Implementation and Self-Assessment Guide for Organizations

Section 1 Objectives of deploying AI

Guides organizations to incorporate ethical considerations when deciding whether to implement AI solutions. Organizations should clarify their business purpose, evaluate whether benefits in a responsible approach justify costs, and confirm alignment with organizational values and societal expectations.

Section 2 Internal governance structures and measures

Organizations should establish or adapt governance structures to oversee AI use, either by incorporating AI governance into existing governance, risk and compliance structures or creating dedicated committees, and should consider sandbox testing approaches and separation of oversight teams. Decision-making should be centralized for higher-risk or contentious AI deployments escalated to senior management, or decentralized using pre-approved and off-limits lists for lower-risk solutions, with boards managing risk and values, committees approving models, and project leads accountable for compliance and model risks. Personnel involved in AI governance must be aware of their roles and properly trained; staff handling AI systems need specialized training to interpret outputs and detect bias, all staff using AI should be aware of relevant risks and know where to escalate concerns, and organizations should consider hiring multi-disciplinary talent, creating specialized roles, and implementing education programs at all levels.

Section 3 Determining the level of human involvement in AI-augmented

Organizations should conduct impact assessments from technical and data protection perspectives to determine appropriate human involvement levels, choosing between human-in-the-loop when human judgment significantly improves decision quality, human-out-of-the-loop for high-volume micro-decisions with understandable explanations, or human-over-the-loop using confidence thresholds to trigger human intervention. When setting human involvement levels, organizations should consider risk appetite, user experience, and operational cost, and must continually review and mitigate risks post-deployment through regular model retraining, performance monitoring, data drift detection, and scenario response planning. For safety-critical systems, organizations must ensure personnel can assume control when necessary and the AI system provides sufficient information for informed decision-making and actions.

Section 4 Operations management

Organizations should implement accountability-based data management practices aligned with data protection laws, including tracking data lineage through provenance records and assessing third-party dataset risks. Organizations should verify dataset accuracy, completeness, credibility, currency and relevance; mitigate unintended bias by identifying sensitive data fields and checking for direct and indirect bias indicators; ensure datasets are fully representative by benchmarking against population statistics and using separate datasets for training, testing and validation; conduct statistical tests such as ROC curve analysis; and periodically review and update datasets using challenger models, adversarial models, or automated monitoring. Organizations should enable understanding of deployed models through explanation strategies such as surrogate models, sensitivity analysis, model reports, factsheets, simpler model versions, visualizations and narrative descriptions; when explainability cannot be practically achieved, use repeatability tests, counterfactual fairness testing, exception handling, time-sensitive model validation, error rate testing across subgroups, simulations, version control and model comparison.

Section 5 Stakeholder Interaction and Communication

Organizations should identify and communicate with internal and external stakeholders on AI solutions by tailoring explanations of data, models, human involvement, inferences, algorithms and impact to audience, purpose and context, customizing messages for different stakeholders, adjusting language and complexity, and charting stakeholder journeys to minimize information fatigue. Organizations should disclose to consumers the data fields important to decisions and their values, when and why and how AI was used, reasons for using AI, how models were trained and selected, risk mitigation steps, the role and extent of AI in decision-making in plain language and meaningful formats, outcomes of automated decisions with data sources and lineage, how data was trained and labelled, model performance statistics, and a policy on explanations; they should develop educational tools such as leaflets and user guides, test user interfaces for usability, and design them with users at the centre by consulting end users early and collecting feedback. Organizations must enable users to decline participation in AI solutions automatically or upon request and inform them of impacts, establish channels with trained personnel for users to submit feedback and questions, enable individuals to revise their personal data, set expectations for response times, publicize contact details such as a data protection officer, and create a mechanism allowing users to request reconsideration of consequential AI-based determinations affecting them potentially including procedures for appealing decisions and records of system interactions.