Securing & Governing AI · Chapter 15 of 13
Responsible AI, in practice
Not the principles poster. The specific controls that make an AI system defensible, and who owns each one.
Almost every organisation has published AI principles — fairness, transparency, accountability, human oversight. Almost none can tell you which control implements which principle, or who owns it. That gap is what responsible AI work actually consists of, and it is why the discipline is hiring: in the enterprise sample behind this site, responsible AI and governance language appeared in 87% of postings — the single highest term, higher than agents or evaluation.
Turning principles into controls
| Principle | The control that implements it | Who owns it |
|---|---|---|
| Fairness | Disaggregated evaluation — measure quality per affected group, not in aggregate | The team building it, validated independently |
| Transparency | Disclosure that the user is talking to a system, and what it can and cannot do | Product |
| Accountability | A named owner in an inventory, with a tier by consequence | Governance |
| Human oversight | A review step on consequential decisions, with the reviewer able to actually disagree | Product and operations |
| Explainability | Reconstructable decisions — input, context, versions, output, retained | Engineering |
| Privacy | Data-flow mapping, retention decided deliberately, DPA with the provider | Privacy and legal |
| Safety | Adversarial evaluation, output filtering, incident response for AI-specific failures | Security |
| Contestability | A route for the affected person to challenge an outcome, that a human answers | Operations |
The one principle people implement badly
Human oversight is routinely theatre. A reviewer who sees 400 decisions an hour, with the system's recommendation pre-selected and no time to investigate, is providing the appearance of oversight rather than oversight. Regulators have started saying so explicitly.
The test: measure the override rate. If humans agree with the system 99.8% of the time, either the system is extraordinary or the review is a rubber stamp — and it is almost never the first. That single metric is the most useful thing an assurance function can ask for, and almost nobody computes it.
Fairness, without the mathematics
You will hear that fairness is mathematically impossible to satisfy, which is true and usually misused. The real result is narrow: several reasonable definitions — equal false-positive rates across groups, equal positive predictive value, demographic parity — cannot all hold simultaneously unless base rates are identical. That is a reason to choose and document which definition applies to your use case, not a reason to conclude fairness is unachievable and stop measuring.
Practically: disaggregate the evaluation. Whatever quality metric you report, report it per affected group as well as overall. An aggregate of 94% hiding 71% for one segment is the finding, and it is invisible until someone splits the data.