version of the Compliance Toolbox was developed, operationalising compliance-by-design principles through tools addressing privacy, consent, access control, contracting, trust, fairness, robustness, and explainability.
- The PolicyR and TrustR tools enable machine-readable policy specification, dynamic consent management, automated negotiation, trust and reputation modelling, bias inspection, fairness assessment, and transparent AI decision-making.
- The first version of the DataPACT Compliance Framework was established, providing the legal, ethical, and social foundations for compliance assessment across the entire pipeline lifecycle.
- The framework aligns with key EU regulations, including GDPR, the DGA, the Data Act, and the AI Act, and introduces AssessR tools that connect regulatory knowledge, LLM-based compliance assistants, and certification mechanisms with operational toolchains.
Together, these developments establish a baseline approach that embeds compliance and ethical considerations into data and AI pipelines, improving their reliability and sustainability