Home / Insights / AI and Machine Learning
AI and Machine Learning
Responsible AI in Practice: Turning Principles into Product Decisions
Most companies agree on responsible AI principles; few know how to apply them in a sprint. This guide maps principles to concrete practices — risk tiers, evaluation, documentation, oversight — and explains the frameworks and regulations that now shape them, including generative AI and agents.
TopicsAI and Machine LearningGenerative AI and LLMsAI Agents and Automation
Key takeaways
- Responsible AI means building AI systems that are fair, transparent, safe, secure, privacy-preserving and accountable — and being able to show it.
- Principles become practice through risk tiers: low-risk features need light checks; high-impact decisions need evaluation, documentation, human oversight and monitoring.
- The NIST AI Risk Management Framework (2023) and its Generative AI Profile (2024), and ISO/IEC 42001 for AI management systems, provide practical structures.
- The EU AI Act already bans certain practices and regulates general-purpose AI models; in 2026 EU institutions agreed to postpone most high-risk obligations to December 2027 and August 2028.
- Generative AI and agents add new risks — hallucination, prompt injection, excessive agency — that need specific controls.
On this page
Almost every organisation building AI now has a set of principles: fairness, transparency, privacy, accountability. The harder question is what those words mean for a team shipping a feature next sprint. Without practical guidance, principles either become box-ticking or are ignored under delivery pressure.
This guide connects principles to decisions product and engineering teams actually make.
Principles and what they mean in practice
| Principle | Practical meaning | Example practices |
|---|---|---|
| — | — | — |
| Fairness | Outcomes do not unjustifiably disadvantage groups | Test performance across segments; review training data coverage |
| Transparency | Users and operators understand when and how AI is used | Disclose AI use; explain key factors; document models and data |
| Safety and reliability | The system behaves as intended under real conditions | Evaluation sets, adversarial testing, monitoring, fallbacks |
| Security | The system resists misuse and attack | Prompt-injection defences, access controls, red teaming |
| Privacy | Personal data is minimised and protected | Data minimisation, consent, retention rules, de-identification |
| Accountability | Named people own decisions and outcomes | Ownership, approvals, audit trails, incident processes |
| Human oversight | People can intervene, override or stop the system | Review queues, escalation, kill switches |
Each principle should map to checks in your delivery process.
Start with risk tiers
Not every AI feature needs the same scrutiny. A writing suggestion in an internal tool is different from a model that influences credit, hiring or medical decisions.
| Tier | Examples | Required practices |
|---|---|---|
| — | — | — |
| Low | Internal summarisation, search suggestions, drafting with human editing | Basic evaluation, usage policy, logging |
| Medium | Customer-facing assistants, recommendations, content moderation support | Evaluation across segments, transparency notices, monitoring, escalation paths |
| High | Decisions affecting access to credit, employment, healthcare, essential services or legal rights | Formal impact assessment, bias testing, documentation, human review of decisions, independent validation, regulatory review |
Classify each AI feature at design time and revisit when its use changes.
Frameworks that help
- NIST AI Risk Management Framework. Released in January 2023, with a Generative AI Profile added in July 2024, it organises work into four functions — Govern, Map, Measure and Manage — and is widely used as a practical structure.
- ISO/IEC 42001. An international standard for AI management systems, useful for organisations that want a certifiable governance process alongside ISO 27001.
- OWASP Top 10 for LLM Applications. A security-focused checklist for generative AI features, covering prompt injection, sensitive information disclosure and excessive agency.
The regulatory picture
- EU AI Act. In force since August 2024. Prohibited practices and AI-literacy duties have applied since 2 February 2025, and obligations for general-purpose AI models since 2 August 2025. In May 2026, EU institutions reached a provisional agreement to postpone most high-risk obligations — to 2 December 2027 for stand-alone high-risk systems and 2 August 2028 for AI in regulated products — while keeping transparency obligations on schedule from August 2026. Check the final published text for the dates that apply to you.
- Sector rules. Financial services, healthcare, employment and consumer protection rules apply to AI decisions as to any other decisions. In US banking, model risk guidance (SR 26-2 since April 2026) applies to AI models.
- Privacy laws such as the GDPR govern personal data used for training and inference.
Practices across the lifecycle
- Design: define purpose, users and affected people; classify risk; identify data sources and legal basis.
- Data: check provenance, consent and representativeness; document datasets.
- Build: choose models with appropriate licences and documentation; design human oversight and fallbacks.
- Evaluate: test accuracy, robustness and fairness across segments; red-team generative features.
- Release: publish transparency information; train operators; set monitoring thresholds.
- Operate: monitor performance, drift and incidents; review samples; retrain or roll back when needed.
- Retire: decommission models and data responsibly.
Generative AI and agents: specific risks
| Risk | Control |
|---|---|
| — | — |
| Hallucination | Grounding with retrieval, citations, output checks, human review for consequential content |
| Prompt injection | Separate instructions from untrusted content; restrict tools; validate outputs |
| Excessive agency | Least-privilege tools, approval for irreversible actions, budgets and kill switches |
| Sensitive data leakage | Retrieval-time access control, redaction, provider data terms |
| Harmful or biased content | Content policies, filters and evaluation across groups |
| Intellectual property | Licensed models and data; review of generated output for reuse |
Our guide to what AI agents are covers agent controls in more depth.
Governance that fits delivery
- A short AI use register: each feature, its purpose, risk tier, owner and status.
- Lightweight reviews for low and medium tiers, built into design reviews and definition of done.
- A cross-functional review group — product, engineering, legal, security, domain experts — for high-tier features.
- Templates: model and system cards, impact assessments and evaluation reports, kept short and reusable.
- Incident handling: a way for users and staff to report AI problems, and a process to investigate and respond.
Measuring responsible AI
- Share of AI features with an assigned risk tier and owner.
- Evaluation coverage, including segment-level results.
- Time to detect and resolve AI incidents.
- Human override and escalation rates.
- User complaints related to AI decisions.
Frequently asked questions
Do small companies need AI governance?
Yes, proportionate to risk. A use register, risk tiers and basic evaluation take little effort and prevent costly mistakes.
Is responsible AI only about bias?
No. Bias is one dimension. Safety, security, privacy, transparency and accountability matter as much, especially for generative AI.
Does the EU AI Act apply to companies outside the EU?
It can apply when AI systems are placed on the EU market or their outputs are used in the EU. Take legal advice for your situation.
Should we pursue ISO/IEC 42001 certification?
Consider it if customers or regulators expect formal assurance, or if you already run certified management systems. Many organisations adopt its practices before seeking certification.
Sources and methodology
Facts in this article were checked against the sources below on 6 November 2026. Directory data (ratings, review counts, rate bands and team sizes) changes over time and is shown as published on the date accessed. Illustrative examples are labelled as such and are not quotes.
- NIST: AI Risk Management Framework — accessed 6 November 2026. AI RMF 1.0 released 26 January 2023; Generative AI Profile (NIST AI 600-1) released 26 July 2024
- Gibson Dunn: EU AI Act Omnibus Agreement — Postponed High-Risk Deadlines — accessed 6 November 2026. Provisional agreement 6 May 2026; Annex III to 2 December 2027; Annex I to 2 August 2028; earlier application dates
- Federal Reserve: SR 26-2, Revised Guidance on Model Risk Management (17 April 2026) — accessed 6 November 2026. Supersedes SR 11-7
- OWASP: Top 10 for LLM Applications 2025 — accessed 6 November 2026. Generative AI security risks
Related reading
Continue your research
Need AI governance that does not slow delivery?
Tell us about your AI features and obligations. We will help you set up risk tiers, evaluation and documentation that fit how your team builds.