Is Your Organisation Using AI
Responsibly?

Does your organisation treat AI-generated outputs as drafts requiring human verification before they are shared with clients, used in decisions, or acted on operationally — rather than as final answers?

Is there any process — however informal — for tracking the accuracy and error rate of AI outputs that influence your key decisions or client deliverables?

Does every active AI initiative in your organisation have a named human owner — someone explicitly accountable for that system’s performance, governance compliance, and incident response — documented in writing rather than assumed by role?

If an AI system used in your organisation produced an unexpected, incorrect, or harmful output, is there a defined protocol for stopping, escalating, and remediating — with a named response lead and documented containment steps — before more harm occurs?

Before deploying AI tools — including agentic AI systems — that access sensitive data, connect to external systems, or can take autonomous actions, does your organisation assess the security risks? This includes adversarial manipulation such as prompt injection (where malicious inputs hijack AI behaviour) and data exposure.

Do AI tools and agentic AI systems in your organisation follow the principle of least privilege — accessing only the data, APIs, and systems required for their specific task, with access boundaries documented and reviewed regularly? An AI agent with unrestricted access creates a significantly larger blast radius when it behaves unexpectedly.

Does your organisation disclose to clients, employees, or other affected parties when an AI system has been used to make or materially influence a decision that affects them — and is this disclosure governed by a written policy rather than left to individual judgement?

If a client, employee, or regulator asked how a specific AI-influenced decision or recommendation was reached, could your organisation provide a plain-language explanation of the factors considered — for at least your medium- and high-stakes AI use cases?

Are there written, enforced rules defining which categories of data — client personally identifiable information (PII), employee records, confidential financials, proprietary business information — may not be entered into AI tools without explicit approval? And are employees trained on these specific restrictions?

Before adopting an AI tool, does your organisation review how the vendor handles your data — specifically whether the vendor uses your inputs to train their public models, what data isolation protections exist, and whether data processing agreements are in place?

For AI systems that influence decisions affecting people — hiring, performance evaluation, client eligibility, pricing, or service terms — is there a pre-deployment review to assess whether the system could produce biased or discriminatory outcomes across demographic groups?

After an AI system is deployed, is it periodically reviewed to ensure its outputs remain fair over time — checking for demographic patterns, shifting outcomes, or model drift that could introduce or amplify bias that was not present at launch?