From principles to processes

AI ethics has an operationalisation problem. All organizations subscribe to principles such as "fairness", "transparency", "non-discrimination" and "respect for human autonomy". Few have concrete processes to verify that their AI systems comply with those principles in practice.

Ethical principles without processes are statements of intent. Ethical processes without metrics are bureaucracy. This module focuses on the hard part: turning abstract principles into operational procedures, with measurable indicators and assigned responsibilities.

The problem of "ethics washing"

Publishing a document of "AI ethical principles" without implementation and verification mechanisms is ethics washing. It is the equivalent of having a privacy policy that nobody reads or follows. Regulators, sophisticated customers and the media have learned to distinguish between declared principles and actual practices.

The question is not "do we have ethical principles?". The question is: "what happens when an AI system violates one of our ethical principles? Who detects it? How is it escalated? What are the consequences?"

Reference ethical frameworks

You do not need to invent an ethical framework from scratch. Established references exist that you can adopt and adapt:

Ethics Guidelines for Trustworthy AI (HLEG, 2019)

The EU High-Level Expert Group established 7 key requirements:

1. Human agency and oversight: AI systems should support human autonomy and decision-making.
2. Technical robustness and safety: systems must be resilient, secure and accurate.
3. Privacy and data governance: protection of personal data and data quality.
4. Transparency: traceability, explainability and open communication.
5. Diversity, non-discrimination and fairness: avoiding unfair bias, accessibility, stakeholder participation.
6. Societal and environmental well-being: sustainability, positive social impact.
7. Accountability: auditability, minimisation of negative impacts, redress mechanisms.

ALTAI (Assessment List for Trustworthy AI)

The HLEG's practical tool. A self-assessment questionnaire with over 130 questions organized according to the 7 requirements. Not legally binding but the most concrete reference for a systematic ethical self-assessment.

OECD AI Principles

Five complementary principles adopted by more than 40 countries: inclusive growth and well-being, human-centred values and fairness, transparency and explainability, robustness and safety, accountability.

UNESCO Recommendation on AI Ethics (2021)

The first global normative instrument on AI ethics. Adopted by 193 countries. Emphasis on proportionality, safety, fairness, sustainability, right to privacy, human oversight and decision-making, transparency and explainability, responsibility and accountability, awareness and literacy, and multi-stakeholder and adaptive governance.

Ethical impact assessment (EIA)

The ethical impact assessment is the systematic process for identifying, analysing and mitigating the ethical risks of an AI system before deployment. It is not the same as the GDPR DPIA or the AI Act FRIA, although it shares elements with both.

When to conduct an EIA

• Before acquiring or developing a new AI system.
• Before a substantial modification to an existing system.
• When an unintended use of an existing system is identified.
• After an ethical incident (detected bias, discrimination complaint, negative public reaction).
• Periodically (at least annually) for high-risk or high-impact systems.

EIA structure

Phase 1: Context and scope

Define the system being assessed, its purpose, affected groups, usage context and relevant ethical principles. Identify internal and external stakeholders who should participate in the assessment.

Phase 2: Ethical risk identification

Systematically, for each relevant ethical principle, identify potential negative impacts. Use techniques such as structured brainstorming, scenario analysis, literature reviews and consultations with affected stakeholders.

Phase 3: Analysis and prioritisation

For each identified risk, assess likelihood and impact. Ethical impact has dimensions beyond economic harm: human dignity, autonomy, equity, public trust. Prioritise risks using a severity/likelihood matrix adapted to the ethical context.

Phase 4: Mitigation measures

For each prioritised risk, define concrete measures. Measures must be specific (what), assigned (who), planned (when), measurable (how it is verified) and reviewable (when it is reassessed).

Phase 5: Monitoring and accountability

Establish continuous monitoring mechanisms: indicators, periodic audits, reporting channels, ethics committee review. The EIA is not a static document: it is a living process that is updated with operational experience.

Algorithmic bias: types, detection and mitigation

Algorithmic bias is arguably the most concrete and measurable ethical risk. Understanding its types and knowing how to detect it is a core competency for any AI governance professional.

Types of bias

• Historical bias: training data reflects existing social inequalities. Example: if historically more men were hired for tech roles, a model trained on that data will reproduce the preference.
• Representation bias: certain groups are under or over-represented in the training data. Example: a facial recognition model trained predominantly on Caucasian faces has higher error rates for other ethnicities.
• Measurement bias: variables used as proxies measure different things for different groups. Example: postal code as a proxy for "credit risk" may encode racial or socioeconomic discrimination.
• Aggregation bias: a single model for heterogeneous populations ignores relevant differences between subgroups. Example: a medical model that works well on average but fails for women or for persons over 65.
• Deployment bias: the model is used in a different context than intended, where biases have different consequences. Example: a risk model designed for one country is applied in another with different social dynamics.

Detection techniques

• Disparate impact analysis: compare positive/negative outcome rates between protected groups. The EEOC four-fifths (80%) rule is a reference: if a group has a selection rate below 80% of the majority group, there is prima facie evidence of disparity.
• Equalized odds: verify that true positive and false positive rates are similar across groups.
• Demographic parity: verify that the probability of a positive outcome is independent of the protected group.
• Individual fairness: similar persons should receive similar outcomes (requires defining "similarity" in a non-trivial way).
• Counterfactual fairness: would the decision be the same if the individual belonged to a different group?

Mitigation strategies

• Pre-processing: rebalance training data, remove proxies for protected attributes, apply resampling techniques.
• In-processing: incorporate fairness constraints in the model's objective function during training.
• Post-processing: adjust decision thresholds per group to equalise outcomes. Easier to implement but may reduce overall accuracy.
• Continuous monitoring: mitigating bias during development is not enough. It must be monitored in production, because data distribution can change (data drift) and new biases can emerge.

Fairness audits

A fairness audit is a systematic assessment of an AI system to verify that it does not produce discriminatory outcomes. Unlike bias detection (which is technical), the fairness audit includes an organisational and governance dimension.

Fairness audit protocol

Step 1: Define scope and criteria

Which system is audited. Which protected groups are evaluated (gender, age, ethnic origin, disability, etc.). Which fairness metrics are applied and why. Which thresholds are considered acceptable.

Step 2: Collect data

Obtain training data, test data and, if possible, production data. Obtain the system's predictions/decisions broken down by protected groups. Verify the quality and completeness of demographic data.

Step 3: Quantitative analysis

Calculate the fairness metrics defined in step 1. Compare results across groups. Identify significant disparities. Analyse whether disparities are justifiable by legitimate factors.

Step 4: Qualitative analysis

Review individual cases where the system produced questionable outcomes. Assess whether the system's explanations are comprehensible and reasonable. Consult with representatives of affected groups about their perception of the system's fairness.

Step 5: Report and recommendations

Document findings, include quantitative and qualitative data, prioritise risks, propose corrective actions with deadlines and responsible parties. The report must be comprehensible to management (not only to technical staff).

Step 6: Follow-up

Verify implementation of corrective actions. Schedule the next audit. Establish continuous monitoring mechanisms between audits.

Explainability and interpretability

Explainability is the ability to make AI system decisions understandable to the persons affected. It is both an ethical and a legal requirement (Art. 13 AI Act, Arts. 13-14 and 22(3) GDPR).

Levels of explainability

• Global explainability: understanding how the model works in general. What factors it considers, what weight it assigns them, what patterns it detects.
• Local explainability: understanding why the model made a specific decision for a specific individual. "Your credit was denied because your debt-to-income ratio exceeds threshold X and your payment history shows 3 incidents in the last 12 months."

Explainability techniques

• SHAP (SHapley Additive exPlanations): calculates the contribution of each variable to the individual prediction. Based on cooperative game theory.
• LIME (Local Interpretable Model-agnostic Explanations): creates a simple local model that approximates the complex model's behavior around a specific prediction.
• Counterfactual explanations: "the decision would have been different if [variable X] had been [value Y]". Intuitive for the data subject but computationally expensive.
• Feature importance: ranking of the most influential variables in the decision. Simpler, less precise.

Proportional explainability

Not all systems need the same level of explainability. A spam filter needs less explainability than a credit scoring system. Proportionality depends on the impact of the decision on the affected person, the existence of alternatives (can the data subject appeal?), the regulatory context and the reasonable expectations of stakeholders.

Stakeholder engagement

AI ethics cannot be decided exclusively by technicians or lawyers. Affected stakeholders must participate in defining what is "fair" and "acceptable" in their context.

Stakeholder identification

• Directly affected: persons whose decisions are influenced by the system (candidates, customers, patients, students).
• Indirectly affected: family members, communities, competitors.
• Operators: persons who oversee and use the system.
• Regulators: supervisory authorities.
• Civil society: rights organisations, consumers, academics.

Participation mechanisms

• Public consultations before the deployment of high-impact systems.
• User panels that evaluate the experience with the system.
• Accessible and non-dissuasive feedback channels.
• Inclusion of representatives from vulnerable groups in ethics committees.
• Publication of transparency reports with disaggregated performance data.

Ethics by design: methodology

Ethics by design integrates ethical reflection into every phase of the AI system lifecycle, instead of treating it as a post-development final review.

Conception phase

Before starting development: preliminary ethical impact assessment, definition of applicable ethical principles, stakeholder identification, establishment of fairness criteria, definition of explainability requirements.

Design phase

During design: data selection with representativeness criteria, choice of algorithms with adequate interpretability properties, definition of human oversight mechanisms, user interface design with transparency information.

Development phase

During construction: fairness testing with predefined metrics, documentation of design decisions with ethical justification, code reviews focused on bias, testing with adversarial data and edge cases.

Deployment phase

Before and during launch: pre-deployment fairness audit, training of operators on ethical aspects, configuration of continuous fairness metric monitoring, activation of feedback channels.

Operation phase

During production use: continuous bias and fairness monitoring, complaints and grievance management, periodic audits, EIA updates, transparent communication of results.

Ejercicio practico

Puntos clave