Risk, Ethics & Compliance ยท RSK-05
Ethical principles in practice
The organisation has adopted ethical principles for AI and applies them through a working review route that can change or stop a use of AI.
Why it matters
Many organisations publish principles that have no effect on what they build or buy. Principles only matter when there is a route that tests real proposals against them and has the authority to require changes.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No adopted principles; ethical questions are left to individuals. |
| 2 Developing | Principles are published, but there is no route for applying them to real cases, or the route is advisory and rarely used. |
| 3 Defined | Adopted ethical principles are applied through a working review route with triggers and authority, used at the outset of each use and for recorded trade-offs. |
| 4 Managed | Review outcomes are tracked to completion, the route's use and effect are reported, and cases that should have been reviewed but were not are identified. |
| 5 Optimising | Principles and the review route are refined from case experience and stakeholder feedback, and reasoning from past cases is reused as guidance. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- RSK-05.1 Adopted ethical principles for AI are applied through a defined review route with clear triggers.
- RSK-05.2 The review route has authority to require changes to a use of AI.
- RSK-05.3 The review route records its outcomes.
- RSK-05.4 The review route is used across the organisation.
- RSK-05.5 Each use of AI is assessed against the adopted principles at the outset, and the result informs its approval tier.
- RSK-05.6 Where principles conflict, the trade-off goes through the review route and is tested for necessity and proportionality.
- RSK-05.7 Each trade-off between principles is recorded with the alternatives considered and the reasons for the choice.
Assessment questions
- What ethical principles has the organisation adopted for AI?
- Which proposals go to ethical review, and what can the review require?
- Can you give an example where ethical review changed or stopped a use of AI?
- Record of trade-offs between principles, with alternatives and reasons
- The adopted principles and the terms of reference for the review route
- Records of ethical reviews and their outcomes
- Principles assessments at the outset and the approval tier they informed
How to reach Level 3
- Adopt a short set of ethical principles for AI and get them approved.
- Set up a review route with clear triggers, recorded outcomes and authority to require changes or stop a use, and make it available across the organisation.
- Assess each use against the principles at the outset and use the result to set its approval tier (GOV-03).
- Where principles conflict, send the trade-off through the review route, test it for necessity and proportionality, and record the alternatives considered and the reasons.
Common pitfalls
- Publishing principles with no route that can change or stop a use.
- Resolving conflicts between principles informally, leaving no record of the trade-off.
Starter artefacts
- Ethical principles statement
- Principles screening checklist for new uses
- Ethics review record including trade-off analysis
Ownership and sequence
- Accountable
- ai governance lead
- Contributors
- risk lead, business owner, people lead
- Depends on
- GOV-04
- Roadmap step
- 3
- Lifecycle
- strategy, design, operate
Cross-references
| GDS AI Playbook | P2 direct |
|---|---|
| ISO/IEC 42001 | A.6.1.2 partial; A.9.2 partial; A.9.3 partial |
| JSP 936 Part 1 | para 50 direct; para 85 partial; para 86 direct; para 87 partial; para 91 partial; para 93 partial; para 95 partial; para 101 partial; para 105 partial; para 137 partial |
| MITRE AI Maturity Model | P1.1 partial; P1.3 partial; P2.3 partial |
| NIST AI RMF 1.0 | GOVERN 1.2 partial; GOVERN 4.1 partial; MEASURE 2.2 partial |
| UK Data and AI Ethics Framework | Trade-offs 3 direct; Trade-offs 4 partial; SAT 1.8 direct; SAT 2.11 direct |
| UNESCO AI Maturity Framework | 5.2 direct |
direct: this control at Level 3 meets the item. partial: it covers part of it.