Responsible AI turns values such as fairness, transparency, privacy and accountability into concrete checks at every stage of an AI system's life. International guidelines and the US Department of Defense principles give the shared vocabulary, and eight lifecycle stages show where each check belongs.
AI ethics asks whether a system should do something, not only whether it can or whether the law allows it. The recurring themes are fairness, transparency, privacy, safety, accountability and human oversight. Like a building that must meet code and also be safe and accessible to everyone who uses it, trustworthy AI has to be lawful, ethical and technically sound at the same time.
Ethical, should we
Values beyond compliance
Dignity and autonomy
Weighing tradeoffs in context
Trustworthy AI needs both
Non-discrimination
Privacy
Transparency to users
Human oversight
Lawful, must we
Binding rules with penalties
EU AI Act and data protection law
Varies by jurisdiction
The AI HLEG view: trustworthy AI is lawful, ethical and robust. Ethics overlaps the law on themes like non-discrimination and privacy but reaches further than any single statute.
Key points
The EU High-Level Expert Group on AI (AI HLEG) says trustworthy AI must be lawful, ethical and robust, so meeting the law alone is not enough.
NIST lists seven trustworthy characteristics: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; fair with harmful bias managed.
In the NIST AI Risk Management Framework (AI RMF), valid and reliable is the necessary base for the other characteristics, and accountable and transparent relates to all of them.
NIST: transparency answers what happened in the system, explainability answers how a decision was made, and interpretability answers why and what it means to the user.
Characteristics trade off, such as predictive accuracy versus interpretability, or privacy techniques versus accuracy with sparse data; NIST says resolve tradeoffs transparently and justifiably in context.
The Adopt, Defend, Govern (ADG) principles: fairness and non-discrimination, transparency and explainability, privacy, accountability, human oversight, robustness and safety, sustainability and well-being.
Highly secure but unfair, accurate but opaque, or transparent but inaccurate systems are all undesirable; NIST says trustworthiness is only as strong as its weakest characteristic.
Exam tip
When an answer says a system is ethical because it is legal, reject it; the AI HLEG trio is lawful, ethical and robust. For NIST questions, valid and reliable is the base and accountable and transparent spans everything.
AI can fail in ways ordinary software rarely does. It can absorb bias from data or from the people building it, give confident answers that are simply wrong, hide its reasoning, and be misused to fake voices or faces. Because AI runs at machine speed and scale, one flawed pattern can repeat thousands of times before anyone notices.
diagram
Five families of ethical challenge. Bias follows the three NIST categories, and harm at scale reflects how AI can repeat one flaw many times or interact with other AI.
Key points
NIST Special Publication (SP) 1270, March 2022, names three categories of AI bias: systemic, computational and statistical, and human-cognitive; each can occur without prejudice or intent.
AI can increase the speed and scale of bias and amplify harm, and balanced predictions can still be unfair, for example if people with disabilities cannot use the system (NIST).
Opacity is an AI-specific risk: limited explainability and reproducibility make it hard to judge whether a system is accurate, fair or secure, and harder for affected people to seek redress.
NIST AI 600-1, the Generative AI Profile, calls confidently stated but false output confabulation, its formal term for hallucination, and lists it among 12 generative AI risks.
Automation bias is excessive deference to automated output; EU AI Act Article 14(4)(b) requires people overseeing high-risk AI to stay aware of it.
Deepfakes are a misuse risk: under EU AI Act Article 50(4), deployers must disclose AI-generated or manipulated deep fake content, and Article 50 applies from 2 August 2026.
The Adopt, Defend, Govern (ADG) harm classes are Technical (security), Societal (bias and rights), Operational (reliability and accuracy) and Systemic (emergent AI-to-AI risk such as agent collusion).
Exam tip
Bias questions often hide the answer in the category: unrepresentative samples are computational and statistical, organizational norms and practices are systemic, and over-trusting the output is human-cognitive. Fixing the data alone does not fix systemic bias.
Several international bodies have written down what ethical AI should look like, and most say similar things in different voices. The OECD and UNESCO set the broad values, the EU's expert group turned them into a checklist, the G7 wrote a code for developers of the most advanced models, and the Council of Europe drafted the first binding treaty. Think of them as layers: shared values on top, practical tools and law underneath.
diagram
Five international instruments, from non-binding principles to the first binding treaty. OECD is the first intergovernmental standard, UNESCO the first global ethics standard, and the Council of Europe convention the first legally binding one.
Key points
The Organisation for Economic Co-operation and Development (OECD) AI Principles, adopted May 2019 and updated May 2024, are the first intergovernmental AI standard and have 47 adherents.
OECD values-based principles: inclusive growth, sustainable development and well-being; human rights and democratic values; transparency and explainability; robustness, security and safety; accountability.
The five OECD policy recommendations cover AI research investment, an inclusive AI ecosystem, interoperable governance, human capacity and labour market transition, and international cooperation.
The United Nations Educational, Scientific and Cultural Organization (UNESCO) Recommendation on the Ethics of AI, adopted by 193 Member States in November 2021, is the first global AI ethics standard.
UNESCO's Recommendation has 4 core values, 10 principles and 11 policy areas, plus two tools: a Readiness Assessment Methodology for countries and an Ethical Impact Assessment for individual AI systems.
The EU High-Level Expert Group on AI (AI HLEG) Ethics Guidelines of 8 April 2019 set 7 key requirements, later turned into the Assessment List for Trustworthy AI (ALTAI) in July 2020.
The Group of Seven (G7) Hiroshima Code of Conduct (October 2023) is voluntary; the Council of Europe Framework Convention on AI is the first binding AI treaty, open since 5 September 2024, not yet in force.
Exam tip
Match each instrument to its nature: OECD and UNESCO are non-binding recommendations, the Hiroshima code is voluntary, and only the Council of Europe convention is a binding treaty. First intergovernmental standard means OECD; first global standard on AI ethics means UNESCO.
The US Department of Defense adopted five ethical principles for AI in February 2020, covering combat and everyday business uses alike. In short: people stay responsible, bias is minimized, the system can be traced and audited, it is tested for clearly defined uses, and it can be switched off if it misbehaves. The five names, Responsible, Equitable, Traceable, Reliable and Governable, are what exam questions paraphrase.
diagram
The five DoD AI ethical principles adopted in February 2020, each with the phrase an exam question is likely to paraphrase. They apply to combat and non-combat AI alike.
Key points
The Department of Defense (DoD) adopted five AI ethical principles in February 2020, after Defense Innovation Board recommendations in October 2019, for both combat and non-combat functions.
Responsible: personnel exercise appropriate judgment and care and remain responsible for AI development, deployment and use. Equitable: deliberate steps minimize unintended bias.
Traceable: relevant personnel understand the technology, with transparent and auditable methodologies, data sources, design procedures and documentation.
Reliable: AI has explicit, well-defined uses, and its safety, security and effectiveness are tested and assured within those uses across the entire life cycle.
Governable: AI can detect and avoid unintended consequences, and deployed systems that show unintended behavior can be disengaged or deactivated.
A 2021 DoD memo set six responsible AI (RAI) tenets: RAI governance, warfighter trust, AI product and acquisition lifecycle, requirements validation, RAI ecosystem and AI workforce.
The department has also used the name Department of War since September 2025, and its January 2026 AI strategy memo reframed responsible AI around objectively truthful models and any lawful use.
Exam tip
Expect a scenario-to-principle match: a kill switch or deactivation is Governable, an audit trail with documented data sources is Traceable, testing within defined uses is Reliable, and bias reduction is Equitable. The five 2020 principles are what the blueprint names.
Responsible AI is ethics put to work: named people, written rules and real checks at every step, so an AI system can be trusted and its decisions defended. It is not a separate review bolted on at the end, in the same way that safety on a building site is part of every shift rather than a final inspection. The C|RAGE blueprint walks it through eight stages, from defining the problem to retiring the system.
diagram
The eight responsible AI stages in the C|RAGE blueprint, grouped into four phases. Lessons from retirement loop back to the next problem definition, and documentation is kept current throughout even though the blueprint lists it seventh.
Key points
EC-Council's RE3 Trust Model defines trustworthy enterprise AI as Responsible, Ethical, Efficient and Explainable, and the Adopt, Defend, Govern (ADG) framework exists to operationalize all four.
In RE3, Responsible means every AI action traces back to a human decision-maker, delivered by Minimum Controls MC-1 (AI inventory) and MC-3 (separation of duties) and the AI Governance Council.
ADG's integration rule: responsible AI is embedded in all three pillars, Adopt, Defend and Govern, and is never run as a separate track.
The C|RAGE stages: problem definition, data collection and preparation, design and development, testing and validation, deployment, monitoring and maintenance, documentation, and improvement and retirement.
The NIST AI Risk Management Framework (AI RMF) says risk management should be continuous and performed throughout the lifecycle, ideally starting in Plan and Design.
ISO/IEC 42001:2023, published December 2023, is the first AI management system (AIMS) standard; it is voluntary and certifiable, unlike the legally binding EU AI Act.
ADG Minimum Control 3 (MC-3) separates deployment ownership, security validation and approval authority so that no single function holds all three.
Exam tip
Think like a governance lead: the best answer embeds responsible AI checks in every stage with a named accountable owner, rather than one ethics review before launch. ISO/IEC 42001 certification is voluntary evidence, not legal compliance on its own.
The most ethical decision can be not to build the AI at all, and that choice happens at the start. Problem definition asks what the system is for, who it affects, and whether AI is the right tool; data collection then asks whether the data is lawful, representative and traceable. A recipe is only as good as its ingredients, and a model is only as fair as its data.
diagram
Problem definition ends in a go or no-go decision informed by an impact assessment. Only a go leads to data collection, where lawfulness, representativeness and provenance are checked.
Key points
NIST AI Risk Management Framework (AI RMF) MAP 1.1 documents intended purpose, users, context-specific laws and norms, and potential impacts on people, society and the planet.
NIST AI RMF MANAGE 1.1 decides whether development or deployment should proceed, and MANAGE 2.1 weighs viable non-AI alternatives.
ISO/IEC 42005:2025 guides AI system impact assessments of effects on individuals, groups and society, and recommends repeating them across the lifecycle.
Context should be set by interdisciplinary, demographically diverse people (MAP 1.2) with feedback from people outside the development team on individual and societal impacts (GOVERN 5.1).
EU AI Act Article 10(3): training, validation and testing data for high-risk AI must be relevant, sufficiently representative and, as far as possible, free of errors and complete.
The Digital Omnibus on AI added Article 4a: special category personal data may be processed only when strictly necessary to detect and correct bias, under strict safeguards, then deleted.
NIST's data stage gathers, validates and cleans data and documents its metadata; keeping training data provenance supports transparency, accountability and intellectual property compliance.
Exam tip
If the scenario is still at problem definition, the best answer is an impact assessment and a go or no-go decision, possibly choosing a non-AI option, not model tuning. Representativeness and provenance are the data-stage keywords.
Design is where ethics becomes requirements: privacy, fairness and human oversight are written into the specification before the model is built. Testing then proves those requirements hold under realistic and hostile conditions, like crash-testing a car rather than only checking that the engine starts. The evidence from testing is what a governance body signs off on.
Design and development
Testing and validation
Ethical goal
Privacy and fairness as requirements
Human oversight built in
Tradeoffs justified
Works in deployment-like conditions
Fair across groups
Robust to failure and attack
Evidence produced
Documented requirements
Design rationale
TEVV results and metrics
Signed MC-4 evaluation report
What each build stage aims for and the evidence it leaves behind. Governance approves on the evidence row, not on the goals alone.
Key points
NIST AI Risk Management Framework (AI RMF) MAP 1.6 elicits requirements, such as 'the system shall respect the privacy of its users', and weighs socio-technical implications in design.
Oversight is designed in: NIST MAP 3.5 defines human oversight processes, and EU AI Act Article 14 requires high-risk AI to be designed so people can effectively oversee it while in use.
Design tradeoffs, such as predictive accuracy versus interpretability, should be resolved transparently and justified for the context, with the reasoning documented.
Testing follows test, evaluation, verification and validation (TEVV): MEASURE 2.1 documents test sets, metrics and tools, and MEASURE 2.3 shows performance in deployment-like conditions.
NIST MEASURE 2.9 requires the model to be explained, validated and documented, and its output interpreted in context, to inform responsible use and governance.
NIST MEASURE 2.11 evaluates fairness and bias; Adopt, Defend, Govern (ADG) Minimum Control 11 (MC-11) uses representative test data and established fairness metrics, repeated after model or data changes.
ADG Minimum Control 4 (MC-4) requires quality, safety, security, fairness and failure-mode testing before production, evidenced by a signed report covering all four harm classes.
Exam tip
A test plan that only checks accuracy on familiar data is the trap; the strong answer tests fairness, safety, security and failure modes under deployment-like conditions and keeps the evidence. Design-stage answers mention requirements and oversight, not tuning.
Deployment is a formal handover with conditions, not just pressing publish: someone with authority approves it, users are told they are dealing with AI, and there is a way back if things go wrong. After launch the system is watched like a patient after surgery, for drift, misuse, unfair outcomes and incidents, and every change goes through change control.
diagram
Deployment as a governed handover, then monitoring with an escalation path. Defend escalates unresolved risk to Govern, which decides between rollback, retraining under change control, or a documented exception.
Key points
In the Adopt, Defend, Govern (ADG) Deploy and Authorize stage, Adopt releases with rollback ready, Defend confirms testing and monitoring readiness, and Govern grants approval or a conditional exception.
NIST AI Risk Management Framework (AI RMF) Deploy and Use activities: pilot, check compatibility with legacy systems, verify regulatory compliance, manage organizational change and evaluate user experience.
EU AI Act Article 50, applying from 2 August 2026, requires people to be told when they interact directly with an AI system unless that is obvious.
NIST AI RMF MANAGE 4.1 sets post-deployment monitoring plans covering user input, appeal and override, decommissioning, incident response, recovery and change management.
ADG Minimum Control 8 (MC-8) monitors production for abuse, drift, data leakage, unsafe actions, bias emergence and configuration drift, with alert thresholds and response times.
Configuration drift detection confirms production models, prompts, tools and context sources still match what was approved; new features are re-evaluated against the original risk classification.
For high-risk AI, EU AI Act Article 72 requires a provider post-market monitoring plan and Article 73 requires reporting of serious incidents.
Exam tip
The governance answer at go-live is a documented approval with conditions and a rollback path; at run time it is monitoring tied to thresholds plus change control. A model update that skips change control is a control failure even if it improves accuracy.
If it is not written down, it did not happen: documentation is how an organization proves to users, auditors and regulators what its AI does and why. Continuous improvement turns incidents and monitoring results into fixes, and responsible retirement means switching a system off safely, keeping the records, and carrying the lessons into the next project. Think of a ship's logbook that is kept long after the ship is decommissioned.
diagram
Continuous improvement and retirement are two exits from the same finding. Either way the records are updated, and a retired system leaves its evidence and lessons behind.
Key points
For high-risk AI the EU AI Act requires technical documentation kept up to date (Article 11 and Annex IV), automatic logging (Article 12) and information for deployers (Article 13).
NIST AI Risk Management Framework (AI RMF) MAP 2.2 documents the system's knowledge limits and how people should use and oversee its output; GOVERN 4.2 has teams document and communicate risks and impacts.
The Adopt, Defend, Govern (ADG) Explainable AI property means outputs are traceable, replayable and defensible, delivered through the Telemetry surface of logs, traces, evaluations and replay data.
NIST AI RMF MANAGE 4.2 builds measurable continual improvement into system updates, and ISO/IEC 42001 requires the AI management system to be continually improved.
NIST GOVERN 1.7 requires processes to decommission and phase out AI safely without raising risk, and MANAGE 2.4 assigns who can supersede, disengage or deactivate a misbehaving system.
In the ADG Retire and Learn stage, Adopt decommissions the service, Defend preserves evidence and validates closure, and Govern updates policy and records and feeds lessons back into sourcing.
Since May 2024 the Organisation for Economic Co-operation and Development (OECD) AI Principles say AI at risk of undue harm should be safely overridable, repairable or decommissionable.
Exam tip
Retirement is not deletion: the best answer disengages the system safely, preserves logs and evidence, updates the inventory and feeds the lessons back. Documentation questions point to records, such as technical documentation, model cards and logs, that let a third party reconstruct what happened.
Model card fragment with retirement record · json
{
"model": "contoso-credit-v3",
"intendedUse": "Pre-screen credit applications for human review",
"outOfScopeUse": ["Final credit decisions without human review"],
"trainingDataSheet": "https://example.com/ai/datasheets/train-2026-10",
"fairnessEvaluation": "https://example.com/ai/evals/credit-v3-fairness",
"knownLimitations": ["Lower accuracy for applicants with short credit history"],
"status": "Retired",
"retirement": {"date": "2026-12-31", "replacedBy": "contoso-credit-v4", "logsRetainedUntil": "2033-12-31"}
}
Responsible AI also looks past the single system to its footprint on the planet and on people. Training and running models uses a lot of electricity, AI can leave out people who are missing from the data or the design team, and automation changes jobs. Sustainable, inclusive AI measures those effects and designs for them, the way a good architect plans energy use and wheelchair access from the first sketch.
Environmental
Social
Risk
Data centre use near 950 TWh by 2030
Training and inference footprint
Exclusion of under-represented groups
Inaccessible systems
Job and skills disruption
Responsible practice
Measure and document energy use
Prefer efficient models and hardware
Diverse teams and stakeholder input
Accessibility by design
Support workforce transition
Sustainability and inclusion as two sides of the same responsibility. Each risk has a matching practice drawn from IEA, EU AI Act Article 95, NIST and OECD guidance.
Key points
The International Energy Agency (IEA) reports data centre electricity use grew 17% in 2025 and projects it to roughly double from 485 to 950 terawatt-hours by 2030, about 3% of global demand.
The IEA also finds energy use per AI task has been falling by at least an order of magnitude a year, so efficient models and hardware choices make a real difference.
NIST AI Risk Management Framework (AI RMF) MEASURE 2.12 assesses environmental impact; NIST is revising AI RMF 1.0 under a July 2025 US plan that directs removing climate references.
Under the EU AI Act, general-purpose AI model providers document known or estimated energy consumption (Annex XI), and Article 95 codes of conduct cover energy-efficient AI.
Article 95 codes also promote inclusive and diverse design teams, stakeholder participation, accessibility for persons with disabilities and gender equality; NIST GOVERN 3.1 asks for diverse teams.
United Nations Educational, Scientific and Cultural Organization (UNESCO) core values include ensuring diversity and inclusiveness and supporting the flourishing of environment and ecosystems.
The Organisation for Economic Co-operation and Development (OECD) AI Principles call for responsible business conduct across the lifecycle and preparing workers for labour market transition.
Exam tip
If a question asks which principle covers energy and environmental impact, look for sustainability or societal and environmental well-being, which OECD, UNESCO, the EU expert group and ADG all include. Inclusion answers name diverse teams, stakeholder input and accessibility.