Cross-reference

UK Data and AI Ethics Framework

116 items: 108 met directly by a control at Level 3, 6 partly, 2 deliberately out of scope.

Ref	Item (our description)	Controls	Note
Transparency 1	Explain the what, how and why of the project in plain language to non-experts	POR-05 direct, TEC-05 partial, OPM-02 partial, GOV-09 partial	The business case states in plain language the problem the use solves, with options that include not using AI; documentation and published records explain the how.
Transparency 2	Maintain detailed records of the project, including the decisions made in its design	POR-03 partial, GOV-06 partial, GOV-05 partial, POR-05 partial, RSK-03 partial, POR-04 direct	A record of key design decisions and assumptions, with reasons, is kept for each use and updated at each gate; owner, user need, supplier and impact assessments are recorded alongside.
Transparency 3	Make information about a project or tool publicly available	GOV-09 direct	Published records for in-scope uses, with a recorded decision on publication for each inventory entry.
Transparency 4	Use the ATRS if in mandatory scope; consider publishing a record even if not	GOV-09 direct	GOV-09 requires records in the required format and a reasoned publish decision for every inventory entry, which covers voluntary records.
Transparency 5	Give appropriate disclosure when AI has been used to produce an output	GOV-10 direct, RSK-08 partial, TEC-02 partial	GOV-10 sets disclosure rules for AI content released externally and used internally for decisions or records.
Transparency 6	Maintain records of all data sources, including collection methods, licences and preprocessing	DAT-08 direct, DAT-04 partial	DAT-08 records source, collection method, rights, licence and preparation steps; DAT-04 catalogues other data in use.
Transparency 7	Publish DPIAs and EIAs where possible	GOV-09 direct, RSK-03 partial	For each use it is decided whether its impact assessments are published, with the reason recorded.
Transparency 8	Maintain detailed records of all design decisions and assumptions behind a solution	POR-05 partial, TEC-05 partial, RSK-02 partial, POR-04 direct	A record of key design decisions and assumptions, with reasons, is kept for each use and updated at each gate.
Transparency 9	Create and regularly update assurance documentation such as model cards or data set cards	TEC-05 direct, DAT-08 partial	TEC-05 documentation per version states purpose, intended users, limitations and where not to rely on it, checked at each release.
Transparency 10	If possible, publish your source code openly	OPM-08 partial, POR-08 partial	Sharing solutions with peers and reuse inside are covered; no control asks for a decision on publishing code openly.
Transparency 11	Build algorithmic tools with explainability in mind, to the degree the use case needs	TEC-02 direct, TEC-06 partial	TEC-02 builds in explainability and sets the degree needed by risk and audience; TEC-06 tests what was achieved.
Transparency 12	Use technical methods such as SHAP or LIME to assess model interpretability	none	out of scope: choice of interpretability technique is technical method advice; TEC-06 already tests the explainability achieved.
Transparency 13	Consult technical experts and current research when choosing explainability methods	none	out of scope: advice on selecting explainability methods is technical practice for build teams, not an adoption control.
Accountability 1	Nominate an SRO, typically a senior decision maker, accountable for the project	GOV-05 direct	Named business owner for every use, recorded in the inventory.
Accountability 2	Talk to the DPO and ensure they have the information, tools and authority to govern	DAT-05 partial, GOV-07 direct	Data protection advice is brought in at the start of design with authority to require changes, and data protection governance has a defined AI step.
Accountability 3	Establish independent reviews to review and challenge data and AI decisions	MON-05 direct	Independent assurance by risk tier for all uses, with tracked findings.
Accountability 4	Clarify legal responsibilities across the data and AI supply chain for all parties	RSK-04 direct, SEC-03 partial, OPM-04 partial	For each use, how legal obligations are split between suppliers, the organisation and users is recorded and each party is told its share.
Accountability 5	When buying a system, define detailed responsibilities and liability contractually	OPM-04 direct, RSK-09 partial	Standard AI contract terms allocate responsibility and liability for AI outputs and harm, alongside data, IP, security split and audit.
Accountability 6	Publish accessible information on how the AI system works and why it is ethical and lawful	GOV-09 direct, TEC-05 partial	Published transparency records cover purpose, data, logic and the measures taken.
Accountability 7	Have mechanisms for users to give feedback, report errors or contest decisions	MON-06 direct, RSK-08 direct, OPM-07 partial	Feedback per use (MON-06), challenge with human review (RSK-08), problem reporting (OPM-07).
Accountability 8	Establish a human in the loop to oversee outputs in risky or high-impact uses	RSK-07 direct	Oversight set by risk, with reviewer authority to override or stop.
Accountability 9	Identify who is responsible for AI outputs and decisions, including LLM tools	GOV-05 direct, TEC-01 partial, GOV-01 partial	Named owners for every use, embedded and general tools included via the inventory; approved tools each have an owner.
Fairness 1	Define fairness for the project and how to measure it across its life cycle	RSK-06 direct	Fairness measures defined per use, tested before release and monitored live.
Fairness 2	Understand your users: groups most affected and links to protected characteristics	RSK-06 direct, RSK-03 partial	RSK-06 defines the groups at risk; RSK-03 covers equality impact.
Fairness 3	Consider proxies for protected characteristics and be transparent about their use	RSK-06 direct, DAT-05 partial	Proxies for protected characteristics are identified for each in-scope use and their use is recorded with reasons.
Fairness 4	Complete an EIA and consider publishing it with the DPIA and ATRS record	RSK-03 direct, GOV-09 partial	RSK-03 covers the equality assessment; publishing the assessment itself is not required.
Fairness 5	Include diverse views: consider diversity of the team and contracted third parties	PPL-07 partial, GOV-04 partial, OPM-06 direct	Diversity of perspective is considered for each delivery team, including contracted third parties, with structured stakeholder input where it falls short.
Fairness 6	Collect feedback and data throughout so the project stays fair and delivers benefits	MON-02 direct, MON-06 direct, MON-03 partial	Live fairness monitoring, user feedback and benefits tracking.
Fairness 7	Regularly update your EIA	RSK-03 direct	Impact assessment kept current during use.
Privacy 1	Involve information governance teams early in the project design process	GOV-07 direct, DAT-05 partial, OPM-06 partial	Information governance and data protection advice are brought in at the start of design, with authority to require changes.
Privacy 2	Record purpose and benefit of data collection and use it to prevent scope creep	DAT-05 direct, MON-02 partial	Recorded purpose and compatibility check per use; MON-02 watches for use outside the approved purpose.
Privacy 3	Embed privacy by design and default and undertake a DPIA	OPM-06 direct, RSK-03 direct, DAT-05 partial	Privacy by design with protective defaults (OPM-06) and a privacy impact assessment (RSK-03).
Privacy 4	Adopt data minimisation: collect and process the least data the purpose needs	DAT-05 direct, DAT-07 partial	Data collected and processed for each use is limited to what the purpose needs.
Privacy 5	Facilitate data subjects' rights to access and correction, with meaningful consent	DAT-05 direct	Rights requests handled, including for training data, on a recorded lawful basis.
Privacy 6	Use privacy enhancing technologies such as anonymisation or synthetic data	DAT-05 direct, DAT-08 partial	Privacy enhancing techniques are considered wherever personal data is used, with the decision recorded.
Privacy 7	Share data responsibly under a privacy-preserving governance regime and agreements	DAT-07 direct, DAT-05 partial, DAT-06 partial	Sharing follows documented agreements; lawful basis and retention sit with DAT-05 and DAT-06.
Privacy 8	Consider additional privacy risks AI brings, such as re-identification or leakage	RSK-03 direct, SEC-04 direct, TEC-08 partial	Privacy and sensitive inferences in the impact assessment; leakage rules for AI tools; detection of unapproved public tools.
Privacy 9	Provide clear privacy notices and give users free choice to configure settings	DAT-05 direct, OPM-06 partial	People told accessibly how their data is used; privacy-protective defaults in OPM-06.
Privacy 10	Prepare for breaches with clear plans and assigned responsibilities	SEC-05 direct, MON-04 partial	Security incident playbooks with breach notification routes and trained responders.
Privacy 11	Plan for decommissioning: data archival or deletion at an appropriate time	POR-09 direct, DAT-06 direct	Retirement covers disposal or retention of models and data, under records rules.
Environmental sustainability 1	Explore alternative solutions, including simple and low-energy options, before selecting	OPM-02 direct	Configure, procure, build or wait decision with environmental footprint as a criterion.
Environmental sustainability 2	Consider reuse of existing models, favouring open-source models over retraining	OPM-02 direct, POR-08 partial, OPM-08 partial	Reuse of existing and openly available models is considered before training new ones.
Environmental sustainability 3	Select suitable metrics for measuring and assessing environmental impact	RSK-03 partial, MON-01 direct	Measures for each use include environmental footprint (energy, compute, water) where material, with a baseline; the impact assessment covers environmental effects.
Environmental sustainability 4	Evaluate sustainability credentials of third-party providers, including renewable energy use	RSK-09 direct	Supplier due diligence covers energy use and wider sustainability practice.
Environmental sustainability 5	Raise awareness of the environmental and social impact of digital technologies	PPL-01 direct	The literacy baseline required for all staff covers the environmental and social impact of AI use, which brings sustainability into training.
Societal impact 1	Write down project objectives in non-technical terms before choosing a technical solution	POR-05 direct, STR-01 partial	The business case states the problem in plain language and weighs options, including not using AI, before approval at the gate.
Societal impact 2	Involve diverse stakeholders, especially those most affected, in design and testing	OPM-10 direct, OPM-06 partial, CUL-08 partial, CUL-03 partial	Participants who represent the people served and engagement of affected communities (OPM-10); user research and testing with users (OPM-06); public views in design (CUL-08); staff (CUL-03).
Societal impact 3	Complete an Equality Impact Assessment	RSK-03 direct	Equality is part of the impact assessment before go-live.
Societal impact 4	Use feedback mechanisms such as surveys and advisory boards to shape outcomes	MON-06 direct, CUL-08 partial	Feedback per use reviewed and acted on; CUL-08 gathers public views.
Societal impact 5	Make sure you have meaningful human control at the right stages	RSK-07 direct	Oversight model per use set by risk.
Societal impact 6	Continuously evaluate and improve the project, including decommissioning when no longer useful	POR-04 direct, POR-09 direct, MON-03 partial	Stage gates from idea to retirement; retirement triggered by periodic review with user transition.
Safety 1	Make sure researchers and research participants are physically and emotionally safe	OPM-10 partial	Research with participants has informed consent and ethics review and protects their wellbeing and right to withdraw; the safety of the researchers themselves is not addressed.
Safety 2	Comply with security requirements and standards such as Secure by Design	SEC-01 direct, OPM-06 partial	Recognised security baseline applied to every use before go-live.
Safety 3	Apply data minimisation to limit the potential harms of a data breach	DAT-05 direct, DAT-07 partial	Data collected and processed for each use is limited to what the purpose needs, which covers personal data.
Safety 4	Keep all data secure throughout the project	SEC-04 direct, DAT-07 partial, SEC-01 partial	Information protection rules and technical measures on AI tools, with least privilege access.
Safety 5	Check for data quality, accuracy or reliability issues such as drift or poisoning	DAT-03 direct, MON-02 direct, SEC-02 partial	Data quality assessed before and during use; drift monitored live; poisoning as an AI threat.
Safety 6	Ensure human oversight and strategies to intervene, especially in high-risk uses	RSK-07 direct	Oversight with authority to override or stop.
Safety 7	Run rigorous testing to find failure modes, including red teaming	TEC-06 direct, SEC-06 partial	Testing against criteria, edge cases and harmful output (TEC-06), with safeguard bypass and independent security testing for higher risk (SEC-06).
Safety 8	If the system cannot be made sufficiently safe, do not use it	RSK-01 partial, GOV-03 direct, POR-07 partial	A use whose residual risk cannot be brought within the risk appetite is not approved, or is stopped.
Safety 9	Use available resources, including courses on risks and ethics	PPL-01 direct, PPL-05 partial	The literacy baseline covers risks and the adopted ethical principles for all staff; role pathways add specific risk duties.
Trade-offs 1	Include stakeholder perspectives by engaging with affected communities	CUL-08 direct, CUL-03 partial	Views of the people served gathered and considered in design.
Trade-offs 2	Consult legal and human rights frameworks so decisions align with standards	RSK-04 direct, RSK-03 partial	Obligations register used at design with legal advice; rights in the impact assessment.
Trade-offs 3	Balance proportionality and necessity	RSK-05 direct, DAT-05 partial	Where principles conflict, the trade-off is tested for necessity and proportionality through the review route.
Trade-offs 4	Ensure meaningful and inclusive deliberation	GOV-04 partial, RSK-05 partial	Trade-offs between principles go through the review route and are recorded with alternatives and reasons, and the oversight forum is diverse; the review route itself is not required to be inclusive.
Trade-offs 5	Establish mechanisms to monitor outcomes and adjust if necessary	MON-02 direct, RSK-03 partial	Live monitoring against thresholds with named responders.
SAT 1.1	Describe the problem you are trying to solve in non-technical terms	POR-05 direct, POR-03 partial	The proportionate business case for every use states the case for change, benefits and options; the pipeline register holds the proposal but not the problem statement itself.
SAT 1.2	Describe the project purpose and user need	OPM-06 direct, POR-05 partial, GOV-06 partial	User research under the delivery standards establishes the user need; purpose is recorded in the business case and, once live, the inventory.
SAT 1.3	Have you consulted your organisation's DPO?	DAT-05 direct, GOV-07 partial	Each use of data is signed off with data protection advice before use; GOV-07 gives data protection its AI step.
SAT 1.4	Have you consulted your organisation's data and information security teams?	GOV-07 direct, SEC-01 partial, SEC-02 partial	Information management and security governance each have a defined AI step that the AI route calls on; the security baseline and threat model bring security teams in per use.
SAT 1.5	Are you using any personal or sensitive data? Consider the privacy impact	DAT-04 direct, DAT-05 direct, RSK-03 partial	The catalogue records sensitivity and whether data holds personal data; lawful basis and fairness are recorded per use, and the impact assessment covers privacy.
SAT 1.6	Have you conducted a DPIA, and how will identified risks be mitigated?	RSK-03 direct, DAT-05 partial, GOV-07 partial	The impact assessment covers privacy, is signed off before go-live and tracks mitigations; DAT-05 feeds it and GOV-07 ties in the existing DPIA process.
SAT 1.7	What data sharing agreements are in place, and are they proportionate and privacy protecting?	DAT-07 direct, DAT-05 partial	Sharing follows documented agreements approved by the data owner; proportionality to the purpose comes from the DAT-05 purpose and fairness check.
SAT 1.8	What governance structures support safe, effective and responsible implementation?	GOV-04 direct, RSK-05 direct, GOV-03 partial, GOV-07 partial	Oversight forum and an ethics review route with authority to require changes; decision rights tiered by risk set which structures review each use.
SAT 1.9	How have you assigned responsibility for outcomes? Can owners make necessary changes?	GOV-05 direct, GOV-03 direct, CUL-04 partial	Named business, data, technical and assurance owners per use, with decision rights to change or retire; concerns raised are acted on through CUL-04.
SAT 1.10	What process documents project decisions and builds an evidence base for them?	POR-03 direct, POR-04 direct, TEC-05 partial	Decision history and gate decisions are recorded in the pipeline register; design records for audit come through TEC-05 documentation.
SAT 1.11	If conducting research, how are researchers and participants kept safe?	OPM-10 direct	Evaluations and user research involving people need informed consent and ethics review through the established route, which covers risks to participants and researchers.
SAT 1.12	How are you ensuring diversity and representation in your project team?	OPM-06 direct, PPL-07 partial, GOV-04 partial	Diversity of perspective is considered for each team, with structured stakeholder input where it falls short.
SAT 1.13	Who are your users, and how might groups be impacted unequally?	RSK-03 direct, RSK-06 direct, OPM-06 partial	The equality impact assessment and defined groups at risk cover unequal impact; users and their needs come from user research.
SAT 1.14	How are you involving diverse stakeholders and affected groups in planning, design and development?	OPM-10 direct, OPM-06 partial, CUL-08 partial, CUL-03 partial	For significant uses, affected communities and experts who are not users are engaged at planning and design (OPM-10), and user research continues through development (OPM-06).
SAT 1.15	Have you consulted civil society and domain experts? What risks and opportunities were recorded?	OPM-10 direct, STR-07 partial, CUL-08 partial	For significant uses, affected communities and experts who are not users are engaged at planning and design, with their input and the response recorded.
SAT 1.16	Are you researching environmental impact, and is it shaping early decisions?	OPM-02 direct, RSK-03 partial	The configure, procure, build or wait decision for every use weighs environmental footprint; the impact assessment covers environmental effects before go-live.
SAT 2.1	How are you implementing safety principles from the start of your project?	OPM-06 direct, TEC-06 partial, SEC-02 partial, GOV-07 partial	Delivery standards require safety, security and privacy by design, with accuracy, robustness and reliability requirements set at design.
SAT 2.2	What processes assess and resolve data quality issues?	DAT-03 direct	Quality requirements per use, assessed before use and at intervals, with owned remediation.
SAT 2.3	How are you communicating the system's purpose, design and outcomes to stakeholders?	TEC-05 direct, GOV-09 partial, CUL-02 partial	Documentation per version states purpose, users, how it works, inputs, outputs and limits, suited to each audience; public records and internal communication add reach.
SAT 2.4	How are you communicating with individuals about how their data is used?	DAT-05 direct	People whose data or inputs are used are told accessibly how they are used, accessed and stored.
SAT 2.5	How will outputs be clearly explained and understood by stakeholders and users?	TEC-02 direct, TEC-06 partial, RSK-08 partial	The degree of explainability is set per use by risk and audience and built into patterns; testing checks what was achieved.
SAT 2.6	What privacy enhancing methods have you integrated into your project?	DAT-05 direct, OPM-06 partial, DAT-07 partial	Privacy enhancing techniques are considered and recorded for personal data used in training or tuning; privacy by design and minimised test data cover other stages.
SAT 2.7	What plan is in place for fairness testing?	RSK-06 direct, MON-06 partial	Fairness measures and testing before release under a documented approach; user feedback adds a non-technical source.
SAT 2.8	How are you identifying and mitigating biases in your data sets?	RSK-06 direct, DAT-03 direct	Bias management across the lifecycle, and data quality requirements that include representativeness.
SAT 2.9	How are diverse needs captured and integrated into prototype development?	RSK-03 direct, OPM-06 partial, OPM-10 partial	The equality impact assessment covers the Public Sector Equality Duty; user research (OPM-06) with participants who represent those served (OPM-10) informs design.
SAT 2.10	What would be the harm in not doing the project?	POR-05 direct	The business case states benefits and options, which include not proceeding.
SAT 2.11	Consider trade-offs between ethical principles and alternatives. Why prioritise the chosen solution?	RSK-05 direct, RSK-02 partial, OPM-02 partial	Where principles conflict, the trade-off is recorded with the alternatives considered and the reasons for the choice.
SAT 2.12	What plan is in place for measuring and reducing environmental impact?	RSK-03 partial, OPM-02 partial, MON-01 partial	Environmental footprint is measured with a baseline and environmental mitigations are tracked, but no control asks for a reduction plan or target set against those measures.
SAT 3.1	How have you considered the accuracy, representativeness and completeness of your data set?	DAT-03 direct, RSK-06 partial, MON-02 partial	Data quality requirements include relevance and representativeness, with shortfalls mitigated; proxy discrimination and future monitoring sit in RSK-06 and MON-02.
SAT 3.2	How have you evaluated and addressed fairness in your AI system before going live?	RSK-06 direct, TEC-06 partial	Groups at risk and fairness measures are defined, tested before release and mitigated.
SAT 3.3	How are you ensuring accessibility for all users?	OPM-06 direct, RSK-03 partial	Services, documentation and notices are tested with users who have accessibility needs before go-live.
SAT 3.4	How have you designed and tested human oversight mechanisms?	RSK-07 direct, GOV-05 partial, CUL-04 partial	The oversight model is set per use, and its design is tested before go-live to show reviewers can detect problems and intervene in time.
SAT 3.5	Is documentation in place so others can replicate your process, results and outputs?	DAT-08 direct, TEC-05 direct, TEC-06 partial	Data sources and preparation linked to models, versioned models, prompts, configuration and data sets, and recorded test results.
SAT 3.6	Have you checked whether the project is in scope of the ATRS?	GOV-09 direct, RSK-04 partial	For each inventory entry a publication decision is made against the applicable criteria, with the reason recorded.
SAT 3.7	How are you integrating environmental monitoring into development?	RSK-09 partial, OPM-02 partial, RSK-03 partial, MON-01 partial	Footprint shapes the sourcing choice, supplier energy and sustainability are assessed and a baseline is set before go-live, but environmental measures are not tracked through development.
SAT 3.8	Could the project affect employment, working conditions or skills? Who gains or loses?	PPL-06 partial, CUL-01 partial, CUL-03 partial, CUL-07 partial, RSK-03 direct	The impact assessment for each use covers workforce effects (workload, working conditions, skills and progression) alongside equality; workforce plans add the organisation view.
SAT 3.9	What go or no-go criteria apply before going live, and what would cause delay?	POR-04 direct, GOV-03 direct, POR-07 partial, MON-01 partial	Gate exit criteria proportionate to risk, and decision rights naming who approves go-live.
SAT 3.10	How will you transition to live, and who will own the system afterwards?	GOV-05 direct, OPM-07 direct, POR-03 partial, OPM-01 partial	Formal ownership handover with residual risk acceptance and a support owner for every live service; the register entry moves to the inventory.
SAT 4.1	How are you monitoring performance in deployment and responding if it degrades or becomes unsafe?	MON-02 direct, OPM-09 direct, MON-01 partial, TEC-05 partial	Live monitoring against thresholds with named responders, tested fallbacks with users told, and rollback to a known good version.
SAT 4.2	How are logs and documentation maintained to support investigations and transparency?	DAT-06 direct, MON-02 partial, TEC-05 partial, SEC-01 partial	Records rules cover inputs, outputs, decisions and system logs, retrievable for every use; event logging and version documentation support them.
SAT 4.3	What mechanisms let users submit feedback on system performance?	MON-06 direct, OPM-07 partial	Every live use has a feedback route for users and affected people; OPM-07 adds a problem reporting route.
SAT 4.4	How are you actioning user feedback to improve the project?	MON-06 direct, TEC-05 partial	Feedback is reviewed on a set cycle with actions recorded; users are told of planned changes under TEC-05.
SAT 4.5	Can the rationale for outputs be explained understandably to users and affected individuals?	RSK-08 direct, TEC-02 partial	People affected by AI-supported decisions can obtain a meaningful explanation.
SAT 4.6	How are you notifying users they are interacting with AI rather than a human?	RSK-08 direct, GOV-10 partial, TEC-02 partial	People are told at first contact, clearly and accessibly, when interacting with AI; content disclosure and machine-readable marking support it.
SAT 4.7	If within mandatory scope, have you published an ATRS transparency record?	GOV-09 direct	Records are published for all in-scope uses in the required format.
SAT 4.8	How long will data be retained, and what justifies that period?	DAT-06 direct, DAT-05 partial	Retention rules for AI inputs, outputs and decisions are applied to every use; purpose limitation under DAT-05 supports the justification.
SAT 4.9	What monitoring and interventions detect and prevent misuse of the system?	MON-02 direct, SEC-01 partial, TEC-02 partial, GOV-03 partial	Live monitoring covers misuse and use outside the approved purpose, with named responders; guardrails and security monitoring add prevention.
SAT 4.10	What procedures are in place to safely stop or retire the system?	OPM-09 direct, POR-09 direct, MON-09 partial, SEC-05 partial	Documented safe stop and fallback in continuity plans with recovery objectives, plus a planned retirement process.
SAT 4.11	Will people affected by shutdown or replacement be told? What are the wider impacts?	POR-09 direct, OPM-09 partial, GOV-09 partial	Retirement assesses the effect of withdrawal on affected people and services, identifies groups at greater risk and tells users and affected people in advance.
SAT 4.12	How will you monitor environmental impact after deployment and respond if it rises?	RSK-03 partial, MON-01 partial	Environmental footprint is measured against a baseline and the impact assessment is kept current, but live monitoring of footprint against a threshold, with a named response, is not required.
SAT 4.13	What measures responsibly manage or recycle hardware and infrastructure?	POR-09 direct, RSK-09 partial	Retirement covers reuse, recycling or disposal of dedicated hardware and infrastructure; supplier due diligence on wider sustainability practice reaches hardware owned by providers.

References and short descriptions only; see the source publication for its own text. The cross-reference is the author's interpretation and is not endorsed by the publisher. See notices.