Trustworthy AI needs more than security: it must protect privacy, fail safely, be understandable to the people it affects and stand up to ethical review. This section covers privacy techniques, trust trade-offs, safety and oversight, user transparency, ethics audits and ongoing trust monitoring.
Privacy by design means deciding how to protect people's data while the AI system is still on the drawing board, not after a complaint. You collect less, check the risk up front with an impact assessment and add privacy-enhancing technologies where risk stays high. AI raises the stakes because models can infer things about people that were never collected.
diagram
Privacy is designed in before processing starts: set the purpose, collect less, assess the risk, then add privacy-enhancing technologies where high risk remains.
Key points
General Data Protection Regulation (GDPR) Article 25 requires data protection by design and by default, such as pseudonymisation and processing only the data each purpose needs.
GDPR Article 5(1)(c), data minimisation, requires personal data to be adequate, relevant and limited to what is necessary for the purpose.
GDPR Article 35 requires a data protection impact assessment (DPIA) before processing that is likely to result in high risk, especially when new technologies are used.
The NIST AI Risk Management Framework (AI RMF) names privacy-enhancing technologies (PETs), de-identification and aggregation of outputs as ways to build privacy-enhanced AI.
AI creates inference risk: models can identify individuals or reveal private information that was never directly collected (NIST AI RMF).
European Data Protection Board (EDPB) Opinion 28/2024 says a model trained on personal data cannot be presumed anonymous; anonymity is assessed case by case.
GDPR changes proposed in the Digital Omnibus are still being negotiated; the Council's October 2026 mandate kept the current definition of personal data.
Exam tip
If a scenario plans a new AI use of personal data that is likely high risk, the expected first step is a DPIA, completed before processing starts.
Differential privacy adds carefully measured noise so results stay useful but no single person's data can be picked out, like blurring a crowd photo just enough that faces vanish while the crowd size stays clear. Federated learning keeps raw data where it lives and sends only model updates to be combined. Neither is complete alone, so strong systems use them together.
Differential privacy
Adds calibrated noise
Epsilon sets privacy loss
Output privacy for the model
Both
Privacy-enhancing technologies
Combined in privacy-preserving FL
Federated learning
Raw data stays local
Shares model updates
Aggregator combines updates
Differential privacy protects what a result or model reveals, while federated learning limits where raw data travels. Privacy-preserving federated learning combines them.
Key points
NIST SP 800-226 (March 2025) describes differential privacy as a mathematical framework that quantifies privacy loss to individuals whose data appears in a dataset.
The privacy loss parameter epsilon sets the strength: a smaller epsilon means stronger privacy but lower accuracy.
Unlike de-identification, differentially private releases resist all privacy attacks, including future ones, and the protection composes across multiple releases.
SP 800-226 uses a differential privacy pyramid: epsilon and the unit of privacy at the top, algorithms in the middle, and access control, trust models and data collection at the base.
Federated learning trains across multiple local datasets and shares model updates instead of raw data, with an aggregator combining the results.
Federated learning alone is not a complete privacy solution, because attacks on model updates can reveal training data (NIST and UK privacy-preserving federated learning series).
Secure aggregation or homomorphic encryption gives input privacy for the updates, while differential privacy gives output privacy for the trained model.
Exam tip
Know the trade-off: a smaller epsilon is more private and less accurate. If an option claims federated learning alone guarantees privacy, it is a distractor.
Pseudonymization swaps names for codes but keeps the key in a locked drawer, so someone with the key can still re-identify people. Anonymization removes the link for good, so no one can reasonably work out who the data is about. That difference decides whether data protection law applies at all.
Pseudonymised
Anonymised
Can it be re-linked?
Yes, with the separately kept key
Not by means reasonably likely to be used
GDPR status
Personal data
Still personal data for the key holder
May not be for a recipient without means, per SRB
Outside the GDPR
Must pass isolation, linkage and inference tests
Pseudonymised data can be re-linked by whoever holds the key, so it stays personal data for that party. Anonymous data must pass the EDPB's three tests.
Key points
General Data Protection Regulation (GDPR) Article 4(5) defines pseudonymisation: data can no longer be attributed to a person without additional information kept separately under safeguards.
Pseudonymised data that could be attributed using additional information is still information on an identifiable person (GDPR Recital 26), so pseudonymisation is a safeguard, not an exit.
Anonymous information, which no longer relates to an identifiable person by means reasonably likely to be used, falls outside the GDPR.
In EDPS v SRB (C-413/23 P, 4 September 2025), the Court of Justice of the EU held that pseudonymised data is not personal data in all cases and for every person.
The same judgment said that, for the controller's duty to inform, identifiability is assessed at collection and from the controller's point of view.
European Data Protection Board (EDPB) draft Guidelines 02/2026 on anonymisation (July 2026) test three criteria: no record isolation, no linkage and no inference.
ISO/IEC 20889:2018 classifies de-identification techniques and their applicability for reducing re-identification risk.
Exam tip
If the organization keeps a re-identification key, the data is pseudonymised and still personal data for it. Only data that passes the isolation, linkage and inference tests counts as anonymous.
Trustworthy AI is a balancing act, not a checklist you tick once. Making a model easier to explain can expose private data, and adding privacy noise can cost accuracy, so someone has to decide which matters more in each context and write down why. NIST's seven characteristics (see 2.2) are the vocabulary for those decisions.
diagram
NIST expects people, not formulas, to choose metrics, recognize trade-offs and record a justified decision for each context of use.
Key points
The NIST AI Risk Management Framework (AI RMF) says trustworthiness is only as strong as its weakest characteristic, and addressing characteristics one at a time will not ensure it.
Typical trade-offs are interpretability versus privacy, predictive accuracy versus interpretability, and privacy-enhancing techniques versus accuracy when data is sparse.
Trade-off analysis can show that a tension exists but does not settle it; the choice should be made transparently and justifiably in the context of use.
A transparent system is not necessarily accurate, privacy-enhanced, secure or fair, but an opaque system makes those properties hard to verify over time.
Resilience is returning to normal function after an adverse event; security includes resilience plus protocols to avoid, protect against, respond to and recover from attacks.
The AI RMF says human judgment should set the specific trustworthiness metrics and threshold values for each system.
ADG (Adopt, Defend, Govern) frames trustworthy enterprise AI through its RE3 Trust Model: Responsible, Ethical, Efficient and Explainable AI.
Exam tip
When two trustworthiness goals conflict, the governance answer documents the trade-off and the rationale for the chosen balance. Maximizing one characteristic and ignoring the rest is the distractor.
Safety controls make sure an AI system fails gently and that a person can step in. The more an AI can do on its own, the stronger those controls must be, like a learner driver whose instructor has a second brake pedal. The EU AI Act even expects a stop button for high-risk systems.
diagram
When behavior leaves its safe operating limits, a circuit breaker halts actions and a person decides what happens next, as Article 14 and ADG agentic hardening expect.
Key points
The NIST AI Risk Management Framework (AI RMF) says safe AI should not, under defined conditions, endanger human life, health, property or the environment.
Practical safety measures include rigorous simulation and in-domain testing, real-time monitoring, and the ability to shut down, modify or let humans intervene (NIST AI RMF).
AI RMF MEASURE 2.6 requires showing the system is safe, its residual risk is within tolerance and it can fail safely, especially when pushed beyond its knowledge limits.
EU AI Act Article 14(4) lets overseers disregard, override or reverse outputs and interrupt the system with a stop button or similar procedure that halts it in a safe state.
Article 14 also requires overseers to stay aware of automation bias, the tendency to over-rely on outputs, especially when the system recommends decisions.
ADG (Adopt, Defend, Govern) agentic hardening adds delegated authority bounds, dry-run modes for irreversible actions, and human override and emergency stop pathways.
NIST AI 600-1 lists human-AI configuration as a generative AI risk, covering anthropomorphizing, automation bias, over-reliance and emotional entanglement.
Exam tip
Higher autonomy means more controls, not fewer. An option that removes human review from a high-impact system to save cost is the distractor.
People have a right to know when they are dealing with AI. In the EU, chatbots must say they are bots, AI-generated media must carry a machine-readable mark, and deepfakes must be labeled. For high-risk systems, the provider must also give deployers clear instructions about what the system can and cannot do.
Providers must
Deployers must
People interacting or exposed
Tell people they are dealing with an AI system
Inform people exposed to emotion recognition or biometric categorisation
AI-generated content
Mark synthetic content in a machine-readable way
Label deepfakes and unreviewed public-interest text
Article 50 has four cases: two duties for providers, who build disclosure and marking in, and two for deployers, who label and inform at the point of use.
Key points
EU AI Act Article 50 transparency obligations have applied since 2 August 2026, in four cases split between providers and deployers.
Providers must design systems that interact with people so those people know they are dealing with AI, unless that is obvious to a reasonably well-informed person.
Providers of generative AI must mark synthetic audio, image, video and text in a machine-readable format that is detectable as AI-generated (Article 50(2)).
Under the Digital Omnibus on AI, generative systems placed on the market before 2 August 2026 have until 2 December 2026 to apply the Article 50(2) marking.
Deployers must disclose deepfakes, AI-generated text on matters of public interest that had no human editorial review, and use of emotion recognition or biometric categorisation.
Breaching the transparency rules can bring fines up to EUR 15 million or 3% of total worldwide annual turnover, applied proportionately to smaller companies.
For high-risk systems, Article 13 requires instructions for use covering intended purpose, accuracy, known limitations and human oversight measures.
Exam tip
Providers build disclosure and marking into the system; deployers label deepfakes and tell people about emotion recognition. Questions often hinge on which role carries the duty.
An explanation tells a person why the AI reached its answer, in terms they can understand. Some models are simple enough to read directly, like a decision tree; others need an outside tool that probes them to see which inputs mattered. A good explanation also admits when the system is outside what it was built for.
Self-interpretable model
Post-hoc explanation
How it explains
Model is the explanation
Readable globally and per decision
Separate tool queries the model
Needs no inner knowledge of it
Examples
Decision trees
Regression models
LIME for one decision
SHAP feature importance
NIST IR 8312 sorts explanations into two families: models that explain themselves, and outside tools that probe a model to explain it.
Key points
The NIST AI Risk Management Framework (AI RMF) separates three ideas: transparency answers what happened, explainability answers how a decision was made, and interpretability answers why.
NIST IR 8312 sets four principles of explainable AI: explanation, meaningful, explanation accuracy and knowledge limits.
Knowledge limits means a system operates only under the conditions it was designed for and when it reaches sufficient confidence in its output.
Self-interpretable models, such as decision trees and regression models, are their own explanation; post-hoc methods explain a model from outside by querying it.
LIME (Local Interpretable Model-Agnostic Explainer) explains one decision by probing nearby inputs, and SHAP (SHapley Additive exPlanations) gives per-feature importance for an input.
EU AI Act Article 86 gives people affected by certain Annex III high-risk decisions the right to clear and meaningful explanations from the deployer.
Explanations should fit the audience, because developers, policy makers and end users need different content and style (NIST IR 8312).
Exam tip
An explanation that sounds convincing but does not reflect how the model actually decided fails the explanation accuracy principle.
An ethics review asks whether an AI system should be built or used at all, and on what terms, before it reaches people. Impact assessments look at who could be harmed, fairness evaluations look for unequal outcomes, and independent audits check the evidence. The AI Governance Council makes the final call and records any exceptions.
diagram
The product team brings the use case and impact assessment, a bias auditor supplies fairness evidence, the Council decides, and internal audit checks the trail.
Key points
ISO/IEC 42005:2025 guides AI system impact assessments on individuals, groups and society, performed throughout the lifecycle and updated as needed.
ISO/IEC 42001 requires AI system impact assessment (clauses 6.1.4 and 8.4), an internal audit programme (9.2) and management review (9.3).
ADG (Adopt, Defend, Govern) Minimum Control 11 (MC-11) requires fairness evaluation with representative test data and established metrics, repeated after model or data changes.
ADG Minimum Control 10 (MC-10) requires governance reviews with exception handling and board reporting; exceptions go in a register with justification and expiry.
ADG places an AI ethics and sociotechnical oversight lead in GOVERN, and a responsible AI scientist and bias or fairness auditor in DEFEND.
Certain deployers of high-risk AI, such as public bodies, must also complete a fundamental rights impact assessment (FRIA) under EU AI Act Article 27 (see 2.3).
UNESCO's Recommendation on the Ethics of AI, adopted by 193 Member States in November 2021, says AI should be auditable and traceable, with impact assessment and audit.
Exam tip
Independence matters: the team that built a system should not be its only reviewer. Look for answers that route findings to the AI Governance Council with documented decisions.
Trust is not certified once; it has to be earned every day the system runs. Trust monitoring tracks fairness, user complaints, exceptions and incidents over time and turns them into numbers leaders can act on. Outside certification adds independent evidence that the management system behind the AI actually works.
diagram
Trust metrics run in a loop: collect signals, compare them with thresholds, act on breaches and keep watching.
Key points
ADG (Adopt, Defend, Govern) Tier 3 board indicators include an AI risk posture score, exception backlog trend, AI incident trend, vendor AI risk exposure and a responsible AI compliance rate.
ADG Tier 2 outcome metrics include quarter-over-quarter fairness metric trends and AI-related compliance findings from internal and external audits.
ADG Minimum Control 11 (MC-11) requires fairness re-evaluation after model or data changes, so fairness drift is caught rather than assumed away.
Systems that keep learning after release must address feedback loops so biased outputs do not shape future inputs (EU AI Act Article 15(4)).
NIST AI Risk Management Framework (AI RMF) MANAGE 4.1 monitoring plans include capturing input from users, plus appeal and override mechanisms.
NIST AI 600-1 names content provenance as one of four primary considerations for generative AI, alongside governance, pre-deployment testing and incident disclosure.
ISO/IEC 42006:2025 sets requirements for bodies that certify ISO/IEC 42001 management systems, making third-party certification a consistent external trust signal.
Exam tip
A one-time fairness test at launch is not enough. The best answer sets thresholds, tracks trends and ties each breach to a defined review, retraining or rollback.