Responsible AI Principles: Fairness, Accountability and Transparency
There are more sets of responsible AI principles in circulation than any organisation can usefully adopt. The good news is that they converge. Underneath the different vocabularies sit the same five commitments, and one of those sets, the OECD's, has been formally adopted by 47 jurisdictions and copied into most national frameworks since. Pick that as the spine and the rest becomes translation rather than choice.
The set that everything else is built on
The OECD AI Principles were adopted in May 2019 as the first intergovernmental standard on artificial intelligence, and updated in May 2024 to take account of general-purpose and generative systems. There are five values-based principles, plus five recommendations aimed at policy makers rather than companies.
| Principle | What it asks of a business |
|---|---|
| Inclusive growth, sustainable development and well-being | Ask who benefits and who bears the cost, including people who are not your customers |
| Human-centred values and fairness | Respect rights, autonomy and privacy; test for discriminatory outcomes, not just discriminatory intent |
| Transparency and explainability | Tell people when they are dealing with an AI system, and be able to explain a decision that affects them |
| Robustness, security and safety | Make the system behave predictably across its life, including under attack and under inputs it was not trained on |
| Accountability | Name a human who is answerable for each system, and keep records that let a third party check the claim |
The shorthand you will hear in research circles, FATE, covers fairness, accountability, transparency and ethics. It is a fine memory aid and a poor governance framework, because it leaves out safety, security and human oversight, which is where most real incidents live.
The UK version
The UK's March 2023 white paper on a pro-innovation approach to AI regulation set out five cross-sectoral principles: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. The mapping to the OECD set is close enough that a business complying with one is broadly complying with the other. Two things about the UK approach matter in practice.
First, there is no single AI regulator. The principles are issued to existing regulators, which means your obligations arrive through whichever body already regulates you: the ICO for personal data, the FCA in financial services, the MHRA for medical devices. Second, contestability and redress is the principle the other frameworks underplay. It asks a concrete question: when your system gets it wrong about a person, what is the route by which they find out, complain, and get it put right? Most organisations can answer the first four principles and stall on that one.
From principles to controls
Principles fail at the point where they meet a delivery deadline. The fix is to attach every principle to an artefact, an owner and a trigger, so that it becomes something a project manager has to produce rather than something a policy asserts.
The NIST AI Risk Management Framework, published in January 2023, is the most useful bridge. It names seven characteristics of trustworthy AI: valid and reliable; safe; secure and resilient; accountable and transparent; explainable and interpretable; privacy-enhanced; and fair with harmful bias managed. Then it sets out four functions that operationalise them. Govern establishes the policies, roles and culture, and sits above the other three. Map establishes the context and identifies the risks of a specific system. Measure analyses and tracks those risks. Manage allocates resources to treat them.
A workable translation for a mid-sized company looks like this:
- Fairness becomes a documented bias test against a named dataset, repeated when the model or the population changes, with the result recorded whether it passes or fails.
- Transparency becomes a system card for each deployed model and a user-facing disclosure written in the language your customers actually use.
- Accountability becomes a named individual in the risk register for each system, not a committee.
- Robustness becomes a defined failure mode, a monitored performance threshold and a rollback that someone has actually tested.
- Contestability becomes a published route for a person to challenge an automated decision, with a service level attached.
Where the law starts
None of the principle sets is binding by itself. Three things around them are. The EU AI Act, Regulation (EU) 2024/1689, is directly applicable and reaches UK companies placing AI systems on the EU market, with obligations scaled by risk tier. UK data protection law already governs solely automated decisions with legal or similarly significant effects on individuals. And ISO/IEC 42001, published in 2023, gives you a certifiable AI management system, which is what to reach for when a customer or an insurer wants third-party assurance rather than your own word.
Our related guides go deeper on each layer: how to build an AI governance framework, AI governance frameworks compared, algorithmic bias explained and the EU AI Act for UK business. For the policy document that turns all of this into rules for your staff, see how to write an AI use policy, or start from the E-Business Ethics homepage.
The test that separates real programmes from paper ones
Ask for the evidence rather than the policy. Pick one deployed system and ask four questions. Who is named as accountable for it? When was it last tested for biased outcomes, and what did the test show? What is the documented failure mode, and who is watching for it? How does a customer challenge a decision it made about them? A responsible AI programme answers all four with documents. Everything else is a values statement.
Frequently Asked Questions
What are the responsible AI principles?
The most widely adopted set is the OECD AI Principles: inclusive growth, sustainable development and well-being; human-centred values and fairness; transparency and explainability; robustness, security and safety; and accountability. Adopted in 2019 and updated in May 2024, they underpin most national frameworks, including the UK's.
What does FATE stand for in AI ethics?
Fairness, accountability, transparency and ethics. It is a shorthand from the research community rather than a legal standard, and it maps onto three of the five OECD principles. It is useful as a memory aid, but a board needs the fuller set because it omits safety, security and human oversight.
What are the UK's AI principles?
Five, set out in the March 2023 white paper on a pro-innovation approach to AI regulation: safety, security and robustness; appropriate transparency and explainability; fairness; accountability and governance; and contestability and redress. They are issued to existing regulators rather than enforced by a single new AI regulator.
What is the difference between the NIST AI RMF and the OECD principles?
The OECD principles say what a trustworthy system looks like. The NIST AI Risk Management Framework says how to get there. NIST names seven characteristics of trustworthy AI and four functions, Govern, Map, Measure and Manage, that turn the characteristics into repeatable practice.
Are responsible AI principles legally binding?
The principles themselves are not. The obligations that sit on top of them are: the EU AI Act, Regulation (EU) 2024/1689, is directly binding and reaches UK companies placing AI systems on the EU market, and UK data protection law already governs automated decisions about people. Treat the principles as the design language and the statutes as the requirements.
How do you turn principles into practice?
Attach each principle to an artefact and an owner. Fairness becomes a documented bias test on a named dataset. Transparency becomes a system card and a user-facing disclosure. Accountability becomes a named decision owner in the risk register. A principle with no artefact is a poster, not a control.
Which standard should we certify against?
ISO/IEC 42001, published in 2023, is the AI management system standard and the closest equivalent to ISO 27001 for information security. It is the practical answer when a customer or an insurer asks for third-party assurance rather than a self-declaration.
Sources
- OECD AI Principles, adopted 2019 and updated May 2024: oecd.ai
- NIST, AI Risk Management Framework (AI RMF 1.0), January 2023: nist.gov
- UK government, AI regulation: a pro-innovation approach, white paper, March 2023: gov.uk
Positions checked on 22 August 2026. AI policy is moving quickly; verify any principle wording against the issuing body before quoting it in a governance document.