Risk, Ethics & Compliance
Sets out how the organisation decides how much AI risk it will accept, assesses the risks and effects of each use of AI, and meets its legal, regulatory and ethical obligations. Assessment should be proportionate: a quick check for low-risk use, and deeper work where people's rights, safety or livelihoods could be affected.
AI risk appetite
The board or equivalent has approved a statement of how much AI risk the organisation will accept, broken down by kind of risk, and it is used in decisions.
AI risk assessment method
The organisation uses one consistent, documented method to assess the risks of each use of AI, and the results feed its corporate risk management.
Impact assessment before deployment
Before a use of AI goes live, its likely effects on people and groups (including equality, privacy, rights and safety) and on society and the environment are assessed to a depth that matches its risk, and the findings are acted on.
Legal and regulatory obligations
The organisation keeps a current view of the laws, regulations and standards that apply to its use of AI, with an owner for each obligation and a way of checking it is met.
Ethical principles in practice
The organisation has adopted ethical principles for AI and applies them through a working review route that can change or stop a use of AI.
Fairness and bias management
Unfair bias is identified, tested for and reduced at each stage of a use of AI, from design through to live operation.
Human oversight proportionate to risk
Each use of AI has human oversight designed to match its risk, stating who reviews, at which point, and with what authority to override or stop it.
Explanation and challenge for affected people
People affected by decisions that AI supports can find out that AI was involved, get an explanation they can understand, and challenge the outcome through a route that can change it.
Risk of AI from suppliers
Before AI in a bought product or service is used, and when it changes, the organisation assesses what it does, how it uses data, how the supplier changes the model, and what assurance the supplier offers.