What is responsible AI in practice?

The operational expression of several overlapping frameworks, reduced to nine control themes: validity and robustness, safety and security, fairness, transparency, explainability, privacy, human oversight, accountability and audit trail, and the generative and agentic surfaces. Each theme carries specific controls and maps to the frameworks it satisfies, so an obligation that moves can be re-pointed rather than triggering a new programme.

How do you measure responsible AI maturity?

Score each control theme as it genuinely operates rather than as policy describes it: not started, ad hoc, defined, operating, or measured. The composite maps to five maturity levels from ad hoc to adaptive. Most organisations that believe they are at level three are at level two, because the test is not whether rules exist but whether they hold when everyone is busy.

Which responsible AI framework should we use?

They are complementary rather than competing. NIST AI RMF gives you the functional structure of govern, map, measure and manage. ISO/IEC 42001 gives you a certifiable management system. The OECD principles give you the values. The EU AI Act turns a subset into legal obligation. Map controls to all of them at once — the mapping is what absorbs regulatory change.

What does responsible AI miss when it is copied from a 2023 framework?

The generative and agentic surfaces. Prompt and system-prompt governance, grounding and retrieval scope, confabulation thresholds, prompt-injection defence, provenance, vendor model change, and for agents: autonomy classification, agent identity, tool permissions, memory scope, transaction limits and blast-radius containment. A framework that governs only the model will miss where modern systems actually fail.

Pillar three · Responsible AI

Where your controls actually are

Nine control themes, scored as they genuinely operate rather than as the policy describes them. You get a maturity level, your three weakest themes, and the specific controls that close them.

Most organisations that believe they are at level three are at level two, because the test is not whether rules exist but whether they hold when everyone is busy.

The nine themes

01Validity, reliability and robustness

The system does what it claims, at the quality it claims, under conditions it will actually meet.

— Pre-release validation against a defined acceptance threshold
— Benchmark and task-level evaluation with a versioned golden dataset
— Regression suite covering prompts, retrieval configuration and model version
— Drift detection on inputs and outputs with a defined response action
— Safe failure behaviour — degrade or refuse rather than guess
— Adversarial and stress testing proportionate to consequence

NIST AI RMF — Measure 2ISO/IEC 42001 — A.6 AI system life cycleISO/IEC 23894 — AI risk managementISO/IEC 5338 — AI lifecycle processesEU AI Act — accuracy and robustness obligations for high-risk systemsOECD — Robustness, security and safety

02Safety and security

The system cannot be made to cause harm, and cannot become a route into everything behind it.

— Threat model covering model theft, inversion, membership inference, data poisoning, prompt injection, supply chain and API abuse
— Prompt-injection defence: input segregation, least-privilege tool access from the generative layer, output filtering, detection telemetry
— Content filters and refusal behaviour tested, including jailbreak resistance
— Kill-switch with named operators, tested on a schedule rather than assumed
— Red teaming where the consequence of failure justifies it
— Supply-chain assurance for models, weights, datasets and components

NIST AI 600-1 — Information SecurityOWASP Top 10 for LLM ApplicationsMITRE ATLASEU AI Act — cybersecurity obligations for high-risk systemsISO/IEC 27001OECD — Robustness, security and safety

03Fairness and non-discrimination

The system does not distribute harm unevenly across the people it affects.

— Bias assessment before release, with the protected characteristics identified in advance
— Sub-group performance measurement, not just aggregate accuracy
— Mitigation applied and its effect measured rather than assumed
— Residual bias documented and explicitly accepted by a named owner
— Monitoring for divergence between sub-groups after release

NIST AI RMF — Measure 2.11EU AI Act — data and data governance obligationsISO/IEC 42001 — A.5 Assessing impactsOECD — Human-centred values and fairness

04Transparency and disclosure

People know when they are interacting with AI, and what it can and cannot do.

— User-facing disclosure where a person interacts with the system
— Marking of synthetic content and provenance signals where feasible
— Model and system cards covering intended use, limitations and out-of-scope use
— Published statement of what the system does not do

EU AI Act — transparency obligations for certain AI systemsISO/IEC 42001 — A.8 Information for interested partiesNIST AI RMF — Govern 4OECD — Transparency and explainability

05Explainability and contestability

A decision that affects someone can be explained to them, and challenged.

— Decision-level explanation proportionate to consequence
— Model logic and feature documentation retained
— A route for an affected person to contest an outcome where law or decency requires it
— Explanations tested on the people who will actually receive them

NIST AI RMF — Measure 2.9EU AI Act — right to explanation of individual decision-makingOECD — Transparency and explainability

06Privacy and data protection

Personal data is used lawfully, minimally, and does not leak back out of the model.

— Lawful basis recorded before processing begins
— Data protection impact assessment where required, and a fundamental rights impact assessment where the deployer is in scope
— Minimisation at collection and at prompt construction
— Memorisation and extraction testing for models trained or fine-tuned on personal data
— Data-subject rights handling that works when the data is inside a model, not only inside a database
— Cross-border transfer assessed, including where inference happens

GDPR / UK GDPREU AI Act — data and data governance; fundamental rights impact assessmentNIST AI 600-1 — Data PrivacyISO/IEC 42001 — A.7 Data for AI systems

07Human oversight

A human can understand, intervene in and stop the system — in practice, not on paper.

— Oversight mode chosen by rule rather than preference (see the oversight decision rule)
— Named roles able to override, with overrides logged and reviewed
— Automation-bias prevention: the interface must make disagreement easy
— Oversight evidence captured as a record, so the control can be audited
— Appeal path where the law requires one

EU AI Act — human oversight obligations for high-risk systemsNIST AI RMF — Govern 3.2ISO/IEC 42001 — A.9 Use of AI systems

08Accountability and audit trail

Every consequential decision has a name against it and survives the people who made it.

— Named owners maintained and re-attested on a schedule
— Decisions, approvals, overrides and exceptions held as immutable records
— Retention aligned to the longest applicable obligation
— A point-in-time audit pack producible for any system on demand
— Exceptions time-boxed, owned and reviewed — never open-ended

ISO/IEC 42001 — Clause 5 Leadership; A.3 Internal organizationEU AI Act — record-keeping and documentation retentionNIST AI RMF — Govern 1

09Generative and agentic surfaces

The risks that only appear once a system can generate, plan, remember and act.

— System prompts and templates versioned, reviewed and change-controlled
— Retrieval sources explicitly scoped; grounding verified as part of evaluation
— Confabulation measured against a threshold, with high-stakes output verified before use
— Vendor model updates treated as material change and revalidated
— Agent autonomy classified, tool permissions whitelisted, memory scope bounded
— Blast-radius containment on consequential actions

NIST AI 600-1 — all twelve risk categoriesEU AI Act — general-purpose AI obligationsISO/IEC 42001 — A.10 Third-party relationships

Scoring scale

0 · Not started —: No deliberate activity against this theme.
1 · Ad hoc —: Done by some teams, inconsistently, depending on who is involved.
2 · Defined —: A documented expectation exists and most teams follow it.
3 · Operating —: Applied consistently, with evidence produced as a by-product.
4 · Measured —: Evidenced, measured against targets, and fed back into design.

Maturity bands

Level 5 · Adaptive 85%+: Controls are evidenced and measured, and regulatory change is absorbed through configuration rather than programmes.
Level 4 · Measured 65%+: Controls operate consistently and are measured. The remaining gaps are usually agentic systems and third-party model change.
Level 3 · Operating 45%+: Expectations are defined and mostly followed. Still reactive to regulatory change, and weak on discovering what never came through intake.
Level 2 · Documented 25%+: Policy exists; practice depends on individuals remembering. It degrades the moment they are busy.
Level 1 · Ad hoc 0%+: Decisions are made case by case by whoever is in the room. There is no reliable answer to how many AI systems you run.

The oversight decision rule

Most frameworks say oversight should be "proportionate to risk" and stop there, which leaves the hardest question unanswered. This is a rule rather than a principle.

In the loop — A human approves each output before it has effect.: Use when the output is binding on a person, materially affects their rights, access, pricing or employment, or is effectively irreversible.
On the loop — The system acts; a human monitors and can intervene.: Use when the output influences a consequential decision but a person still makes it, or actions are reversible within a useful window.
Over the loop — The system acts; humans review samples and aggregate behaviour.: Use when output is internal, low-consequence and reversible, and volume makes per-item review meaningless.
Out of the loop — No routine human involvement.: Use when only where the worst realistic outcome is trivial and recoverable. If you cannot describe that outcome, you are not in this category.

Oversight that exists only in a policy document is not a control. If there is no evidence a human ever disagreed with the system, assume the oversight is decorative.

Agentic governance assumes agents will occasionally be creative in unproductive ways. Controls therefore constrain blast radius, not just intent — because intent is the thing you cannot inspect. The 12 generative risk categories and the full agentic overlay are on the framework page.

Common questions

What is responsible AI in practice?: The operational expression of several overlapping frameworks, reduced to nine control themes: validity and robustness, safety and security, fairness, transparency, explainability, privacy, human oversight, accountability and audit trail, and the generative and agentic surfaces. Each theme carries specific controls and maps to the frameworks it satisfies, so an obligation that moves can be re-pointed rather than triggering a new programme.
How do you measure responsible AI maturity?: Score each control theme as it genuinely operates rather than as policy describes it: not started, ad hoc, defined, operating, or measured. The composite maps to five maturity levels from ad hoc to adaptive. Most organisations that believe they are at level three are at level two, because the test is not whether rules exist but whether they hold when everyone is busy.
Which responsible AI framework should we use?: They are complementary rather than competing. NIST AI RMF gives you the functional structure of govern, map, measure and manage. ISO/IEC 42001 gives you a certifiable management system. The OECD principles give you the values. The EU AI Act turns a subset into legal obligation. Map controls to all of them at once — the mapping is what absorbs regulatory change.
What does responsible AI miss when it is copied from a 2023 framework?: The generative and agentic surfaces. Prompt and system-prompt governance, grounding and retrieval scope, confabulation thresholds, prompt-injection defence, provenance, vendor model change, and for agents: autonomy classification, agent identity, tool permissions, memory scope, transaction limits and blast-radius containment. A framework that governs only the model will miss where modern systems actually fail.