Ethical AI becomes practical when a business can answer operating questions about a real system. What is it for? Who owns it? Which data does it use? Who is affected? Where can it fail, and who can disable it? Broad promises about trustworthy innovation are not a substitute for those records.
Create a system record before launch
Record purpose, owner, intended users, affected people, approved data, model and version, connected tools, decision limits and human review points. Include what the system must not do. A support drafter may suggest an answer from approved policies but may not change an account or promise an exception.
Keep the record connected to deployment configuration. When a model, vendor, data source or permission changes, the owner should review whether evaluation and notices still apply.
Review with people affected
Technical accuracy tests miss practical harms. Ask staff and representative users whether they can question, correct or appeal an output. Review accessibility, language quality and whether people understand when they interact with automation.
Evaluation cases should reflect consequential and difficult situations, not only averages. Measure factual quality and examine unequal treatment across meaningful cases. One aggregate score cannot establish fairness.
Prepare for incidents and change
Define incidents, alert owners and containment. The plan should include disabling the system or tool, handing queued work to people, preserving relevant records, notifying appropriate parties and correcting downstream data. Test disable and handoff before launch.
Set purpose-based retention for prompts, outputs, approvals and logs. Minimise sensitive data and restrict access. Vendor updates, model replacements and new external calls require change review.
Use frameworks as organising aids
NIST describes its AI Risk Management Framework as voluntary. Its govern, map, measure and manage functions structure ownership, context, evaluation and response. Using it is not certification and does not establish legal compliance. Obtain context-specific legal and domain advice where required.
For implementation controls on tools, retries and approvals, see eight tips for responsible AI agents.