In this post
Before you build
- Say what decision the system supports and who is affected by it.
- Decide whether AI is needed at all.
- Name who is accountable for the system.
Data and privacy
- Know what data is used, where it came from and whether you may use it for this purpose.
- Minimise personal data and keep it out of prompts and logs where you can.
- Check where a provider stores and processes data, and under what terms.
Bias and fairness
- Test results across the groups the system affects, not only on average.
- Look at how errors are distributed, not just how many there are.
- Give people a way to challenge an outcome.
In operation
- Keep a human in the loop for consequential decisions.
- Monitor for drift and for new misuse.
- Keep records so decisions can be explained and audited.
- Review the system on a schedule, and when the law or the use changes.
Sources and further reading
- NIST. AI Risk Management Framework (AI RMF 1.0). nist.gov/itl/ai-risk-management-framework.
IICTP is a new independent credential and is not ISO/IEC 17024 accredited.