W. P. Carey Inc.

We enforce an AI Use Policy covering all AI‑related traffic, including external generative AI services, AI features embedded in software as a service applications, and internal AI models or agents accessed over the Company's network. Access to AI services is permitted only for legitimate business purposes and must comply with all applicable Company security, privacy, and acceptable use policies.

Only AI services that have been formally reviewed and approved by our information technology and legal departments, with oversight by the cybersecurity governance committee, may be used. The Company will block or restrict access to unapproved or high‑risk AI services and domains (shadow AI) through technical and administrative controls.

All AI models, agents, and AI‑enabled features that the Company develops, integrates, or consumes must follow the Company’s service delivery processes. This includes appropriate risk assessment, data protection measures, and change management for all AI capabilities.

2026 Proxy Statement 13

All AI‑related traffic is subject to logging and monitoring. Our information technology team will periodically review AI usage patterns and related logs to identify potential misuse, data leakage, or policy violations and will take appropriate investigative and corrective actions as needed.