Module 1 · Lesson
Using AI responsibly and ethically
Six principles
| Principle | What it means in practice |
|---|---|
| Fairness | AI must not disadvantage people because of protected characteristics such as race, sex, age, disability or religion. Test for it; do not assume it. |
| Transparency | People are told when AI is used in ways that affect them, and can get an explanation. |
| Privacy | Personal data is used only where necessary, lawful and protected. |
| Human oversight and accountability | A named person can understand, question and override the AI, and is responsible for the outcome. |
| Accuracy and reliability | Outputs are checked against sources and monitored over time. |
| Security | Access, data flows and vendors are controlled. |
How bias gets into AI
- Historical data. A model trained on past decisions learns past preferences. In 2018 Reuters reported that Amazon had abandoned an experimental résumé-screening tool after finding it downgraded résumés containing the word “women’s”, because it had learned from a decade of mostly male hires.
- Proxies. Removing a protected characteristic does not remove its traces. Postcode can stand in for race, graduation year for age, and gaps in employment for disability or caregiving.
- Rules that encode bias directly. In 2023 the US Equal Employment Opportunity Commission announced a $365,000 settlement with iTutorGroup, whose application software was alleged to have automatically rejected female applicants aged 55 or over and male applicants aged 60 or over.
- Prompt framing. Asking for “a young, energetic team player” builds bias into the request.
- Automation bias. People tend to over-trust a confident machine output and stop checking. This is why “a human reviews it” is only a safeguard if the human really reviews it.
Measuring adverse impact: the four-fifths rule A common first screen for discriminatory effect comes from the US Uniform Guidelines on Employee Selection Procedures. Calculate each group’s selection rate (the number selected divided by the number who applied). Then divide each group’s rate by the highest group’s rate to get the impact ratio. A ratio below 0.80 (four-fifths) is generally treated as evidence of adverse impact that needs investigation.
| Group | Applicants | Advanced to interview | Selection rate | Impact ratio |
|---|---|---|---|---|
| A | 100 | 40 | 40 ÷ 100 = 40% | 40% ÷ 40% = 1.00 |
| B | 80 | 20 | 20 ÷ 80 = 25% | 25% ÷ 40% = 0.625 |
Group B’s ratio of 0.625 is below 0.80, so this screening step should be examined. The rule is a rule of thumb, not a legal verdict: with small numbers it can mislead in both directions, and statisticians use additional tests. But it is easy to compute, and the bias audits required for certain hiring tools in New York City are built on impact ratios. The text of the Uniform Guidelines is at 29 CFR Part 1607.
Privacy and data handling Before you paste anything into an AI tool, ask two questions: what kind of data is this, and is this tool approved for it?
| Category | Examples | Rule |
|---|---|---|
| Green | Public information, generic templates, fictional practice data, your own writing with no personal details. | Fine in any reputable tool. |
| Amber | Internal documents with no personal data, such as a policy or an anonymous, aggregated survey summary. | Only in tools your organisation has approved for internal information. |
| Red | Anything about an identifiable person: names with performance, pay, health, disciplinary or investigation details; candidate records; government identifiers. | Never in an unapproved tool. In an approved tool, only when necessary, and with the minimum data. |
- Consumer and business versions of the same tool differ. Consumer accounts may use your conversations to improve the model unless you turn that off; business and enterprise plans typically do not train on customer data by default and add administrative controls. For ChatGPT, see OpenAI’s Data Controls FAQ and its enterprise privacy page. Check the equivalent pages for whichever tool you use.
- Find out what your employer permits. Many organisations have an acceptable-use policy for AI. If yours does not, raising the question is a useful contribution.
- Minimise and anonymise. Remove names, replace them with roles (“Employee A”), aggregate where you can.
- Remember the output is data too. A summary of an investigation is as sensitive as the notes it came from.
Human oversight that is real Laws and good practice increasingly require “meaningful human review”. A review is meaningful when the reviewer has the authority to change the outcome, the information to judge it (including the source material, not only the AI’s output), the time to do so, and is accountable for the result. Clicking “approve” on a stream of recommendations is not oversight.
The legal landscape: a global snapshot You do not need to memorise statutes. You do need to know that rules exist, roughly what they ask for, and that they differ by place. The table gives the position as of 2 October 2026. Treat it as a map for further reading, and confirm the current position before relying on it.
| Jurisdiction | Position as of 2 October 2026 | What it means for an HR team |
|---|---|---|
| European Union | AI Act (Regulation (EU) 2024/1689, amended by Regulation (EU) 2026/1744). AI used for recruitment, selection, promotion, termination, task allocation, and monitoring or evaluating workers is classed as high-risk. Prohibited practices, including emotion inference in the workplace, have applied since 2 February 2025. A duty to take measures supporting staff AI literacy applies (the 2026 amendment softened its wording but kept it). Transparency duties, such as telling people they are interacting with an AI system, apply from 2 August 2026. High-risk obligations for employment systems were postponed from 2 August 2026 to 2 December 2027. The GDPR applies throughout, including limits on decisions based solely on automated processing and the requirement for data protection impact assessments. | Inventory your AI uses. Tell people when they are dealing with AI. Train staff. Use the extra time to prepare for human oversight, record-keeping and informing workers and their representatives before high-risk systems are used. |
| Jurisdiction | Position as of 2 October 2026 | What it means for an HR team |
|---|---|---|
| United States: federal | No AI-specific employment statute. Existing anti- discrimination laws (Title VII, the Americans with Disabilities Act, the Age Discrimination in Employment Act) apply to AI- assisted decisions. Executive Order 14365 (December 2025) seeks to limit state AI regulation; no federal law pre-empting state rules had been enacted at the time of writing. In Mobley v. Workday, a federal court has allowed discrimination claims over AI screening tools to proceed against the vendor. | Using a vendor’s tool does not remove the employer’s responsibility, and vendors may be liable too. |
| US: New York City | Local Law 144: an independent bias audit, a published summary and advance notice to candidates are required for automated employment decision tools. Enforced since July 2023. A December 2025 audit by the New York State Comptroller criticised the city’s enforcement, and commentators expect closer scrutiny. | If a tool scores or ranks candidates who live in the city, you need the audit, the published summary and the notice. |
| US: Illinois | HB 3773 (in effect 1 January 2026): employers must give notice when AI is used in employment decisions, must not use AI in a way that discriminates, and must not use postcode as a stand-in for protected characteristics. Implementing rules were proposed and then withdrawn in mid-2026, so the detail of the notice is unsettled. | Give notice now; watch for the final rules. |
| US: California | Civil-rights regulations on automated-decision systems (in effect 1 October 2025). Privacy-agency rules on automated decision-making technology (1 January 2027). SB 947, the “No Robo Bosses Act”, signed 30 September 2026 and effective 1 July 2027: employers may not rely solely on an automated system to discipline or dismiss a worker; where they rely on it primarily, a human reviewer must corroborate the decision and the worker must be told. | Keep records, test for bias, and build genuine human review into discipline and dismissal before July 2027. |
| US: Colorado | The 2024 AI Act was repealed and replaced by SB 26-189, effective 1 January 2027, which focuses on notice and disclosure for consequential decisions. Draft rules were published in August 2026. | Prepare notices and disclosures; follow the rulemaking. |
| US: Connecticut and Texas | Connecticut SB 5: disclosure duties phased in from 1 October 2026 to October 2027. Texas TRAIGA (1 January 2026): prohibits using AI with intent to discriminate. | State rules follow where candidates and employees live, so remote hiring can bring you into scope. |
| United Kingdom | No AI Act. UK data protection law and the Equality Act 2010 apply. The Information Commissioner’s Office audited AI recruitment tools in 2024 and published recommendations; the government published a Responsible AI in Recruitment guide. | Complete a data protection impact assessment, test for bias, be transparent with candidates, keep a human in the decision. |
| Jurisdiction | Position as of 2 October 2026 | What it means for an HR team |
|---|---|---|
| Canada | No federal AI statute (the proposed Artificial Intelligence and Data Act lapsed in January 2025). Ontario: since 1 January 2026, publicly advertised job postings by employers with 25 or more employees must disclose the use of AI to screen, assess or select applicants. Quebec’s privacy law requires informing people when a decision is based exclusively on automated processing. | Add disclosure language to postings; apply privacy law. |
| Asia-Pacific | South Korea: the AI Basic Act took effect on 22 January 2026, with a grace period before fines. Japan: an AI Promotion Act (2025) takes a non-binding, principles-based approach. Singapore: voluntary governance frameworks and testing tools. China: personal-information law regulates automated decision-making, alongside rules on generative AI and labelling of AI content. Australia: no AI-specific statute; privacy and employment law apply, and new transparency requirements for automated decisions under the Privacy Act are scheduled to begin in December 2026. | Expect transparency and human- oversight duties for high-impact uses; check local counsel. |
| Latin America | Brazil: the data protection law (LGPD) gives a right to review of automated decisions. A comprehensive AI bill passed the Senate in December 2024 and remained pending in the lower house at the time of writing. | Privacy law already applies; watch the bill. |
KEY IDEASix themes that recur everywhere
- Notice: tell candidates and employees when AI is used in decisions about them.
- Human review: a person, not the system, makes or can overturn significant decisions.
- Bias testing: check outcomes across groups, before use and regularly afterwards.
- Records: keep documentation of what the tool does, how it was tested and what it decided.
- Data protection: collect the minimum, secure it, and respect people’s rights over it.
- Shared responsibility: both the vendor and the employer can be held accountable.
If you build these six into your practice, you will be close to compliant in most places and well prepared for new rules.
Questions to ask a vendor of AI-enabled HR software
- What exactly does the AI do: generate text, score, rank, filter, predict?
- What data was it trained on, and does it use our data for training?
- Has it been tested for adverse impact across protected groups? By whom, how recently, and can we see the results?
- Can we run our own bias audit on our own data, and will you support that?
- What explanation can we give a candidate or employee about how an output was produced?
- How does a human review or override the output, and is that logged?
- Where is data stored, who can access it, and how long is it kept?
- Which laws do you consider the product subject to, and what compliance commitments are in the contract?
- How will we be told when the model changes?
- Who is liable if the tool produces a discriminatory outcome?
A personal checklist for everyday use
- Is this tool approved for the data I am about to use?
- Have I removed personal details that are not needed?
- Have I checked every fact, number, date and legal statement against a source?
- Have I read the output for bias, stereotypes and exclusionary language?
- Would I be comfortable telling the affected person that AI was used?
- Am I the one making the decision, with the AI as an input?
Jot down key ideas in your own words. Saves automatically.