What responsible AI means for your business

Almost every week brings a new AI story. An agent escapes its test, a support bot gets fooled, a summary makes something up. Each one comes back to the same question: how do you innovate with AI without harming the people it touches?

What responsible AI is

Responsible AI means designing, building and using AI so it doesn't harm the people and organisations it touches, and treats them fairly.

In Europe this goes back to 2019, when an expert group set up by the European Commission described trustworthy AI as lawful, ethical and robust, and listed seven principles to get there. The EU AI Act refers to all seven principles, which frame how AI is designed and used.

Let's take a close look at each principle, with an example from this year.

In July, OpenAI was testing its AI agents on a cybersecurity benchmark. The agents broke out of their test environment, reached the internet and broke into Hugging Face's systems, looking for the answers. OpenAI and Hugging Face each spotted the activity separately, and only when they compared notes did OpenAI realise its own agents were behind it. A case for human agency and oversight: people decide, and someone can step in or stop the system.

In May, Meta's AI support assistant came under attack. Attackers tricked it, and some Instagram accounts were taken over, the Obama-era White House account and Sephora's among them. Meta says the problem is fixed. A case for technical robustness and safety: the system holds up when someone tries to misuse it.

In July, Italy's data protection authority fined Character.AI €158,000. Its privacy notices fell short, and its age checks didn't protect children well enough. A case for privacy and data governance: you protect people's data, and you're allowed to use it.

In September, a stand-up comedian called Tiffany Sloane started posting on Instagram and reached about 375,000 followers in a few weeks. In October, the comedian George Brett Olson showed side by side that she had copied his jokes, his set and even the colour of his shirt. Tiffany was AI-generated, and nothing in her bio said so. A case for transparency: people know when they're dealing with AI.

That one is worth stopping on. Instagram's head, Adam Mosseri, says AI content is getting harder to tell apart. If he finds it hard, your customers need you to tell them.

In the US, job seekers are suing Workday, alleging its screening tools rejected Black, female, older and disabled applicants. In June a judge let the case go ahead. Nothing has been proven yet. A case for diversity, non-discrimination and fairness: the system doesn't shut people out.

On 2 November, Turkey's Competition Authority announced an investigation into Google's AI Overviews and AI Mode. It is looking at whether they cut traffic to news publishers, whether Google's content contracts are fair, and whether they shut out publishers and rival AI assistants. Until it decides, Google has to let publishers refuse the use of their content in these features without losing visibility elsewhere on Google, on terms that reflect what the content is worth and treat every publisher the same. A case for societal and environmental well-being: you weigh what AI does to society, beyond your customers.

And the last one, which ties the other six together.

In May, a court in Munich ruled against Google in a preliminary injunction. Its AI Overviews had linked two publishers to scams and subscription traps, and both claims were false. Google argued people know not to trust AI blindly. The court said the summaries were Google's own content, so Google answers for them. A case for accountability: someone answers for the outcome. What your AI says and does in front of customers is yours.

Your Responsible AI Review

So how do you check all seven in your company? Here's how I'd do it.

1. Write your principles. What do you use AI for, and where do you never use it? Put it on one page everyone can read, built from your own values. A page copied from a public framework won't hold up in a hard decision.
2. List every AI system. Include what you build, what you buy and what your staff opened on their own. Note whether you built each one or only use it, because your legal duties depend on that.
3. Sort them by risk. First check nothing falls into the uses the AI Act bans. Then mark the high-risk ones, such as hiring, credit and insurance decisions, and the ones covered by transparency rules, such as chatbots and AI-made content.
4. Test the riskiest systems against the seven principles. Who could be harmed, is the data allowed and good enough, are the results fair across groups, and who is watching?
5. Name the owner and the process. Who approves a new tool, who can stop it, and where does someone report a problem? Put AI risks on the company risk register, and train people for the tools they use. You won't be the only one still working on this. In a Morgan Stanley survey fielded in April, just under half of 200 executives said responsibility for AI governance was fully assigned in their company.
6. Keep the evidence and keep watching. Save approval records and test results to show a customer or regulator who asks. Models change, so put a review date in the diary.

You don't need all six done to start. Pick the system that worries you most and take it through the steps this quarter.

If you'd like to talk it through, bring the problem you're stuck on to a free 30-minute call: meltemgunyuzlu.com/call

The next two years

Turkey's competition authority and the Munich court won't be the last to decide that a company owns what its AI does. Over the next two years, the companies that keep their customers' trust will be those that can show, system by system, who checked it and who answers for it.

Share this with the leader who assumes the vendor answers for the AI.

← All insights