Key takeaways
- Start with purpose and risk: who could be harmed and how.
- Test for bias across groups and review training data sources.
- Protect personal data and follow the law that applies in your region.
- Keep a human accountable for high-impact decisions and give users a way to appeal.
- Monitor after launch and keep records of choices and changes.
What is responsible AI?
Why does responsible AI matter?
AI systems now help decide who gets a loan interview, which message is flagged and what a customer sees. Mistakes can harm people at scale, damage trust and create legal risk. Responsible AI is the set of habits that reduces those harms while keeping the benefits. It is a practice for the whole team, not only for a specialist.
What are the core principles?
Frameworks from public bodies, such as the NIST AI Risk Management Framework and the OECD AI Principles, share common themes:
| Principle | Plain meaning |
|---|---|
| Fairness | Do not create unjustified differences in outcomes for groups |
| Privacy | Collect and use personal data lawfully and minimally |
| Transparency | Tell people when AI is used and what its limits are |
| Safety and robustness | Work reliably, including in unusual cases |
| Accountability | A named person or team answers for the system |
| Human oversight | People can review, correct and override important decisions |
| Security | Resist misuse and attacks, including prompt injection |
How do I assess risk before building?
Write down the purpose, the users, the decisions the system influences and what could go wrong. Ask: is the decision high impact (health, money, jobs, education)? Who is affected who has no say? What happens when the model is wrong? Rate the risk and match the controls: low-risk tools need light review, high-risk ones need testing, human review and approval.
How do I check for bias?
Bias can come from data that under-represents groups, labels shaped by past decisions or features that stand in for sensitive traits. Steps: describe the data and who is missing, split performance metrics by relevant groups, look for large gaps, investigate causes and fix with better data, different features or changes to the process. A metric that looks good overall can hide poor results for a group.
How do I protect privacy?
Collect only the data you need, remove or mask identifiers, set retention limits, restrict access and do not paste personal or confidential data into tools that are not approved. Follow the laws and policies that apply to you, such as data protection rules in your region. Tell people how their data is used.
How do I handle generative AI risks?
Generative systems can produce false statements, unsafe content, copied text or leaked data. Controls include grounding answers in trusted documents with citations, filters and safety rules, limits on what tools the system can use, review of outputs before sending to customers, and testing with adversarial prompts. Label AI-generated content where people could be misled.
What does transparency look like?
Tell users when they interact with AI, explain what the system can and cannot do, show sources where possible and give a route to a human. Keep internal documentation: data sources, model version, evaluation results, known limits and decisions made. A short "model card" style document is a good habit.
How do I keep humans in control?
For high-impact decisions, use AI as support, not the final decision maker. Make sure the reviewer has the time, information and authority to disagree, otherwise review is only a formality. Provide a way for affected people to ask for a review.
How do I monitor after launch?
Track quality, error types, user complaints, drift in data and performance by group. Set thresholds that trigger review or rollback. Keep a log of incidents and fixes, and review the system on a schedule, not only when something goes wrong.
What is a simple review checklist?
- Is the purpose clear and appropriate? 2. Is the data lawful, relevant and checked for gaps? 3. Were results tested across groups? 4. Are privacy and security controls in place? 5. Do users know AI is used and what its limits are? 6. Is there human oversight and an appeal path? 7. Is there monitoring, logging and an owner? 8. Is there a plan to stop or roll back?
What mistakes should teams avoid?
Treating ethics as a final step, testing only on average results, copying data without checking its source, hiding AI use from users and having no owner after launch. This guide is general information and not legal advice; check the rules that apply to your organisation and region.
Download Responsible AI Guide PDF
Responsible AI Guide PDF
The PDF carries the same content as this page in a clean, print-ready layout, so you can read it offline and keep it for revision.
4 pages · 88 KB · PDF · Updated 5 Nov 2026