AI should be deployed with accountability, governance and fit-for-purpose controls.

The principles we apply

• human accountability and responsibility for decisions
• appropriate human review of AI-generated outputs where needed
• privacy and careful handling of client information
• security considerations built into design, not added later
• access control and appropriate technology selection
• governance and policy alignment to the use case
• testing and monitoring as part of operational deployment
• transparency where appropriate and responsible communication
• fit-for-purpose controls based on sensitivity, consequences and context

The right controls depend on the context.

The appropriate security and governance approach depends on the use case, sensitivity of information, technology environment, integration model and consequences of error. We do not apply a one-size-fits-all control framework. We look at the business context, the data involved and the operational risk and then design the right controls for that environment.

We also avoid making claims that have not been established. We do not claim ISO certifications unless they are already documented elsewhere, and we do not promise guaranteed data residency, zero data retention or absolute security. We approach privacy, security and governance in a careful and realistic way.

Responsible deployment matters.

The process is not simply to build something clever and ship it. We consider how it will be used, who has access, what the review requirements are, what the operational controls are and how the system will be monitored over time.

Responsible AI is about building systems that people can trust in the context they are used, with clear accountability and sensible controls. You can also see how we approach technology choice on Our Technologies.