AI Governance & Responsible AI

The policies, processes, roles and controls an organisation uses to ensure its AI systems are safe, fair, legal, secure and aligned with its values throughout their life cycle.

It bans unacceptable-risk practices, imposes strict requirements on high-risk systems (risk management, data governance, documentation, human oversight), adds transparency duties for some systems such as chatbots and deepfakes, and has specific rules for general-purpose AI models.

Govern (culture, policies, accountability), Map (context and risks), Measure (assess and track risks) and Manage (prioritise and act on risks).

Define relevant groups and harms, compare metrics like selection rate, false-positive and false-negative rates across groups, investigate data causes, and test mitigations while monitoring trade-offs.

Adversarial testing of AI systems to find harmful behaviours — jailbreaks, unsafe advice, data leakage, prompt injection — before attackers or users do.

A short document describing a model's purpose, training data, performance across conditions and groups, limitations and ethical considerations.

Inventory them, assess vendor risk (data use, security, compliance), set contract terms, restrict sensitive data, and monitor usage and incidents.

Designing processes where qualified people can understand, monitor, override or stop AI decisions — with enough time, information and authority to do so meaningfully.

Contain the harm, investigate root cause, notify affected parties and regulators where required, fix and test, then update policies and controls.

Firms serving EU and US clients must meet their AI and privacy rules; local regulation and data-protection frameworks are evolving; and trustworthy AI is a competitive advantage.