The concept
Responsible AI: building and using AI so it is fair, private, transparent and accountable. Three parts today.
1. Bias
Bias: outcomes systematically worse for one group. It often comes from history in the data, or from proxies: fields like ZIP code that stand in for protected traits.
Walkthrough: testing a credit-limit model (illustrative numbers)
A bank pilots a model that recommends credit-limit increases. Before launch, it compares outcomes by group:
- Group A: 600 of 1,000 recommended = 60%.
- Group B: 420 of 1,000 = 42%.
- Ratio: 42 ÷ 60 = 0.70.
A rule of thumb from US hiring guidance (the "four-fifths rule") flags ratios below 0.80 for review. It's a signal, not a verdict. Next:
1. Check if income and repayment history explain the gap.
2. Hunt for proxies: drop ZIP code, retest.
3. Document the result; keep a human reviewer on declines.
4. Re-run the check monthly after launch. Data drifts.
2. Privacy
- Send only what the task needs (data minimization).
- Put customer or patient data only into tools your company has approved.
- Health and financial data carry extra rules (e.g. HIPAA, GDPR).
3. Regulation (as of late 2026, not legal advice)
- EU AI Act: bans and AI-literacy duties since Feb 2025; general-purpose AI model rules since Aug 2025; transparency rules (e.g. telling people they're talking to an AI) from Aug 2026.
- A July 2026 amendment (the "Digital Omnibus") delayed high-risk rules: credit scoring, life and health insurance pricing and hiring from 2 Dec 2027; AI in regulated products like medical devices from 2 Aug 2028.
- Colorado replaced its 2024 AI Act with SB 26-189, effective 1 Jan 2027: notice when AI is used in consequential decisions, an explanation within 30 days of an adverse one, and a path to human review.
- NIST AI Risk Management Framework: voluntary US guidance: https://www.nist.gov/itl/ai-risk-management-framework
EU AI Act overview: https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai
Where you see it at work
- Banking and insurance: lending and pricing models are where bias testing and high-risk rules land first.
- PMs and BAs: write fairness, privacy and disclosure checks into acceptance criteria.
Your action today: for one AI use at work, write three lines: what data it touches, who is hurt by a wrong answer, and who reviews it.
In one sentence
Test outcomes by group, send only the data you need, and know which rules apply before you launch.
Which of the three worries you most at work: bias, privacy or regulation? 👇