Responsible AI: turning principles into controls, owners and evidence

An enterprise customer's security questionnaire has a new section on AI. It asks for your responsible AI principles and how you apply them. You have a values page and a team that cares, but nothing a reviewer can check. This guide turns responsible AI into something you can prove.

It is written for founders, CTOs and security leads at UK tech firms of 25 to 250 people. You will leave with the UK's five principles, a table that gives each one a control, an owner and an evidence record, and a short statement your customers can test.

What is responsible AI?

Responsible AI means developing and using AI in ways that are safe, transparent, fair, accountable and open to challenge. In practice, each of those principles has a named owner, a working control and a record that shows the control ran. Without those three things, responsible AI is a values statement on a website, not a discipline.

The UK government's AI regulation white paper uses the same framing. It says its principles "set out the key elements of responsible AI design, development and use, and will help guide businesses."

For the wider operating model that responsible AI sits inside, see our guide to building an AI governance framework. This page stays with the principles and how you evidence them.

What is the difference between responsible AI and ethical AI?

Ethical AI is the values: what your firm believes is right when it builds or uses AI. Responsible AI is the operating discipline that puts those values to work through owners, controls and evidence. The two belong together, but only responsible AI gives a customer something to test.

The UK government's guidance on understanding AI ethics and safety defines AI ethics as "a set of values, principles, and techniques that employ widely accepted standards to guide moral conduct in the development and use of AI systems."

That definition is a good starting point for the ethical use of AI. It does not tell anyone who checks the model before release, or where a customer goes when an AI-assisted decision looks wrong.

A principle nobody owns is a hope, not a control.

What are the UK's five responsible AI principles?

The UK's five responsible AI principles, set out in the 2023 white paper, are: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. They are cross-sector, non-statutory and applied by existing regulators such as the ICO and the FCA in their own sectors.

The white paper says the principles "will be issued on a non-statutory basis and implemented by existing regulators." The February 2024 government response kept that position: "We think a non-statutory approach currently offers critical adaptability."

So the five principles are not law in themselves. They are still the most useful spine for a UK firm, because they are the set your regulators and UK customers will recognise. They also line up closely with the two international references most questionnaires cite.

The OECD AI Principles were adopted in 2019 and updated in May 2024. The NIST AI Risk Management Framework, released in January 2023, is "intended for voluntary use". Its seven characteristics are listed in NIST AI 100-1. The white paper itself says the UK principles build on the OECD set.

If a customer asks which responsible AI framework you follow, a sound answer for a UK firm is the UK five, mapped to OECD and NIST. You do not need a sixth or seventh principle of your own.

How do you turn responsible AI principles into controls?

You turn responsible AI principles into controls by giving each principle one control that runs on a schedule, one owner role, and one record that proves it ran. For a firm of 25 to 250 people, we recommend starting with five controls, one per principle. Each produces evidence you can hand to a customer or an auditor.

The table below is our starting set. The owner is a role, not a committee, because a committee cannot sign a record. Our article on AI accountability covers why that matters.

The fairness row matters most where AI touches personal data. The ICO's guidance on AI accountability and governance says the accountability principle makes you responsible for complying with data protection law "and for demonstrating that compliance in any AI system that processes personal data." It calls a data protection impact assessment "an ideal way to demonstrate your compliance."

The contestability row is the easiest to leave out. The white paper says affected people "should be able to contest an AI decision or outcome that is harmful or creates material risk of harm." A support inbox is not a route for challenge unless someone triages AI complaints and records what happened.

If nobody can challenge the output, nobody is accountable for it.

How does responsible AI map to ISO/IEC 42001:2023?

Responsible AI maps to ISO/IEC 42001:2023 through the standard's requirement areas rather than through a one-to-one list. The five controls above sit inside the AI policy, roles and responsibilities, AI system impact assessment, AI system lifecycle and third-party relationship areas of an AI management system. Building them now is groundwork for certification later.

ISO/IEC 42001:2023 is the international standard for an AI management system. Our ISO/IEC 42001 overview explains how the standard is structured. Described at area level, the fit looks like this:

The last row is easy to miss. If most of your AI arrives inside a supplier's product, the register and the impact assessment must cover bought tools as well.

Where do responsible AI principles become legal duties?

In the UK, the five principles are not law, but existing law still applies to AI, including UK GDPR, equality law and sector rules. In the EU, the AI Act turns parts of responsible AI into specific duties, such as AI literacy under Article 4 and disclosure duties for certain systems. Map each control to any duty that applies.

Two EU examples show the pattern. The Commission's AI literacy Q&A says Article 4 requires providers and deployers "to take measures to support the development of AI literacy" of their staff. Its overview of the AI Act says people using systems such as chatbots "should be made aware that they are interacting with a machine."

Both fit inside the transparency and accountability rows of the table. For the obligations in full, see our EU AI Act overview.

How do you write a responsible AI statement customers can test?

Write a responsible AI statement that names your principles, then makes one checkable commitment under each. Every commitment should point to a record you could share under NDA. Keep it to one page. A customer should be able to read it and ask for the evidence behind any line.

Here is the shape we recommend for a 25 to 250-person firm:

1. Scope. Say which AI you build into your product and which AI tools your staff use.
2. Principles. Name the UK five and say you map them to the OECD AI Principles and the NIST AI RMF.
3. Commitments. Give one sentence per principle, each matching a control in the table above.
4. Ownership. Name the executive accountable for the statement and the date of its last review.
5. Challenge route. Give a contact point for anyone who wants to question an AI-assisted outcome.

A testable commitment reads like this: "Every AI feature passes a documented pre-release test, and we re-test after any material change." A reviewer can ask for the last test record and check the date.

An untestable one reads like this: "We are committed to safe and ethical AI." No record can prove or disprove it.

How does responsible AI answer a security questionnaire?

A responsible AI programme answers the AI section of a security questionnaire by giving each question a record rather than a paragraph. Questions about where you use AI, how you test it, how you handle personal data and who is accountable map straight onto the five controls. The register, test records and impact assessments become your attachments.

Typical questions, and the record that answers each:

• Where do you use AI in the service? The AI system register.
• How do you test AI features before release? The pre-release test records and their failure conditions.
• Is customer data used to train models? The impact assessment and the AI use notice.
• Who is accountable for AI in your organisation? The named owner on the register and the review minutes.
• How can we raise concerns about an AI outcome? The challenge route in your responsible AI statement and the challenge log.

Answering this way means less drafting and more attaching. The answers also stay consistent from one questionnaire to the next, because they come from the same records.

What are the common mistakes with responsible AI?

The common mistakes with responsible AI are principles with no owner, copying a large technology company's principle set, and leaving out a route for challenge or redress. Each produces a policy that reads well but fails the first follow-up question from a customer. Each is also quick to fix.

• Principles with no owner. A list of values signed off by "the leadership team" has no one to ask for evidence. Give each principle a role.
• Copying a big-tech principle set. A set written for a global platform assumes teams and budgets you do not have. The UK five are shorter, recognised by your regulators and easier to evidence.
• No route for challenge or redress. If an affected person cannot reach a human, the contestability principle exists only on paper. Publish the route and log what comes through it.

A responsible AI page with no evidence behind it is marketing, and customers can tell.

Frequently asked questions