Category: Governance

  • Training People to Think With, Against, and Through the Machine

    The real AI skill is judgement

    Many organisations describe their AI training goals in deceptively simple terms: teach people how to use the tools. That usually means showing employees how to write a prompt, summarise a document, generate a presentation, or ask a chatbot for ideas.

    AI is capable of very good tactical responses. The day-to-day, line-by-line work a capable junior or mid-level employee would produce. Those capabilities matter, but they are only the entry point, because the more consequential skill is not producing an answer with AI. It is deciding whether the answer deserves confidence, identifying what it missed, exposing where it might fail, and improving it through deliberate interaction.

    There’s a long list of damaging failures where the AI produced a confident answer that turns out to be based on flawed assumptions or made up facts. Using some simple approaches can catch these mistakes before they reach a client or regulator while still allowing AI’s speed.

    The core idea is treating AI as a dynamic sparring partner: a system that can propose, challenge, reframe, simulate, and revise, but whose contributions must be examined by a capable human. This changes the purpose of AI training. The goal is not merely fluency with interfaces, as with traditional software. It is the development of disciplined judgement under conditions in which plausible language can conceal weak reasoning.

    Prompt literacy is not enough, judgement is the harder skill

    Prompt literacy asks, “How do I get the model to produce what I want?” Judgement literacy asks a harder sequence of questions: What should the model be asked to do? What would a good answer contain? Which assumptions are hidden in the response? What evidence would change my mind? How could this answer fail in practice?

    That distinction is central because AI systems are optimised to produce useful-looking responses, not to guarantee that every claim is correct, complete, current, or appropriate for the situation. A confident paragraph may combine sound reasoning with an unsupported assumption. A concise recommendation may omit a constraint that a subject-matter expert would regard as decisive. A polished analysis may be internally coherent while based on incorrect premises.

    Training must therefore teach employees to separate fluency from validity, because AI producing outputs at scale, a small error rate becomes large absolute numbers. A team processing 500 customer communications a week with a 3% undetected error rate has 15 problems a week compounding.

    Treat AI as an argument simulator, not an answer machine

    A productive human–AI interaction has several distinct moves. The user first asks the AI to generate a provisional response. Instead of accepting it, the user then assigns the system an adversarial role: critic, sceptical customer, hostile reviewer, domain expert, risk officer, opposing counsel, or operational implementer. The user asks it to identify weaknesses, test assumptions, and present alternatives. Finally, the user decides what to retain, verify, revise, or reject.

    This process is more reliable than asking for a single “best answer” because it creates structured friction. The AI is used to generate content and also to interrogate the content it produces. Its role shifts from answer machine to argument simulator.

    StageHuman responsibilityUseful AI roleOutput to preserve
    FrameDefine the objective, audience, constraints, and stakesAsk clarifying questions and expose ambiguityA precise problem statement
    GenerateRequest a provisional answer without treating it as finalProduce options, hypotheses, drafts, or modelsMultiple candidate approaches
    CritiqueInspect logic, evidence, omissions, and assumptionsAct as an adversarial reviewerA failure and risk register
    Stress-testCompare the idea against edge cases and real-world constraintsSimulate stakeholders, scenarios, and objectionsConditions under which the idea breaks
    RefineApply human expertise and verified evidenceRewrite, reorganise, and make uncertainty explicitA revised, decision-ready artifact
    ValidateOwn the final judgement and consequencesHelp create checklists or audit trailsA documented approval decision

    The critique protocol preventing AI’s fluency from masking weak reasoning

    A useful training programme should provide a repeatable critique protocol. Employees can begin by asking whether the response answered the actual question rather than a nearby, easier one. They should then examine the assumptions: What does the answer presume about the customer, market, data, timeline, resources, law, or operating environment? Which assumptions are explicit, and which are hidden?

    The next step is to inspect the evidence. Are factual claims traceable to reliable sources? Does the response distinguish observed facts from estimates, interpretations, and recommendations? Does it indicate uncertainty where uncertainty matters? A response that makes no distinction between “we know”, “we infer”, and “we might try” is difficult to govern.

    Employees should also look for omissions. What relevant stakeholder is absent? What downside is underdeveloped? What implementation cost has been ignored? What would a sceptical expert object to? In many professional settings, the most dangerous error is not a false statement but a missing consideration.

    A compact minimal critique sequence can be remembered as TRACE:

    LetterQuestion
    T — TargetDid the output address the real objective and intended audience?
    R — ReasoningAre the logic, assumptions, and causal links sound?
    A — AccuracyWhich claims require verification, and what evidence supports them?
    C — CoverageWhat perspectives, constraints, risks, or alternatives are missing?
    E — ExecutionCould a real person or team implement this, and what would fail first?

    The protocol matters less than the habit. Critique should become a normal stage of work, not an emergency response after an AI-generated mistake reaches a customer, executive, or regulator. Even one good adversarial question catches more than zero.

    The strongest exercises make people disagree with the AI, not just improve it

    The strongest exercises do not ask participants merely to improve an AI answer. They train the reflex to know when to disagree with it.

    A team might give an AI system a proposed product launch plan and ask it to produce three critiques: one from a cash-constrained finance lead, one from a sceptical customer, and one from an operations manager responsible for execution. Participants then rank the criticisms by importance, identify which are supported by evidence, and decide what additional information is needed.

    A second exercise is the assumption reversal. Participants take a central assumption in the AI’s response and invert it. If the plan assumes rapid adoption, they ask what happens if adoption is slow. If it assumes reliable data, they ask how the recommendation changes when the data is incomplete or biased. If it assumes users will follow a process, they ask what incentives would cause users to bypass it.

    A third is the minimum viable rebuttal. Each participant must name the single strongest reason not to accept the AI’s recommendation. The purpose is not to be contrarian. It is to prevent the tendency to equate a polished output with a persuasive one.

    A fourth is the pre-mortem. Participants assume the project has already failed completely, then work backward to identify what caused it. This removes the social pressure to stay quiet in a room full of consensus, because the failure is already stipulated.

    Accountability requires making human judgement visible in the work

    Organisations should not evaluate AI training by counting prompts or measuring how quickly employees produce drafts. Those metrics reward activity. Better measures reward judgement: the number of material assumptions identified, the proportion of important claims verified, the quality of alternatives considered, and the clarity with which uncertainty is communicated.

    A practical workflow is to use an AI work note for consequential outputs. It need not be long. It can record the task given to the system, the key assumptions detected, the main criticisms generated, the facts independently checked, the changes made by the human, and the person who approved the final version. This creates a lightweight audit trail without making every interaction bureaucratic. As a side effect, in high-pressure organisations when something goes wrong the person who approved the AI output without documented scrutiny is exposed. Where the person who has a note showing they checked the key assumptions is not.

    Managers should also distinguish between different levels of risk. A brainstorming exercise may require only a basic plausibility check. A customer communication, hiring recommendation, safety procedure, financial analysis, or policy decision requires a more demanding review. The higher the stakes, the more the process should emphasise source verification, domain expertise, independent reasoning, and explicit approval.

    Correction must be rewarded, not tolerated

    No training framework will work if employees believe that questioning AI marks them as inefficient or resistant to technology. Leaders must communicate that revision is not failure but the mechanism by which value is created.

    This cultural point applies to humans as well as AI outputs. People routinely accept outputs that confirm their preferences, especially when those outputs are articulate and fast. AI can amplify that tendency by presenting a conclusion before the user has fully examined the problem. The organisation must reward people who find a flaw early, surface an inconvenient alternative, or slow down a high-stakes decision long enough to validate its premises.

    People who use the sparring-partner approach understand their work better, because interrogating the AI forces them to articulate what they know and don’t know. Leaders can model the behaviour by asking “What would make this wrong?” and “Show me the strongest case against this recommendation” before asking whether the answer is useful. Over time, these questions become part of the institution’s decision vocabulary.

    The goal is better thinking

    Treating AI as a sparring partner does not mean distrusting every output or forcing every task through an elaborate review ritual. It means assigning the system the right role for the task. AI can be a rapid generator, tireless critic, perspective simulator, editor, tutor, and rehearsal partner. It cannot replace accountability for decisions whose consequences belong to people and institutions.

    The central discipline is simple: generate broadly, challenge deliberately, verify selectively, and decide consciously. When people are trained this way, AI becomes more than a productivity shortcut. While additive initially, it becomes a structured environment for thinking, one that helps users see alternatives, discover weaknesses, and improve the quality of their own judgement. People who develop this capability become the ones their organisation trusts with higher-stakes work, because they’re visibly producing better outputs with fewer errors.

    The organisations that benefit most from AI will not necessarily be those that use it the fastest. They will be those that learn how to build a culture where speed is measured over the long term.

    Start here: a 30-minute exercise any team can run this week

    Bring one ordinary work product such as a proposal, briefing, process note, or customer message. Ask an AI system to improve it. Then ask the system to criticise its own revision from three different perspectives. Have the team independently identify the two most serious weaknesses, verify the most consequential claims, and produce a final version with changes documented.

    At the end, ask three questions: What did the AI notice that we missed? What did we notice that the AI missed? Which part of the final judgement could not responsibly be delegated?

    The answers will reveal the real training agenda. AI competence is not the ability to obtain an answer. It is the ability to engage an answer critically enough to make it better, and to know when it should not be trusted at all.

  • APRA Is Watching Your AI. Is your QA Strategy Ready?

    Australian Financial Services are moving fast with AI and APRA has high expectations.

    Most boards haven’t caught up yet. APRA knows this, and it has said so plainly in its letter to the industry. The regulator’s message is clear: existing governance, risk, and operational resilience practices are not keeping pace with how quickly AI is being deployed inside regulated entities. That gap is now a supervisory concern.

    This article explains what APRA and Australia’s updated privacy laws require of Financial Services using AI, and what a Quality Assurance strategy needs to look like in response.

    APRA Sees Three Governance Failures Happening Right Now

    APRA’s concerns are specific and three patterns appear consistently in its observations of the sector.

    Boards are making AI decisions without enough information. Many boards rely on vendor presentations to understand their AI risks. That’s a problem when the vendor is also the one selling the product. APRA expects boards to be capable of independent challenge, and most are not there yet.

    Governance exists on paper, not in practice. Entities have acknowledged that existing prudential standards apply to AI. Few have actually operationalised that acknowledgement with post-deployment monitoring, change management, and model decommissioning are common gaps.

    Supplier dependencies are underexamined. Many FinTechs have concentrated significant AI activity with a single provider without tested exit strategies. When those providers rely on foundation models, training data, or fourth-party services, the chain of accountability becomes opaque. APRA expects visibility all the way through that chain.

    APRA frames AI governance inside existing obligations such as CPS 230 for operational risk, outsourcing standards, and the Financial Accountability Regime (FAR). There is no separate AI rulebook. The existing rulebook applies, and APRA believes most entities are not meeting it.

    Privacy Law Has Changed. Your AI Systems Probably Haven’t.

    The Privacy and Other Legislation Amendment Act 2024 introduced changes that directly affect Financial Services using AI to make decisions about customers.

    The most significant change for AI is the new automated decision-making transparency requirement. If your systems use personal information to make decisions that significantly affect individuals, such as loan approvals or credit scoring, customers will have a right to meaningful information about how those decisions are made. The two-year grace period ends on 10 December 2026.

    Two other changes carry direct operational implications. First, Australians now have a personal right to sue for serious invasions of privacy. AI systems that process sensitive personal data at scale carry real exposure here. Second, the Office of the Australian Information Commissioner (OAIC) has stronger enforcement powers, including tiered civil penalties and the ability to conduct compliance assessments. The OAIC has already issued specific guidance on commercially available AI products.

    APP 11 now explicitly requires “technical and organisational measures” to protect personal information. This is not an IT-only obligation and covers the full range of privacy and security controls around AI systems.

    The Regulator Expects Boards to Lead, Not Delegate

    Both APRA and ASIC have reached the same conclusion from different directions: Financial Services are adopting AI faster than their governance frameworks can handle it, and boards are too far removed from the risk to provide effective oversight.

    APRA’s expectation is that boards understand AI well enough to set strategic direction and challenge assumptions. ASIC’s concern is that licensees are creating consumer harm by deploying AI without updating their risk and compliance frameworks.

    The practical implications are straightforward. Boards and executives need sufficient AI literacy to ask hard questions of management and vendors. Accountability for material AI use cases needs to be named, not distributed. Under FAR, accountable persons need to be identifiable for decisions made by or with AI systems. Staff need training that goes beyond “here is the tool” and covers misuse, limitations, and secure practices.

    Human oversight and ownership is not optional for high-risk decisions. AI can inform those decisions but a named person needs to own them.

    Your AI Systems Need to Fail Safely, Not Just Perform Well

    CPS 230, effective from 1 July 2025, extends operational resilience obligations to AI-enabled systems. This creates concrete requirements that go beyond standard performance monitoring.

    AI systems supporting critical operations need tested fallback processes. That distinction matters when regulators ask for evidence. AI failure modes that need to be planned for include hallucination, silent degradation, and susceptibility to adversarial inputs such as prompt injection or data poisoning.

    Security requirements have also become more specific. AI adoption changes the attack surface with more entry points, faster attack cycles, and new risks from non-human AI agents with system access. APRA expects strong privileged access management, timely patching, hardened configurations, and penetration testing that covers AI-specific vulnerabilities, including AI-generated code.

    Data governance sits underneath all of this. The quality and provenance of training data affects model behaviour. That is now a prudential concern.

    What an APRA-Ready AI QA Strategy Looks Like

    Active supervision of AI is underway with regulators no longer observing and advising. They are assessing and acting. An AI QA strategy needs to be designed for that environment.

    The foundation is a centralised AI inventory: every AI system in use, including third-party tools, mapped to the regulatory obligations it touches under CPS 230, FAR, and the Privacy Act. Without this, gap assessments and audit processes cannot function.

    From that inventory, four capabilities need to be in place.

    Continuous monitoring for bias, drift, and performance degradation. AI models do not stay stable. A model that was accurate at deployment may not be accurate six months later. Automated monitoring catches this before regulators do.

    Independent assurance for high-impact systems. Internal audit and external review processes need to cover AI systems with material customer or operational impact. This cannot be delegated to the team that built the system.

    Testing frameworks built for AI. Standard software testing does not address algorithmic bias, adversarial inputs, or the behaviour of AI-generated code. Testing frameworks need to evolve to cover these risks explicitly.

    Automated compliance tooling. Governance, Risk, and Compliance (GRC) platforms can automate the monitoring and reporting that manual processes cannot keep up with. Predictive compliance tools can identify non-compliant states before they become audit findings. SaaS Security Posture Management (SSPM) tools provide continuous measurement of security controls against regulatory baselines.

    The Gap Between Adoption and Governance Closes in One Direction

    Regulators are not going to slow down their expectations to match the pace of industry governance. The direction of travel is more scrutiny, not less.

    To get ahead of this do three things. Build board-level AI literacy that enables genuine challenge, not just approval. Establish clear ownership for AI decisions at the individual accountability level. Instrument their AI systems for continuous oversight rather than periodic review.

    APRA has been explicit about what it is looking for. The question is whether your governance framework reflects what your AI systems are actually doing, not what the documentation says they do.

  • Australia’s AI Disclosure Deadline Arrives

    If your organisation uses AI to help make decisions about people, Australia’s privacy law is about to change the rules, with the new obligations commencing on 10 December 2026.

    This article sets out what the new obligations require, where other jurisdictions are heading, and the steps your organisation could be taking now.

    December 2026: What the Australian Law Requires

    The Privacy and Other Legislation Amendment Act 2024 introduces a transparency obligation for automated decision-making. It sits inside the Australian Privacy Principles and applies to any APP entity, which covers most businesses handling personal information.

    The obligation is triggered when three conditions are met at the same time:

    1. Your organisation has arranged for a computer program to make a decision, or to do something substantially and directly related to making a decision.
    2. That decision could reasonably be expected to significantly affect the rights or interests of an individual.
    3. Personal information about that individual is used in the operation of the program.

    When all three conditions are met, your privacy policy must disclose what kinds of personal information the program uses, what types of decisions the program makes on its own, and what types of decisions the program substantially assists a human to make.

    Two details in that test widen its scope considerably.

    First, the obligation covers assisted decision-making as well as fully automated decisions, so a computer program that materially steers a human decision-maker brings the obligation into play. A loan officer who reviews an AI-generated credit score before approving or declining an application is making an assisted decision that falls within scope.

    Second, the term “computer program” is interpreted broadly enough to cover generative AI tools, rule-based engines, and sophisticated spreadsheets that score or rank individuals. If your team has quietly introduced automation into a workflow over time, that automation is likely in scope.

    Decisions that could significantly affect rights or interests include home loan approvals, insurance assessments, job application screening, housing allocation, and access to healthcare services. The Office of the Australian Information Commissioner (OAIC) is developing guidance expected by September 2026, though waiting for that guidance before acting carries real risk, as the months between September and December leave little room for the audit work that needs to happen first.

    Regulators Worldwide Are Moving in the Same Direction

    Australia’s December deadline reflects a global shift rather than an isolated local initiative, and regulators in multiple jurisdictions have reached similar conclusions about AI accountability.

    The EU AI Act Ties Obligations to Risk Level

    The EU AI Act classifies AI systems by risk level and attaches progressively stricter obligations to higher-risk applications. Providers of high-risk AI systems must design for transparency so users can understand what the system does and use it correctly. Providers of AI systems that generate or alter content must disclose that the output is AI-generated, with narrow exceptions for legal purposes or clearly artistic contexts. Impact assessments and documentation of decision-making processes are mandatory for high-risk applications.

    United States Regulation Is Emerging State by State

    The US has no single federal AI law, but individual states are filling that gap. California’s AB 3030, effective 1 January 2025, requires licensed healthcare providers to disclose when generative AI was used to create patient-facing content. Connecticut has established frameworks for automated employment decision tools that include mandatory consumer disclosures. This state-by-state patchwork creates real complexity for organisations operating across multiple US states, and it continues to grow.

    Canada’s Proposed AIDA Signals the Same Intent

    Canada’s Bill C-27 includes the Artificial Intelligence and Data Act (AIDA), which would create a regulatory framework for the design, development, and deployment of AI systems. The bill’s future depends on legislative processes still in progress, but the drafting shows a clear intent to regulate AI systems that could materially affect individuals.

    The through-line across all three jurisdictions is consistent, in that any AI system making or influencing consequential decisions about people is likely to attract a requirement to disclose and explain.

    Five Steps Your Organisation Can Take Before the Deadline

    Compliance with the December 2026 deadline calls for preparation that starts well before the OAIC publishes its final guidance, and the following sequence offers a workable approach.

    1. Map Every AI System That Touches Decisions About Individuals

    Start with a complete inventory, since most organisations have more automated decision-support than they realise. Automation tends to arrive incrementally, so a workflow that began as a manual spreadsheet review may now include scoring logic that materially influences outcomes. Third-party tools, vendor platforms, and SaaS applications frequently contain embedded AI functionality that the organisation never explicitly chose.

    For each system you identify, document what personal information it uses and how that information flows through the process, as this mapping forms the foundation the remaining steps build on.

    2. Apply the Three-Condition Test to Each System

    For each identified system, work through the three conditions in order, asking whether a computer program is making or substantially contributing to a decision, whether that decision could significantly affect someone’s rights or interests, and whether personal information is used in the process.

    This analysis calls for both legal and operational judgement, since the same system may trigger the disclosure obligation in one use case and not another. Document your reasoning for every conclusion, including the cases where you determine the obligation does not apply, as that record demonstrates a considered approach if the OAIC reviews your compliance.

    3. Rewrite Your Privacy Policy with Specificity

    Generic statements about using technology to assist decisions are unlikely to satisfy the new requirements. Your privacy policy needs to identify the kinds of personal information used in your automated systems, the categories of decisions made solely by those systems, and the categories of decisions where those systems substantially assist human decision-makers.

    For that reason, the policy is best written after the audit rather than before, since policies drafted from assumptions about what your systems do tend to be inaccurate, and inaccurate disclosure creates a compliance problem of its own.

    Alongside the public-facing policy, maintain internal documentation of each system’s design, the testing conducted, and the risk assessment process, as this record supports both regulatory compliance and sound governance.

    4. Build AI Review Into Procurement and Change Management

    The compliance obligation does not stop at the systems you have today, as vendors update their tools, new AI functionality arrives inside products your team already uses, and new systems join the estate over time.

    Integrating an AI disclosure assessment into your procurement process for any new tool or material software update gives your team a repeatable way to evaluate whether new capabilities bring the organisation into scope.

    5. Establish Human Oversight Protocols for Assisted Decisions

    Where AI assists human decision-makers, clear protocols for human review serve as both a legal expectation and sound risk management. Individuals should have a meaningful avenue to understand and challenge AI-influenced decisions, and for high-impact categories such as credit, employment, or healthcare access, that avenue should be accessible and substantive rather than a formality.

    Train the people who work inside these systems on what the regulation requires and on their specific role in maintaining compliance, since regulatory obligations met at the policy level but not understood at the operational level tend to fail when tested.

    The Cost of Waiting Is Higher Than It Appears

    Organisations planning to start compliance work after the OAIC guidance arrives in September 2026 face a narrow window. The audit alone can take months in organisations with complex or distributed technology environments, and rewriting privacy policies, updating vendor contracts, establishing governance protocols, and training staff all compound that timeline.

    The difficulty here lies less in the regulation, which is reasonably clear, than in the operational reality of understanding what your AI systems do at a level of detail sufficient to make accurate public disclosures.

    Organisations approaching this work systematically from now should be positioned to comply with confidence and to use their privacy policies as a genuine communication tool with customers. The regulation exists in response to AI systems making consequential decisions about people who have a legitimate interest in knowing. Building your compliance programme from that principle, rather than from the minimum required to avoid scrutiny, tends to produce better outcomes for the organisation and for the individuals affected.

  • Your AI Interface Is a Cognitive Design, Not a Cosmetic One

    Most organisations deploying AI spend months selecting the right model, agonising over accuracy rates, vendor contracts, and compliance implications. Then, in the final weeks before launch, someone asks: “What should the screen look like?”

    The interface is not decoration applied after the real decisions are made, instead it determines whether your people reason clearly alongside the AI or quietly work around it. Get it right, and your AI system makes better decisions than either the human or the system could alone. Get it wrong, and you have an expensive system that your team has learned to distrust, override, or ignore.

    This article gives you a structured method to audit any AI interface before deployment. Based on a field called Cognitive Systems Engineering (CSE), developed in the early 1980s by Erik Hollnagel and David Woods to address exactly the kind of high-stakes, human-machine decision environments that organisations across every industry are now building. The method is built around a five-level analysis called the Abstraction Hierarchy. You will walk through each level (we’ll use a loan decision AI as the working example), leaving with a set of questions you can apply to your own deployment.

    The Shift That Changes Everything

    Traditional software is deterministic. You press a button, you get a result. Designing the interface for that kind of system still requires some skill, but is largely a matter of clarity and efficiency because we have many examples of good (and bad) design.

    AI is different as it produces uncertain outputs and reasons probabilistically. It can be right most of the time and catastrophically wrong in ways that are difficult to anticipate. The interface for a traditional system needs to be usable. The interface for an AI system needs to do something different: it needs to make the AI’s reasoning visible so that the human can judge when to act on it, when to question it, and when to override it.

    Hollnagel and Woods called this a “joint cognitive system“: the human and the AI are not separate entities where one hands off to the other. They are a single thinking unit, and the interface is the connective tissue between them. Whether the decision involves a loan approval, a clinical recommendation, a fraud alert, or an operational plan, that connective tissue either holds or it tears.

    The Abstraction Hierarchy, developed by Jens Rasmussen and Kim Vicente at the Risø National Laboratory in Denmark, gives you a disciplined way to design that connective tissue. It asks you to understand your work domain at five levels, from purpose down to physical configuration. Each level reveals a different set of interface requirements that you might otherwise miss.

    The Abstraction Hierarchy: Five Questions for Any AI Interface

    Think of the Abstraction Hierarchy less as a taxonomy and more as a diagnostic interview. At each level, you ask a question about your work domain. The answers tell you what your interface must show, what it must prevent, and what it must make possible.

    Here is the framework applied to a loan decision AI to help understand the details.

    Level 1: What is this system ultimately for?

    This is the question of functional purpose: the values and goals the system exists to serve. Not the technical goals (“classify loan applications”), but the human and organisational values at stake.

    For a loan decision AI, the answer is not simply “approve or decline applications faster”. The real purposes are: extend credit to people who can repay it, protect the institution from credit losses, comply with responsible lending obligations, and treat applicants fairly across demographic groups. These purposes can conflict. A model optimised for speed may sacrifice fairness. A model optimised for loss minimisation may discriminate. These tensions exist whether you name them or not and exposing them allows informed decisions.

    What this means for your interface: The interface must make the system’s governing priorities visible. If the model has been calibrated to weight certain risk factors above others, the loan officer reviewing its recommendation should be able to see that calibration, not just the output. When the AI recommends declining an application, the interface should surface which of the system’s core purposes drove that recommendation: is this a credit risk concern, a compliance flag, or something the model cannot categorise cleanly?

    Questions to ask about your deployment:

    • What are the two or three values this system is genuinely optimised for?
    • What values are in tension, and does the interface make those tensions visible?
    • When the AI’s recommendation conflicts with a user’s instinct, does the interface help the user understand why?

    Level 2: What principles govern how the system operates?

    This is the question of abstract function: the rules, regulations, and governing principles that constrain what the system can and cannot do. In aviation, these are physics and safety regulations. In lending, they are responsible lending laws, anti-discrimination regulations, internal credit policy, and audit requirements.

    These constraints do not change with each transaction. They define the boundaries within which all decisions must fall. The problem is that most AI interfaces present outputs as though these constraints do not exist. The model returns a score. The interface shows the output metric. The loan officer is left to remember, from training, which regulatory constraints apply in this situation.

    What this means for your interface: Regulatory and policy constraints should be structurally present in the interface, not stored in the user’s head. If the AI’s recommendation would require a manual review under responsible lending obligations, the interface should flag that requirement automatically. If the model’s confidence falls below a threshold that your compliance team’s internal policy requires to be reviewed, show that threshold, and ideally the policy, visibly.

    This is the principle that Vicente and Rasmussen called Ecological Interface Design (EID): the constraints of the work domain should be visible in the interface itself, not stored in the user’s memory. An EID-informed loan interface does not require the loan officer to remember the regulatory rulebook. It makes the rulebook structurally visible in the decision flow.

    Questions to ask about your deployment:

    • Which regulatory obligations apply to the decisions this AI supports?
    • Are those obligations visible in the interface, or do users have to remember them independently?
    • When the AI’s recommendation sits in a regulatory grey zone, does the interface make that visible?

    Level 3: What processes does the system need to perform?

    This is the question of generalised function: the operational processes and workflows that need to happen for the system to achieve its purpose within its constraints.

    In a loan context, this includes the steps of gathering applicant data, running the credit model, checking for compliance flags, presenting a recommendation, capturing the loan officer’s decision and rationale, escalating edge cases, and creating an audit trail. These processes are not all equally visible in most AI deployments. Typically, what is visible is the output of the model. The processes that produced it, and the processes that need to follow from it, are hidden or scattered across different systems.

    What this means for your interface: The interface should reflect the full process, not just the model’s output. If the correct process requires a loan officer to review the AI’s recommendation alongside the applicant’s supporting documents before deciding, the interface should make that sequence natural and difficult to skip. If the process requires capturing the officer’s reasoning when overriding the AI, the interface should prompt for that reasoning at the point of override, not as a retrospective form filed later.

    This is also where structured input design matters. If you want the AI to produce consistent, auditable outputs, you need the interface to guide consistent, structured inputs. A free-text prompt box for a loan officer to query the AI is the wrong design. A structured form that constructs the query from validated fields, treating the prompt as a template and the user’s input as variables, produces far better consistent results and a far cleaner audit trail.

    Questions to ask about your deployment:

    • What is the full sequence of steps the process requires, including before and after the AI’s output?
    • Does the interface make the correct sequence the natural path, or can users shortcut it?
    • How does the interface capture the human’s reasoning, not just the AI’s recommendation?

    Level 4: What are the capabilities and limits of each component?

    This is the question of physical function: what each component of the system can and cannot do. For an AI, this means understanding the model’s actual capability boundaries. Where does it perform well? Where does it degrade? What kinds of inputs push it outside its training distribution?

    Loan officers who use AI tools daily develop intuitions about where the model is reliable and where it is not. New officers do not have those intuitions, and even experienced officers can be misled when the model presents its outputs with uniform visual confidence regardless of whether it is in familiar or unfamiliar territory.

    What this means for your interface: The interface must distinguish between high-confidence and low-confidence outputs, and it must do so in a way that reflects the model’s actual calibration, not a standardised disclaimer. If the AI is recommending approval on an application that combines features it has rarely seen together, that uncertainty should be visible. If the model’s confidence score is below a meaningful threshold, the interface should communicate that clearly and differently from high-confidence outputs, not with a footnote, but with a structural difference in how the recommendation is presented.

    This is what the CSE literature calls making the AI’s epistemics visible: the interface should show not just what the AI concluded, but how firmly it concluded it and on what basis.

    Questions to ask about your deployment:

    • Does the interface distinguish between high-confidence and low-confidence recommendations?
    • Can users tell when the AI is operating in territory close to the edge of its training?
    • What happens when the AI encounters an input type it was not trained on?

    Level 5: What is the actual configuration of the system?

    This is the question of physical form: the literal layout, controls, and information architecture of the interface as it exists on the screen.

    This is where most interface design effort is spent and also the level where most AI interface problems are most visible: the designer burying a recommendation at the bottom of a long screen, the confidence score presented in a font smaller than the surrounding data, or the override button placed three clicks away. These are not aesthetic problems but decision quality problems.

    If the most important signal the AI is sending is that it is uncertain about this application, and the interface makes that signal hard to find, the loan officer will miss it. That is design failure, not a training failure.

    What this means for your interface: The visual hierarchy of the interface should reflect the information hierarchy of the decision. The AI’s recommendation and its confidence level should be visually prominent. Flags and caveats should not be hidden in tooltips. The action the interface makes easiest should be the action the process intends to be most common. The action that requires more care, like an override of the AI’s recommendation, should require commensurate effort in the interface: not so much effort that it becomes a workaround, but enough that it cannot happen accidentally.

    Questions to ask about your deployment:

    • Does the visual hierarchy of the interface match the decision hierarchy?
    • Is the AI’s uncertainty as visible as the AI’s recommendation?
    • What is the path of least resistance in the interface, and is that the right path?

    What Happens When You Skip This Analysis

    The most common failure mode is not that the AI model is wrong but that the interface makes it impossible to know when the model is wrong.

    People in high-stakes roles learn quickly. If an AI interface presents confident-sounding recommendations without surfacing the model’s reasoning or uncertainty, they will test it against their own judgement for a few weeks, find cases where it was clearly wrong, and start treating all its outputs with blanket scepticism. The AI becomes a checkbox, not a collaborator. The organisation has paid for a decision-support system and deployed a bureaucratic step.

    The second failure mode is the reverse: people defer to the AI when they should not, because the interface presents its outputs with more authority than the model’s actual confidence warrants. This produces decisions that look considered but are indefensible when scrutinised: by regulators, auditors, customers, or a board asking why something went wrong.

    Both failures are interface failures. The model may be performing exactly as designed. The interface is simply not communicating what the model knows and does not know.

    Where to Start

    You do not need to redesign your entire interface before launch. You need to run through these five levels with the people who will use the system and the people responsible for the process it supports.

    Bring three groups into a room: the people who will use the AI day to day, the people who own the process it sits inside, and whoever is accountable for risk or compliance in that domain. Walk through the five levels as questions. At each level, ask: what does the interface currently show, and what does this analysis say it needs to show? The gaps between those two answers are your design priorities.

    Pay particular attention to Levels 1 and 4. Purpose misalignment (Level 1) and invisible uncertainty (Level 4) are the two most dangerous gaps, and they are the two most commonly overlooked in AI deployments focused on model performance rather than interface design.

    The Abstraction Hierarchy was originally developed to allow human operators to make complex, safety-critical decisions under pressure. Whether your AI is supporting credit decisions, clinical triage, fraud detection, or operational planning, the underlying challenge is the same: consequential, often regulated decisions where the interface either helps people reason well or quietly gets in the way.

    Your AI model does not make decisions. The human-AI system makes decisions. The interface is what makes that system work so design it accordingly.


    References

    [1] E. Hollnagel and D. D. Woods, “Cognitive systems engineering: New wine in new bottles,” International Journal of Man-Machine Studies, vol. 18, pp. 583–600, 1983.

    [2] K. J. Vicente and J. Rasmussen, “Ecological interface design: Theoretical foundations,” IEEE Transactions on Systems, Man, and Cybernetics, vol. 22, no. 4, pp. 589–606, 1992.

  • Is Your AI a Tool, a Colleague, or an Authority?

    Something happens the moment your organisation settles on a word for what AI is. A design philosophy clicks into place and governance questions answer themselves. Oversight feels obviously necessary, or it feels obviously unnecessary. Most of the time, no one in the room notices this happening.

    The words are not a label but a mental frame that imports an entire domain of human experience, complete with its own logic about agency, control, and responsibility. The linguist George Lakoff calls this a conceptual metaphor: we don’t merely describe experience through metaphor, we think through it. The frame structures what feels like common sense, and what feels like common sense rarely gets examined.

    When your organisation calls AI a tool, you are not describing a deployment approach alone. You are importing the complete conceptual logic of tool use, and that logic will quietly answer a hundred design and governance questions before anyone thinks to ask them explicitly.

    Tool: The Human Is the Only Agent in the Room

    A tool has no agency. A hammer doesn’t decide where it lands, a calculator doesn’t choose what to calculate. When a hammer hits the wrong nail, no one convenes a review of the hammer. The logic flows in one direction: the user holds all intention and bears all responsibility.

    Under the tool metaphor, this feels like common sense. The design imperative is a high-control interface that keeps the human firmly in command, and oversight infrastructure feels redundant in the same way you would never audit your word processor. If the AI produces wrong output, the frame says it’s a user problem: either the instructions were wrong, or the output wasn’t checked carefully enough.

    The metaphor works well when it accurately describes what the system does. Grammar checkers, data analysis dashboards, and coding assistants genuinely behave like sophisticated tools. The user directs and the tool responds.

    The metaphor breaks when it’s applied to systems that exercise something resembling judgement. AI that screens job applications, assesses loan risk, or makes triage recommendations is not behaving like a hammer. It generates outputs the user didn’t specify, based on patterns the user didn’t choose. When those outputs are wrong, the tool metaphor offers no mechanism for catching errors and no conceptual language for asking why. The frame has already answered that question: user error.

    Peer: The Machine Gets a Voice

    The colleague or co-pilot metaphor imports a different logic entirely. Colleagues have agency, offer opinions you didn’t ask for, and can be wrong while remaining entirely confident. You expect them to explain their reasoning, and if they can’t, you trust the recommendation less.

    This is a more honest metaphor for how AI behaves in many deployments. Fraud detection systems that flag anomalies for human review, content systems that propose and revise, diagnostic tools that suggest rather than decide: these are genuine collaborations where both parties contribute and neither is simply executing the other’s instructions.

    The peer metaphor makes explainability feel natural because of course you want the AI to show its work, of course a human reviews before acting. Shared responsibility follows from how we think about working alongside colleagues: you don’t fully outsource your judgement to someone else, no matter how capable they appear.

    What this metaphor hides is an asymmetry of confidence. A human colleague who doesn’t know something usually knows they don’t know, whereas AI can be wrong with complete conviction and no visible hesitation. The peer frame can lead people to extend more trust than the relationship warrants, precisely because the metaphor makes trust feel appropriate.

    Authority: The System Decides, Humans Comply

    When AI replaces a human process entirely, a different metaphor tends to take hold, often without being named: the system as authority, processing, deciding, and acting while humans monitor the results.

    The authority metaphor imports from the domain of institutional rules and procedures, where rules are correct by definition and the system knows best. Challenging the output feels like questioning the process itself, which feels obstructive rather than responsible. When the system flags something, people act on the flag. When it doesn’t, people don’t look further.

    This is not inherently dangerous, for example automated invoice processing and robotic process automation handle large volumes of low-stakes work effectively, and the authority metaphor fits those applications well.

    The problem arrives when it’s applied to high-stakes decisions and the system’s reliability is treated as given rather than tested. Automated hiring decisions, credit scoring, and content moderation all operate under this logic. The system makes the call, and human judgement enters only at the edges. The conceptual frame makes this feel like efficiency. The practical consequence is that errors encoded into the system become very hard to see, and harder still to challenge, because the authority metaphor has already told everyone that challenging the system is not their role.

    The Frame You Don’t Examine Is the One That Governs You

    Any of these frames can be appropriate when it accurately describes what the system does: the tool approach for systems the user genuinely directs, the peer model for genuine collaboration, and the authority model for high-volume, low-stakes processes with clear oversight in place.

    Failures accumulate when the metaphor doesn’t match the reality, and no one has named the mismatch. Fpr example. an authority-level system governed by tool-level assumptions, a peer-level AI trusted like a colleague long before it has earned that trust, or a replacement system with no escalation path because, conceptually, there is nothing to escalate from.

    These are not governance failures in the conventional sense so much as failures of conceptual clarity: the organisation built what it thought it was building, solving the problems it thought it was solving, but hadn’t examined the underlying assumptions.

    Naming the Metaphor Is the First Act of Governance

    Before asking what guardrails your AI needs, ask what your organisation believes it is at the level of operating assumption, not at the level of documentation.

    The questions below are designed to surface the operating metaphor. What they reveal is not always what the answer says: often it is what the answer assumes, or what the question itself appears to disturb.

    Who is responsible when the AI gets it wrong?

    The tool frame answers quickly: the person who used it. The peer frame identifies whoever reviewed the output before it was actioned. The authority frame produces something else: confusion, a redirect to IT or the vendor, or a long pause followed by “that hasn’t really come up”.

    The reaction worth noting is impatience. “Obviously the user” said with certainty is itself diagnostic when the system is making decisions the user never specified.

    What happens when someone disagrees with an AI output?

    This question separates the existence of a mechanism from the existence of permission. In a tool frame, no formal process is needed: the user simply doesn’t act on the output. With a peer frame, disagreement has a path: escalation, review, documentation, and move on. In an authority frame, the question often produces a category error. Disagreement is routed to a technical team rather than a domain expert, because the operating assumption is that the output is a system output, not a decision subject to challenge.

    The tell is when the question appears to confuse process with permission. “Anyone can disagree” is not a mechanism.

    How would you know if the AI started getting things wrong?

    The tool frame assumes the user would notice immediately. The peer frame has monitoring, defined thresholds, and review cycles. The authority frame tends to produce the longest pause of any question on this list, followed by “we’d get complaints” or “the vendor monitors that”.

    “We’d get complaints” means the error detection mechanism is your customers.

    Can the AI explain why it produced that output, and does anyone ask it to?

    The first half of this question is technical and the second half is cultural. Systems that are capable of explanation but where no one has ever requested one reveal the operating assumption as clearly as any governance document. In a tool frame, explanation feels unnecessary or obvious. With a peer frame, it is routine and integrated into the process. In an authority frame, the capability may exist in a dashboard somewhere that no one opens. If the honest answer is “I’m not sure anyone has”, that is the operating metaphor speaking.

    What’s the reason for that answer? Is the standard followup question to answers, following the ‘Five whys’ format.

    The point is not which metaphor is correct in the abstract, but whether the one in use was chosen deliberately rather than inherited by default and made explicit to everyone. The frame you pick will make certain things feel like common sense. Make sure those are the things you want to feel natural.


    References

    [1] Lakoff, G., & Johnson, M. (1980). Metaphors We Live By. University of Chicago Press.

  • What Bunnings and a Face Scanner Taught Australian Businesses About Privacy

    Most organisations deploying AI-powered technology assume the hard part is the technology. The Bunnings case shows the hard part is the governance.

    Between November 2018 and November 2021, Bunnings installed facial recognition technology (FRT) in a number of its Australian and New Zealand stores. The system captured the face of every person who walked through the door, compared it against a database of individuals previously involved in criminal conduct or incidents involving staff, and alerted store employees when it found a match. The facial data itself was deleted in milliseconds. Nobody was told it was happening.

    That decision triggered a regulatory investigation that took six years to resolve, a determination by the Privacy Commissioner, an appeal to the Administrative Review Tribunal, and a still-open question about whether the matter ends there. The legal outcome was mixed, but the compliance lessons are not.

    The Regulator Found Bunnings Collected Biometric Data, Whether It Knew It or Not

    On 29 October 2024, Privacy Commissioner Carly Kind found that Bunnings had breached several Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). The breaches related to transparency, collection, and notification. In the Commissioner’s view, FRT was a highly privacy-invasive tool that interfered disproportionately with the privacy of all store entrants, not just the small number of people it was designed to identify.

    Bunnings appealed and on 4 February 2026, the Administrative Review Tribunal (ART) partially set aside the determination and upheld the findings that Bunnings breached APP 1 (transparent management of personal information) and APP 5 (notification of collection). It overturned the finding on APP 3 (collection of sensitive information without consent).

    The APP 3 decision turned on a specific provision. Under section 16A of the Privacy Act, an organisation can collect sensitive information without consent when obtaining that consent would be unreasonable or impracticable, and when the collection is reasonably necessary to prevent a serious threat to the life, health, or safety of any individual or to public health or safety. The Tribunal accepted that Bunnings faced genuine and serious threats, noting the scale of retail crime, the nature of incidents involving staff and customers, and the fact that many products in a Bunnings store can be used as a weapon. On those facts, the Tribunal found FRT to be a reasonable and proportionate response.

    The Privacy Commissioner subsequently confirmed she would not appeal the Tribunal’s decision.

    The Tribunal was explicit on that this outcome is not a green light for biometric deployment, but is a fact-specific finding about a specific organisation facing specific threats, with specific controls in place. Other organisations attempting to rely on the same reasoning without equivalent circumstances will likely find the exception does not apply to them.

    The Breaches Upheld Tell the More Useful Story

    Bunnings succeeded on the consent question but did not succeed on governance, and that distinction matters more for most organisations thinking about where their own exposure sits.

    “Milliseconds” Is Not a Defence Against Collection

    Bunnings argued that because the facial matching process occurred in RAM and the data was deleted in milliseconds, it had not technically “collected” personal information. The Tribunal rejected this.

    The Tribunal found that Bunnings collected facial images captured by CCTV cameras, that those images constituted biometric information, and that biometric information is sensitive information under the Privacy Act, regardless of how briefly it was held. The legal threshold for collection is low. If your system processes personal information, even in real time, even transiently, you have collected it, and privacy obligations follow.

    This matters beyond FRT. Any organisation using automated systems that touch personal information, including AI tools processing voice, images, location, or behavioural data, should assume collection is occurring and govern accordingly.

    A Sign on the Door Is Not Enough When You Are Taking Someone’s Face

    Bunnings had posted privacy notices at store entry points. The Tribunal found this insufficient.

    The Tribunal’s reasoning was that given the sensitive nature of biometric data, the size of Bunnings as an organisation, and the resources available to it, more was required. Customers needed to know the specific type of information being collected, the technology being used, the purposes behind collection, and what happened if they chose not to provide it.

    Generic privacy policies are written to cover everything. Biometric collection requires notices written to cover that specific thing. When the information being collected is sensitive, specificity is required.

    The Absence of a Documented Risk Assessment is Treated as a Governance Failure

    This is the finding with the broadest application.

    APP 1.2 requires organisations to take reasonable steps to implement practices, procedures, and systems that ensure compliance with the APPs. The Tribunal found that Bunnings failed to meet this standard. The steps taken prior to deployment were described as “random enquiries and actions”. No formal, structured, and documented privacy risk assessment had been conducted before the FRT system went live.

    The Tribunal’s language is deliberate. When an organisation collects sensitive information, it faces a serious intrusion of privacy. Serious intrusions require formal responses, not ad hoc ones. A Privacy Impact Assessment (PIA) conducted before deployment, documented, and retained, is what reasonable steps look like in this context.

    The compliance lesson here goes beyond privacy. Regulators across multiple domains, including privacy, cybersecurity, and financial services, are increasingly focused on whether organisations can demonstrate that their governance preceded their deployment decisions, not followed them. If the PIA exists only after a complaint is made, it does not count.

    The Regulatory Environment Around This Decision Has Changed

    The Bunnings case was decided under the existing Privacy Act 1988 framework. That framework is now amended.

    The Privacy and Other Legislation Amendment Act 2024 (Cth), which received royal assent in December 2024, introduced changes that take effect progressively through 2026. Three are particularly relevant to organisations using AI or data-intensive technologies.

    The definition of personal information now explicitly covers inferred or generated data, such as the outputs of machine learning models. AI generating risk scores, predicted preferences, and behavioural classifications are now personal information for the purposes of the APPs. Organisations that assumed model outputs sat outside the Act’s reach need to revisit that assumption.

    From December 2026, organisations must disclose in their privacy policies when personal information is used in substantially automated decision-making that has significant effects on individuals. This requires organisations to audit existing systems now, identify where automated decisions are being made, what professional function they perform, and build disclosure workflows before the obligation takes effect.

    A Children’s Online Privacy Code is being developed, with registration expected by December 2026. Organisations whose services are likely to be accessed by minors face heightened obligations and need to begin preparing ahead of the code’s commencement.

    A further reform expected in the second tranche of amendments is a general “fair and reasonable” test for the collection, use, and disclosure of personal information. If introduced, this would shift the compliance question from whether a notice is given to whether the underlying practice can withstand objective scrutiny. An AI system that targets individuals based on inferred sensitive characteristics, or that generates unexpected outcomes from opaque models, may fail that test regardless of what the privacy policy says.

    What Organisations Should Do Now

    The Bunnings case illustrates a familiar pattern. The organisation deployed the technology first and worked out the governance as concerns arose. That sequence creates risk, and the regulatory direction of travel is toward holding organisations accountable for the order in which they do things.

    The following steps address the specific failure modes the Tribunal identified.

    Conduct a Privacy Impact Assessment before deployment, not after. For any system that collects sensitive information, a formal, structured, and documented PIA is what APP 1.2 compliance looks like. This assessment should identify the risks, document the controls, and record who made the decisions and why, and should exist before the system goes live.

    Write specific notices for specific technologies. If your organisation uses FRT, AI-powered monitoring, or any other tool that collects biometric, health, or other sensitive information, the privacy notice for that collection needs to name the technology, describe what is collected, state the purpose, and explain the consequences of not providing the information. Generic notices covering all data collection are not adequate for high-risk processing.

    Audit your systems for the amended definition of personal information. AI model outputs, including risk scores, classifications, and generated assessments, now sit within the Act’s scope. Organisations using AI tools that generate outputs about individuals should review how those outputs are managed, retained, disclosed, and corrected.

    Map automated decisions and prepare for disclosure. Identify where your organisation uses personal information in automated or substantially automated decision-making with significant effects. Build the workflows and policy language needed to disclose this before December 2026.

    Maintain records of AI-assisted decisions. Accountability under the APPs requires being able to demonstrate what decisions were made, on what basis, and with what human oversight. If that record does not exist, accountability cannot be demonstrated.

    The Bunnings outcome is sometimes framed as a partial win for business. In a narrow legal sense, that is accurate. On the question of governance, Bunnings did not win and was found to have deployed an invasive technology without adequate transparency, without specific notification, and without a documented risk assessment. Those findings were not overturned.

    The compliance clock started the moment the technology was deployed. For organisations considering similar decisions, it starts now.

  • Ethical AI Needs a Scoreboard

    Most organisations deploying AI today have no idea whether their systems are behaving ethically. They might be able to tell you the model’s accuracy. They can tell you its latency. What they cannot tell you is whether it’s treating people fairly, whether it can be trusted, or whether it’s quietly generating harm at scale.

    This is a governance problem, a legal problem, and increasingly a commercial one.

    As AI systems move into healthcare decisions, financial approvals, and public administration, the demand for rigorous ethical evaluation has outpaced the tools available to deliver it. The core metrics organisations use to evaluate ethical AI performance are Trust Scores, Fairness Metrics, Transparency Indices, and Safety Violations Counts. Understanding what each measures, and what it misses, is the first step toward building AI you can actually defend.

    Trust Scores: Make Ethical Behaviour Auditable

    A trust score is a composite, quantitative measure of an AI system’s reliability, safety, and ethical compliance. Rather than reducing system performance to a single output quality measure, a well-constructed trust score aggregates multiple dimensions of behaviour, including bias, security, compliance, and user feedback, into a unified metric.

    The practical value is that trust becomes auditable. Frameworks such as the NIST AI Risk Management Framework and XenonStack’s AI Trust Score treat continuous monitoring as essential to maintaining score accuracy. When a model frequently generates outputs that require human moderation, or when user feedback signals that the system is unsafe or unhelpful, the trust score declines. That decline is the signal to act.

    By establishing baseline trust scores and tracking them over time, organisations can identify whether a system’s ethical integrity is improving or degrading, before a regulator or a court makes that determination for them.

    Fairness Metrics: Equity Is Not a Single Number

    Fairness is one of the most researched areas in AI ethics and one of the most mathematically contentious. The central challenge is that mathematical definitions of fairness frequently conflict. Satisfying one often makes another impossible.

    Fairness evaluation falls broadly into two categories: group fairness and individual fairness. Group fairness ensures equitable outcomes across demographic groups, including race, gender, age, and other protected characteristics. Individual fairness requires that similar individuals receive similar treatment, regardless of their demographic background.

    The four most common group fairness metrics each serve distinct purposes:

    MetricDefinitionPrimary Use Case
    Demographic ParityEqual selection rates across all demographic groupsHiring algorithms, loan approvals
    Equal OpportunityEqual true positive rates across demographic groupsMedical diagnoses, fraud detection
    Equalised OddsEqual true positive and false positive rates across groupsCriminal justice risk assessments
    Counterfactual FairnessOutcome unchanged if a protected attribute is alteredIndividualised pricing, insurance premiums

    These metrics cannot all be satisfied simultaneously. Research published in AI & Society has formalised this, demonstrating that optimising for one fairness criterion typically degrades another. This is not a failure of measurement, but a reflection of genuine ethical complexity.

    Organisations must therefore choose the metrics that best match their use case and ethical commitments, clearly document their choice and reasoning, then conduct regular bias audits throughout the AI system’s operating life.

    Transparency Indices: Opacity Is a Risk You Cannot Manage

    Transparency is the precondition for accountability. Without it, users cannot assess risk, regulators cannot audit compliance, and organisations cannot identify where their systems are failing.

    A Transparency Index measures both how explainable a system’s outputs are and how openly an organisation discloses information about its model’s development and deployment. Technical explainability covers feature importance scores and model complexity. Process documentation covers model cards, datasheets, and disclosures about training data, compute resources, and labour practices.

    The Foundation Model Transparency Index (FMTI), developed by researchers at Stanford, Berkeley, Princeton, and MIT, provides the most rigorous publicly available standard. It uses 100 indicators across three domains, upstream resources, model properties, and downstream impact, to benchmark major foundation model developers against each other.

    The findings should concern any organisation that assumes the industry is moving in the right direction. When the FMTI launched in October 2023, the average score across ten major AI developers was 37 out of 100. By May 2024, this had improved to 58, driven largely by developers submitting proactive transparency reports for the first time. The 2025 edition reversed the trend: the average score fell back to 40 out of 100, with individual companies declining sharply. Meta’s score dropped from 60 to 31. Mistral’s fell from 55 to 18. It is worth noting that the 2025 edition updated its indicators to reflect changes in AI development practices, which researchers caution makes direct comparisons to prior years imprecise.

    Transparency is declining at the moment when the stakes of opacity are rising. For organisations that rely on foundation models from these developers, the opacity of the underlying system limits their ability to govern what they deploy.

    Safety Violations Count: What Gets Tracked Gets Managed

    The Safety Violations Count is a direct measure of how often an AI system fails to behave safely. It tracks instances of inappropriate, biased, or dangerous outputs, providing a concrete picture of operational safety rather than a theoretical one.

    The key indicators within this category are moderation frequency and escalation rate. Moderation frequency measures how often outputs are flagged or blocked by automated safety filters. Escalation rate tracks how often outputs require human review due to potential harm. Both metrics, when tracked consistently, reveal patterns that no single incident report can.

    A third dimension matters: adversarial robustness. This measures how well the system resists deliberate attempts to bypass safety controls, including so-called “jailbreaking” attempts and malicious prompts engineered to circumvent guardrails. A system that behaves safely under normal conditions but fails predictably under adversarial conditions is not a safe system, but a safe-looking system with a discoverable weakness.

    Continuous monitoring of the Safety Violations Count is a compliance tool and how organisations find the vulnerabilities in their models before someone else does.

    The Retention vs. Compliance Trade-Off: There Is No Easy Setting

    Every organisation deploying AI eventually encounters this tension: the stricter the safety controls, the more often the system refuses to answer, adds caveats, or deflects queries. That behaviour frustrates users and frustrated users leave.

    The inverse is equally true. Relaxing safety filters improves user experience, until it doesn’t. Safety violations expose organisations to reputational damage, legal liability, and regulatory intervention. The cost of a single high-profile failure can exceed years of engagement gains.

    This trade-off does not have an obvious optimum. The goal is not to maximise safety at the expense of utility, nor to maximise utility at the expense of safety. The goal is to find the point where safety is as high as possible without degrading the system’s usefulness below the threshold at which users stop finding it valuable. Researchers call this the “Pareto frontier”.

    Getting there requires moving beyond pass/fail metrics. Organisations increasingly use Key Ethics Indicators (KEIs), composite measures that capture how ethical constraints interact with user experience outcomes, to make this trade-off visible and manageable. Without that visibility, decisions about safety and retention are made implicitly by whoever controls the settings, with no way to know if the changes produce the expected result. With it, those decisions can be made deliberately.

    Measure It or Lose Control of It

    The deployment of ethical AI is not a one-time design decision. It is an ongoing measurement discipline.

    Trust Scores, Fairness Metrics, Transparency Indices, and Safety Violations Counts each capture a different dimension of how a system behaves in the world. No single metric is sufficient. Together, they create the visibility organisations need to govern what they deploy.

    The organisations that will navigate AI governance well are the ones that know what those models are actually doing, and have built the measurement infrastructure to act when the answer is not what they expected.

  • AI Introduces New Risk Terrain. You Already Have a Map.

    Most organisations deploying AI already have risk management processes that work. Enterprise risk frameworks, compliance programs, audit cycles, three lines of defence. What they don’t have is a clear way to govern something genuinely new.

    Not new in the sense of unfamiliar process or regulation. New in the sense that the failure modes don’t always look like failure until after the fact. A model that produces biased outputs does so quietly, at scale, with no error log. A third-party AI system can introduce exposure through its training data, not only its integration points. These are risk problems that just don’t surface the usual way.

    The temptation is to build dedicated AI governance structures alongside existing ones. A separate AI risk register. A bespoke framework standing apart from everything else.

    That approach tends to fail, not because the intent is wrong, but because it creates a parallel process that nobody owns. The people who understand AI risk (data scientists, engineers) sit outside the new structure. The people who run risk (compliance, audit, legal) don’t have the technical fluency to govern it. The framework becomes a documentation exercise.

    There is a better path: extend what you already have.

    This guide outlines how to embed AI-specific risk checkpoints into existing risk management processes across three phases; development, deployment, and production.

    The Core Principle: Extend, Don’t Duplicate

    Your existing enterprise risk management program already handles model uncertainty, third-party risk, data governance, and regulatory compliance. AI introduces new variations on each of these: model drift instead of model change, algorithmic bias instead of human error, explainability gaps instead of audit trail gaps. The underlying risk categories are familiar. What’s new is where to look for them, how quickly they can materialise, and how they interact with each other.

    One difference that does require a structural adjustment is monitoring cadence. AI systems are not static. A model validated at deployment will behave differently as real-world data diverges from training data, as usage patterns shift, or as the model is fine-tuned over time. Periodic review cycles that work well for stable systems are a poor match for that rate of change. Continuous monitoring, with clear alert thresholds and defined response triggers, is the appropriate equivalent, and it belongs inside your existing operational risk program, not in a separate process.

    Checkpoints Across the AI Lifecycle

    Development: Apply Controls Before They Cost More

    Risk controls applied at the start of development are far cheaper than those applied after deployment.

    Inventory and classification. Establish a register for every AI model in use, covering its purpose, training data sources, performance benchmarks, and risk tier. The register needs to cover third-party and embedded models, not only those built in-house, and it needs to be maintained as models evolve.

    Threat modelling. Standard threat modelling in software development focuses on system access and data exposure. AI adds two categories: model behaviour risks (such as susceptibility to prompt injection, where a malicious input manipulates the model’s output) and training data risks (such as poisoning, where corrupted data degrades model performance). Both require explicit scenario testing.

    Third-party model assessment. Third-party AI model assessment belongs inside existing supplier risk processes, not alongside them. The criteria differ from standard software: vulnerability and bias assessments, training data provenance, and licensing terms all need to be part of the standard supplier questionnaire for any AI component. Supplier security attestations and independent bias testing are the baseline.

    Data provenance documentation. The traceability requirements for AI training and fine-tuning datasets are analogous to chain-of-custody requirements elsewhere in risk and compliance. Collection methods, licensing terms, usage history, and any known quality issues should be documented before a model moves forward. This documentation is what makes a bias incident investigable after the fact.

    Secure development practices. AI-assisted code generation introduces two specific exposures that standard development controls don’t catch well: insecure patterns that context-unaware static analysis tools miss, and credentials committed through AI-assisted workflows. Context-aware static application security testing and automated secrets detection in CI/CD pipelines address both. Human review of AI-generated code before it progresses is a control, not a formality.

    Deployment: Test for AI-Specific Failure Modes

    Standard pre-deployment testing checks whether a system does what it’s supposed to do. AI deployment testing must also check how a system fails and whether it can be manipulated.

    Adversarial testing. Simulate attacks on model behaviour: malicious prompts, crafted adversarial inputs, stress conditions. The objective is to find the boundaries of the model’s guardrails before someone with harmful intent does.

    Access control validation. AI agents operating with system permissions require particular scrutiny. Test whether agents can escalate privileges beyond their intended scope by simulating compromised credentials. Role-based access controls need to be verified against the model’s actual behaviour, not just its configuration.

    Deployment gates. Real-time risk scoring integrated into your CI/CD pipeline allows deployments that exceed defined risk thresholds to be blocked automatically. Container and infrastructure scanning ensures the environment the model is deployed into is as secure as the model itself.

    Production: Oversight That Matches the Pace of Change

    A model that passes deployment testing is not a model that stays safe. Production is where risk management becomes an ongoing discipline.

    Continuous monitoring. Production monitoring for AI should track performance, fairness metrics, and security indicators in real time, with alert thresholds defined for model drift, anomalous output patterns, and unusual usage. The monitoring framework is familiar. The metrics being tracked are what needs to be extended.

    AI-specific incident response. Existing incident response plans cover system failures and security breaches. AI introduces failure modes that require their own response procedures: biased outputs propagating at scale, hallucinations in customer-facing applications, or agentic systems taking unintended actions. These scenarios need defined containment steps, clear escalation paths, and remediation procedures that are tested before they’re needed.

    Post-incident learning. A single AI incident should trigger a review of the systems and controls that allowed it. The same incident happening twice means the review didn’t produce change. Build post-incident reviews into your AI governance cycle and track whether policy updates are actually implemented. One mistake is the message to improve the system. Two of the same mistakes means the system hasn’t changed.

    Regulatory tracking. The regulatory landscape for AI is moving quickly. The EU AI Act, ISO 42001, and sector-specific guidance from financial and healthcare regulators are all active and developing. Monitoring this landscape belongs inside existing regulatory tracking processes, with the same ongoing attention applied to other evolving obligations.

    Using the NIST AI RMF as a Foundation

    The NIST AI Risk Management Framework provides a structured approach for managing AI risk across the lifecycle. Its core is four functions (Govern, Map, Measure, and Manage) designed to operate as a continuous cycle, not a sequential checklist.

    Govern is the cross-cutting function at the centre of the framework. It addresses organisational risk culture, accountability structures, and AI-related policies. It answers the questions: who approves high-risk AI deployments, how are third-party models introduced, and how are resources allocated for safety testing.

    Map focuses on understanding the AI system’s context, scope, and potential harms before decisions are made. After completing the Map function, organisations should have enough information to make an initial go or no-go decision about whether to proceed with a given AI system.

    Measure covers assessing identified risks through a combination of quantitative and qualitative methods, evaluating performance, fairness, transparency, and security.

    Manage addresses risk response: implementing controls, prioritising mitigations, and planning for incidents.

    The framework is voluntary and deliberately flexible. Organisations customise it through profiles that reflect their specific context, regulatory environment, and risk appetite. If you already operate ISO 27001, SOC 2, or the NIST Cybersecurity Framework, treat the AI RMF as an overlay. Map your existing controls to the Govern and Manage functions first, then add AI-specific requirements where Map and Measure reveal gaps.

    Start With Visibility

    Before you can extend your existing controls, you need to know what you’re governing.

    A practical starting point is the model inventory. Visibility across all AI in use, including models embedded in third-party software, is the prerequisite for everything else. Without it, you can’t apply risk tiers, assess suppliers, or set meaningful monitoring thresholds.

    From that foundation, existing frameworks can be extended systematically: AI criteria into model risk policy, third-party assessment processes, incident response plans, and operational monitoring programs.

    The risk controls that will protect your organisation are the ones embedded into processes people already follow, owned by people who already have accountability. That’s the existing risk function. The scope has changed. The structure doesn’t need to.

  • API vs. Local LLMs: The Cost, Privacy, and Security trade-off

    The AI landscape has handed enterprises a genuinely difficult architectural question: do you call a vendor API (OpenAI, Anthropic, Google), or do you self-host an open-weight model (Llama 3, Mistral, Qwen)?

    This is not a question of convenience. It touches data privacy, compliance obligations, long-term economics, and how much operational risk you’re willing to carry. The right answer varies by organisation. This guide maps the trade-offs so you can make the call with clarity.

    Data Privacy, Security, and Compliance: Where the Decision Often Starts

    For many enterprises, data sovereignty ends the conversation early.

    When you call a vendor API, your prompts and data travel to a third-party server. Even with enterprise agreements that prohibit training on your inputs, the data physically leaves your network. For healthcare, financial services, and government, that exposure creates real legal and compliance risk.

    A self-hosted model eliminates that exposure entirely. Prompts stay inside your infrastructure making compliance audits simpler and intellectual property does not pass through external systems.

    If your data classification policies, regulatory obligations, or legal counsel would flag external data transmission as a problem, self-hosting is the baseline requirement.

    Cost: The Maths Depends on How Much You Use It

    The cost comparison between vendor APIs and self-hosted models is heavily dependent on utilisation rates.

    Vendor APIs charge per token. That structure works well for prototyping, low-volume applications, and irregular usage. You pay for what you consume and carry no idle infrastructure costs.

    Self-hosting flips the model. You pay for compute uptime, not token generation. Costs are fixed and predictable, regardless of whether the model is processing requests or sitting idle.

    Cost FactorVendor API (e.g., OpenAI)Self-Hosted (e.g., Llama 3)
    Pricing ModelUsage-based (per token)Time-based (per hour of compute or power use)
    Upfront InvestmentZero to minimalHigh (cloud instance setup or hardware purchase)
    PredictabilityVariable, scales with usageFixed, predictable monthly infrastructure costs
    High Utilisation CostExpensive at scaleHighly cost-effective
    Low Utilisation CostVery cheapExpensive (paying for idle compute)

    The crossover point is utilisation. High, continuous workloads favour self-hosting because the fixed cost per token drops as throughput increases. Sporadic or unpredictable workloads favour vendor APIs as you avoid paying for idle capacity.

    Self-hosting also provides protection against vendor price changes and model deprecations, which add a different kind of cost: the engineering time to migrate when a vendor discontinues a model you’ve built on.

    Uptime, Maintenance, and Operational Burden

    Vendor APIs abstract away the infrastructure entirely. The provider manages scaling, load balancing, hardware failures, and security patching. Your team consumes a service.

    Self-hosting transfers that burden internally. Running a production-grade LLM requires people who can manage GPU memory constraints, configure inference servers (such as vLLM or Ollama), handle hardware failures, and maintain network security. If you don’t have that capability today, building it takes time and money.

    Speed is also a practical consideration. Vendor APIs are purpose-built for throughput, delivering hundreds of tokens per second. Self-hosted models struggle to match that performance without significant infrastructure investment. For latency-sensitive applications, that gap matters.

    Version Control, Model Updates, and Stability

    Vendor APIs give you access to the latest models the moment they release. New capabilities, longer context windows, and multimodal features arrive without any action on your part.

    The trade-off is stability. Vendors deprecate older models and sometimes alter model behaviour in ways that affect existing applications. An output that worked reliably on one version may behave differently after an update, and you may not get much notice.

    Self-hosting locks you to a specific version. Behaviour is consistent and reproducible for as long as you need it. Updating to a newer model is a deliberate choice, not something imposed on you. The open-source community releases capable models frequently, and quantisation techniques now allow large models to run on hardware that would have been insufficient even a year ago.

    Guardrails, Customisation, and Model Behaviour

    Vendor models ship with built-in safety guardrails. These are designed for general audiences and broad use cases. For most applications, they’re appropriate. For specialised enterprise use cases, they can be too restrictive and refusing prompts that are benign in context, or producing outputs that don’t match your organisation’s voice.

    The US government’s June 2026 export control directive suspending access to Anthropic’s Claude Fable 5 for all foreign nationals, citing a jailbreak vulnerability, illustrated a different kind of risk: vendor-side disruption that enterprises have no control over. Organisations that had built workflows on Fable 5 found access cut without warning. That event accelerated a shift in enterprise thinking toward models that no government directive can reach.

    Self-hosted models give you complete control over behaviour. You can fine-tune on proprietary data, define your own guardrails, and build an AI capability that reflects your specific domain. Competitors using generic vendor APIs cannot replicate that. The model becomes an asset, not a commodity.

    Conclusion: Match the Architecture to the Actual Risk

    The vendor vs. self-host decision comes down to where your risks sit and what you’re optimising for.

    Choose a Vendor API when:

    • Speed to market is the primary goal.
    • Usage is low or unpredictable.
    • Data leaving your network is not a compliance concern.
    • Your organisation lacks the MLOps capability to run production infrastructure.

    Choose to Self-Host when:

    • Data privacy or regulatory requirements prohibit external data transmission.
    • Utilisation is high and continuous, making per-token pricing prohibitive.
    • Deep customisation or proprietary fine-tuning is required.
    • The application must operate in offline or air-gapped environments.
    • Resilience against third-party disruption such as regulatory, commercial, or otherwise, is a business requirement.

    For many organisations, neither option alone is the right answer. A hybrid architecture routes sensitive, high-volume, or compliance-constrained work to self-hosted models, while vendor APIs handle complex reasoning tasks or public-facing applications where frontier capability matters more than data control. Simple, ad-hoc queries with no sensitive context go to the vendor. Anything carrying proprietary data stays internal.

    The architecture question is really a risk question. Map your actual risks first. The right infrastructure follows from that.

  • What the Top Strategy Firms Actually Agree On About AI

    The world’s leading strategy firms – BCG, McKinsey, and Bain – are being paid billions to help companies navigate AI transformation. When three firms that rarely agree on anything reach the same conclusion, it’s worth paying attention.

    Their shared verdict: most organisations are solving the wrong problem.

    They’re treating AI adoption as a technology challenge when it’s really an organisational change challenge. The firms differ on terminology and emphasis, but the underlying diagnosis is consistent and it has direct implications for how leaders should be spending their time and budget.

    BCG: You’re Spending Your Money in the Wrong Place

    BCG’s most important contribution to this debate is the 10-20-70 Rule, a framework that exposes where most AI investments go wrong.

    Successful AI transformation breaks down as follows:

    • 10% on algorithms and AI models
    • 20% on technology infrastructure and data pipelines
    • 70% on people, process redesign, and cultural change

    Most organisations invert this. They spend heavily on the 10% and evaluating models, running vendor comparisons, negotiating licences while treating the 70% as an afterthought. BCG research confirms that organisations that invest deliberately across all three layers triple their chances of capturing the full value of AI.

    BCG also identifies three distinct ways organisations can actually create value with AI:

    1. Deploy – immediate productivity improvements through tools like automation or coding assistants
    2. Reshape – re-engineering functional areas, such as end-to-end supply chain or marketing operations
    3. Invent – building entirely new revenue streams or business models that AI makes possible

    Most organisations are stuck at Deploy. The firms generating outsized returns are moving toward Reshape and Invent.

    McKinsey: The Gap Between High Performers and Everyone Else

    McKinsey’s research into what separates AI high performers from the rest identifies six dimensions where they consistently pull ahead:

    1. Strategy – AI investments are tied directly to specific, high-value business outcomes, not broad digital transformation goals
    2. Talent – their workforce is “bilingual”, meaning people who understand both the business problem and what AI can and cannot do
    3. Operating Model – they’ve moved beyond fragmented pilots toward an integrated hub-and-spoke model that allows successful approaches to scale
    4. Technology – modular, robust infrastructure that doesn’t require rebuilding every time a new use case emerges
    5. Data – focused on the data that matters for specific competitive advantages, not enterprise-wide data cleaning exercises that consume years and deliver little
    6. Adoption – workflows have been redesigned so AI is embedded in how work actually happens, not available as an optional tool

    The sixth dimension is where most organisations underinvest. A capability sitting unused in a system is not an AI implementation, it’s an expensive experiment.

    Bain: Stop Collecting Small Wins

    Bain identifies what they call the “micro-productivity trap”: organisations that deploy dozens of AI tools, accumulate small efficiency gains across the business, and then discover that none of it adds up to meaningful bottom-line impact.

    Their counter is a more disciplined approach:

    Zero-based process design. Rather than layering AI onto existing workflows, define where you want to end up first, what Bain calls a “Point of Arrival”, then work backwards to design the process. This is harder than incremental improvement and produces dramatically different results.

    Fewer, bigger bets. Focus on four to five “battleground domains” where AI can deliver a decisive advantage, rather than spreading effort across the organisation. Concentration beats diversification here.

    Prepare for agentic AI. AI is moving from tools that respond to prompts toward autonomous agents that plan and execute multi-step workflows with limited human direction. Organisations that haven’t thought through how they’ll govern and oversee this are building toward a blindspot.

    What All Three Actually Agree On

    Strip away the proprietary terminology and the consensus is clearer than it looks.

    Responsible AI is infrastructure, not compliance. Governance, transparency, and human oversight aren’t legal requirements to be satisfied but the foundation that lets organisations move faster with confidence. Audit trails, human-in-the-loop processes for high-stakes decisions, and bias testing are about building systems that can be trusted at scale.

    Domain transformation beats tool deployment. Every firm recommends moving from scattered AI tool adoption to targeting entire domains such as a complete software development lifecycle, the full customer engagement journey, for AI-enabled redesign. The unit of transformation should be a business outcome, not a tool.

    The workforce gap is real and it’s your problem to solve. AI literacy is becoming a baseline expectation across roles, not a specialist skill. Organisations that treat upskilling as a training department issue rather than a leadership priority are creating a capability debt that compounds over time.

    Data strategy is business strategy. The firms that are winning with AI are the ones that have identified the specific data that creates a competitive advantage in specific contexts, and have invested in making that data reliable.

    The Organisational Change Implication for Leaders

    The frameworks differ in structure. The conclusion is the same.

    AI management is 70 to 80 percent an organisational change problem. The technology question, for example which model, which platform, which vendor, is the smallest part of the challenge, and it’s the part most organisations spend the most time on.

    The firms getting outsized returns from AI aren’t doing anything exotic with the technology. They’ve made different decisions about people, processes, governance, and focus. Those decisions compound over time. Organisations that continue treating AI as primarily a technology procurement exercise are making a choice, even if they don’t recognise it as one.

    The standard sequence; people, process, technology, in that order, remains the right one. AI doesn’t change the sequence. It raises the stakes for getting it wrong.


    References

    [1] Bain & Company. Unsticking Your AI Transformation.

    [2] Boston Consulting Group. (2024, December 12). The Leader’s Guide to Transforming with AI.

    [3] McKinsey & Company. (2025, November 5). The State of AI: Global Survey 2025.

    [4] McKinsey & Company. Responsible AI Principles.

    [5] Boston Consulting Group. Responsible AI.