AAIA lesson 4: Ethics, laws, standards

Ethical principles tell an auditor what good looks like, laws say what is mandatory, frameworks say how to organise the work, and standards give something that can be assessed against. This lesson covers subtopic 1E, Leading Practices, Ethics, Regulations, and Standards for AI; a supporting task asks the auditor to evaluate AI policies and procedures, including compliance with legal and regulatory requirements. The skill is not reciting instruments; it is choosing the right one as criteria and testing evidence against it.

Principles that become criteria

Most responsible AI statements converge on a similar set, covered on the responsible AI principles page: fairness, reliability and safety, privacy and security, transparency, accountability, and human oversight. Two public sets show the pattern. The OECD AI Principles (adopted in 2019 and updated in 2024) name five values-based principles: inclusive growth, sustainable development and well-being; human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability. The NIST AI Risk Management Framework describes seven characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair, with harmful bias managed. A principle is auditable only when the organisation has turned it into a requirement and a measure.

• Fairness and bias. Bias can enter through unrepresentative data, labels that encode past decisions, proxy variables that stand in for protected characteristics, or the way a model is used. The audit evidence is testing of outcomes across relevant groups, not an assertion that the model “does not use” a sensitive field.
• Transparency. People should know when AI is involved and what it is for. This concerns disclosure to affected people and documentation for oversight bodies.
• Explainability and interpretability. In NIST’s terms, explainability concerns the mechanisms behind how the system operates, and interpretability concerns what an output means in the context of its purpose. Some models are inherently easier to explain than others; the proportionate level depends on the decision’s impact.
• Accountability and oversight. A person answers for the outcome, and a human can intervene where decisions matter.

Transparency and explainability are often mixed up: transparency is about making information about the system and its outputs available to the people who deal with it, explainability about how the system arrives at what it does.

Law, framework, standard

The EU AI Act’s tiers, as described on the European Commission’s pages, run from prohibited practices (unacceptable risk), through high-risk uses such as recruitment or credit scoring, to transparency obligations for things like chatbots, with minimal risk left largely unregulated. For high-risk systems the duties include risk management, quality data, logging, technical documentation, information for deployers, human oversight, and robustness, cybersecurity and accuracy. Providers and deployers carry different duties, and separate rules cover providers of general-purpose AI models, including transparency, copyright and, for models with systemic risk, risk assessment. The Act also has an AI literacy provision for people who operate AI systems. Application dates and details have been amended and are subject to change, so check the current official text; this course gives no legal advice.

On ISO/IEC 42001, three points are safe. It follows the structure shared by other ISO management system standards (leadership, planning, support, operation, performance evaluation, improvement) and so fits beside ISO/IEC 27001 or ISO 9001. It requires an AI system impact assessment and a risk process. It has an annex of reference controls that an organisation selects from according to its risks. Certification is awarded to the management system, in a defined scope, by an accredited certification body; it is not a rating of any single AI product.

Worked example: a recruitment tool

A 1,200-person retailer (a different organisation) uses a vendor tool to rank job applicants. The AI policy is a two-page statement of principles.

The auditor’s reasoning:

1. Classify the use. Recruitment is a sensitive use that many regimes treat as higher risk, so expectations rise: impact assessment, human review of rejections, documentation of data and testing, and records.
2. Pick criteria. If the retailer operates where binding law applies, that law is the compliance criterion. The organisation’s own policy is a second criterion. A framework or standard is useful as a benchmark.
3. Test the policy. It states fairness as a goal but sets no test, no owner and no review cycle. It does not cover vendor tools, though the ranking tool is one.
4. Test operation. No bias testing evidence exists, applicants are not told AI is used, and rejected candidates are never reviewed by a person.

The finding is that the policy expresses intent without mechanism, and operation falls short of both policy and the expectations for a high-risk use. A recommendation would assign an owner, define outcome tests by group, extend the policy to purchased tools, and require human review of adverse outcomes.

Easy to confuse

• Certified versus compliant. A management system certificate shows the system meets a standard’s requirements within its stated scope; it does not prove every AI system is lawful or fair.
• Explainable versus interpretable. Explainable is how the system works; interpretable is what a particular output means.
• Fair versus accurate. A model can be accurate overall and still produce unequal outcomes for a group.

Key points

• Principles are auditable only when converted to requirements and measures.
• Bias testing means comparing outcomes across groups; claiming a sensitive field is excluded is weak evidence.
• Law is mandatory, a framework guides, and a standard can be certified.
• Higher-risk uses such as employment and credit call for impact assessment, oversight and records.
• Policy review checks coverage (including vendor tools), ownership and evidence of operation.

Check yourself

This lesson completes Domain 1; the exam-focused summary is on the governance and risk recap.