Responsible AI usage means deciding who is accountable for each AI system, testing it for the harm it could cause, being open about what it can and cannot do, and monitoring it after launch. Two public references help: the OECD AI Principles and the NIST AI Risk Management Framework.
What do the OECD principles say?
The OECD lists five values based principles for trustworthy AI: inclusive growth, sustainable development and well being; human rights and democratic values, including fairness and privacy; transparency and explainability; a principle on reliability, security and safety; and accountability. They are broad on purpose, written to guide governments and organisations.
For a company, the practical reading is that each principle becomes a question you can ask about a specific system. Who could this treat unfairly? Can we explain what it did? What happens when it fails? Who answers for it?
What is the NIST AI RMF?
NIST's AI Risk Management Framework is voluntary and organised around four functions: Govern, Map, Measure and Manage. Govern covers policies, roles and culture. Map frames context and identifies risks for a particular system. Measure tests and tracks those risks. Manage decides what to do about them and acts.
NIST also publishes a Generative AI Profile, NIST AI 600-1, which applies the framework to generative systems. NIST describes the framework as meant to be used flexibly, so you can adopt parts of it without a large programme.
One caution: principles do not test anything. They tell you what to care about, and the work is turning each into a check you run before launch and again after changes.
What are the real challenges?
Ownership is vague. An AI feature spans product, data, legal and security. When all four own it, nobody does.
Shadow use. Staff paste data into tools nobody approved. A ban rarely works; an approved option and clear rules usually do better.
Testing is hard. Outputs vary, so tests must cover distributions of behaviour, not single answers.
Drift. A model that behaved well at launch can degrade when inputs change or a vendor updates it.
Explaining decisions. For some uses, such as decisions about people, you may owe an explanation. Choose models and logs that make that possible.
A constructed example
A recruiting team wants an AI tool that ranks applicants. Under a Map exercise they list who is affected, which fields the tool uses and where bias could enter, such as proxies for age or location. Under Measure they compare shortlists across groups on past data. Under Govern they name a hiring manager as owner and require that a human reviews every rejection. Under Manage they set a quarterly review and a switch to turn the tool off.
None of that needs special software. It needs a written decision and a calendar.
What about vendors and third party models?
Most companies use models they did not build. Responsibility does not transfer with the contract. Ask each supplier what data they keep from your prompts, whether they train on it, how they notify you of model changes and what logs you can export. Record the answers in the register next to the system, so a later reviewer knows what was promised and when it was checked.
How to check or apply this
- Keep a register of every AI system in use, including tools bought by teams without central approval.
- Name one accountable owner per system.
- Classify each by impact: low for drafting text, higher for decisions about people or money.
- For higher impact systems, write down intended use, known limits, test results and a rollback plan.
- Decide what data may be sent to which tools, and publish the rule.
- Log inputs and outputs where you are allowed to, for review and incident response.
- Review each system on a schedule and after any model change.
- Give people a way to report problems and a person who responds.
Quick check
Is responsible AI a legal requirement?
It depends on where you operate and what the system does. Some laws impose duties for specific uses. The OECD principles and NIST framework are voluntary guidance, not law.
Do we need a dedicated AI team to start?
No. A register, named owners and a review habit are enough to begin, and they scale as use grows.
Sources
Last reviewed: 18 October 2026.
