Ethical Impact Self-Assessment

All the questions below are optional. We are limiting the information we collect (you can see for instance that we do not collect your organisation's name nor address) solely for these purposes: 1 - providing you with a report, 2 - contacting you if you ask us to, 3 - include you in our survey statistics if you ask us to. We will not use your information for any other purpose. we will not transfer or sell your information to a third party.

It helps getting a better report (and statistics if you opt-in) if you answer them as fully as possible.

You answered: {typeA}

You did not answer this question. If this is an error, use the "Back" button to go back and choose an answer. If you decline to answer, it will affect the contents of this report by reducing its context.

Your answer suggests that you have already achieved a high level of maturity and are deploying your initiative(s) following a well documented process and control set. At this maturity level, you should check that you keep monitoring your initiatives (e.g. detect data drift).

You can leverage your good position by sharing non-confidential information about your approach, such as publishing case studies or contributing to academic and (inter)national developments.

An Ethical Impact Assessment would validate your ethical maturity and provide a third-party confirmation of your excellent ethical position.

Whilst your answer points to a good ethical position, it should be moderated by the answer to question 2 and 3, which show a lack of coherence: If you are at a high level in solution management, you would be expected to be at a similarly high level in other areas. 

It may be that your organisation has specific features that allow these individual responses. If it is the case you should document this and then be able to use your good current position in the area of solution management to also drive improvements in other areas.

You should consider your response in the context of your organisation's size. Small and medium organisations usually lack the resources to ensure the ethical position that your response suggests. 

It is completely possible that you have developed efficient processes or manage the implementation of your AI initiative in a way that supports your answer pointing to a good or very good ethical position, and in this case it will be useful to document the specific advantages that lead you to this level, and make them available to your stakeholders (customers) to demonstrate your key advantage.

Your answers suggests that you follow a process mandated by your organisation. Therefore it is likely that the process includes a number of controls which will steer your initiative's development and implementation.

You should check that these controls adequately cover a whole range of ethical considerations. It is all the more important as they are impacting every initiative in your organisation. 

These considerations include conditions to ensure transparency, accountability, fairness, and of course legal requirements linked to your data. 

At this level, you should have a comprehensive documentation of your processes and data, as well as robust project management to deliver your initiative(s). 

An external assessment would contribute to consolidate all these aspects and give you increased confidence in your current ethical standing.

Your answer suggests that you have identified a business proposition for which AI applies. It also suggests that your team has considered and approved a defined approach. 

You are likely to approach AI in an organised manner. You should verify that your solution will adequately address a number of pre-requisites, which may be documented in the business case. These include at least, but not limited to:

- Data Management, ensuring you have the right to use it for training, testing your model. You should hold documented evidence for this.

- The security model. Your answer suggests a more advanced development or implementation so it is critical that you ensure that relevant controls are in place to avoid a data breach. Such controls may be designed with your IT security specialists and include checklists, tests, records. Specific attention should be given to "prompt hacking" where users may circumvent safeguards you may have put in place.

- Other guidance (e.g. DIODE from the BCS in the UK - linked to their course https://www.bcs.org/qualifications-and-certifications/online-it-professional-development-courses/bcs-foundation-certificate-in-the-ethical-build-of-ai/) and legislation, a mandatory risk assessment in Europe, and/or further legislation linked to the regions your initiative will be touching. Issues of fairness, transparency and accountability (again a checklist may assist) should be addressed.

A fuller ethical impact assessment would present you with the key aspects to consider and measure your position against each of them, thus giving you a plan to consolidate and even improve your ethical position.

Your answer suggests that you are experimenting with AI without a defined business question or a defined proposition. Whilst it is of course positive to explore new technologies, it is highly advisable to make sure you have a business need for AI rather than saying "AI is the answer, what was your question?!". 

Even at this stage you should consider factors such as:

- Using AI requires data to train and test a model. You should ensure that you have a legal right to use that data, this right is usually linked to controls applied to that data. Are these controls in place?

- You should also consider the security built around your AI solution: you may develop into an isolated sandbox, but you should ensure that there is no risk to your data, either through a logical link, or unsafe access through prompting.

- Finally, it makes business sense to have your AI initiative support your business and add value. You should build a business case, which will trigger relevant questions regarding investment, return, risks... 

An ethical Impact Assessment would yield particularly well at this early stage in your ethical development by presenting the plan that would support the ethical development of your initiative.

You did not answer this question. If this is an error, use the "Back" button to go back and choose an answer. If you decline to answer, it will affect the contents of this report by reducing its context.

You answered: {theDevelopment}

We strongly recommend that you identify somebody at the earliest opportunity to be accountable for your AI initiative's ethical position. 

Having an accountability point will generate other positive aspects such as the inception of project and risk management. This will result in the consideration of a number of principles:

- legal considerations,
- safety/security,
- fairness,
- transparency,
- contestability and ...
- accountability

These will set the right course for your initiative. 

At this stage, a light-touch assessment will provide you with a toolkit to ensure you adopt an "ethical by design" approach.

You have identified a person acting as a "point of contact" or accountability point for your AI initiative. Your response suggests that this person designs local policies and compliance principles, which is a great first step.

As this design appears local (maybe at departmental rather than corporate level), and does not include actual measures, the individual accountable would benefit from a light touch assessment covering principles (legal compliance, safety/security, fairness, transparency, contestability and governance), and would be able to contrast their approach to the assessment report. It would likely speed the process, suggest measures and increase the individual's/team's confidence in adopting an "ethical by design" approach.

We suggest that your initiative's implementation follows good project and risk management practices. For instance, the documentation of the risks linked to your initiative(s) can be used to steer your development plans, in effect using the concept of risk as a driver for improvement. Risk can be a good thing! 

A more complete assessment would draw out risks and provide ways to address and mitigate them. 

This will allow you to increase your ethical position through a more corporate and informed approach. Ideally the combination of good project and risk management and following ethical principles should bring you into a virtuous improvement circle. 

Your response indicates that you have a good grasp of your AI initiative at a local (departmental) level. 

The question remains to ensure that the principles you have chosen are fully aligned with a good ethical position. This can be done through a "checklist-like" approach, which should be contrasted with your implementation plan.

The context in which your organisation operates and your organisation's own features also play an important part in shaping this plan.

The checklist in a fuller Ethical Impact Assessment includes at least legal compliance, safety/security, fairness, transparency, contestability and governance, and each would have a number of subsets to provide more details.

We suggest that your initiative's implementation follows good project and risk management practices. For instance, the documentation of the risks linked to your initiative(s) can be used to steer your development plans, in effect using the concept of risk as a driver for improvement. At this ethical position level, it is also critical to ensure that your initiative's risk management is inscribed into your wider organisation's risk management. If it is not, we can recommend ways to do so, and make your corporate layer(s) more aware about your initiative's potential outcomes

A fuller assessment would provide you with key aspects to bolster your ethical position, and provide clear plans regarding implementation, risk management, and communication linked to your initiative.

You follow an organisation-wide approach to setting up initiatives leading to a good ethical position. It is often challenging to follow policies and procedures set centrally. 

We suggest you check that you have relevant strategies and policies in place, and that you ensure (And document) that you follow them at your level (it may be a departmental level). 

Relevant strategies and policies would include for example:

- corporate ethical strategy, and corporate vision and values
- risk management strategy, and in the case of ethics, provisions for external risks with reputational impact, or explicit risks related to ethics
- code of ethics, with whistleblower policy, conflict of interest policy, corporate Social Responsibility (CSR) policy
- diversity and inclusion policy
- sustainability and environmental policy
- data ethics policy (may also link to supplier management policy)

and whilst it may not be part of a formal policy, ensure you have feedback mechanisms and systems in place.

The above will foster an environment that will support your organisation's ethical position. If you are at this level, a full assessment can look into each of these policies and how they support AI initiatives development (as they often pre-date applied AI) and how they work together to provide the right environment to develop and deploy an ethical AI initiative.

Additionally you mention that you cover "a vast range of compliance points" and "how they impact a broad range of stakeholders". 

We recommend reviewing these policies in the perspective of the widest societal impact, and list all stakeholders, however remote from your initiative's outcomes, and run a check how/whether they are affected by "knock-on" effects, such as job displacement, readiness to change... 

We also recommend checking some basics, such as spotchecks on feedback channels and ensure feedback is recorded, acted upon, and responded to.

You consider your strategies and policies as exemplar and publish (some of) them. assuming all the above is in place, you are in an excellent ethical position.

We recommend running external checks to maintain that level, and compare them to other exemplars. We also recommend you register and participate in relevant ethical networks, and carry on disseminating your best practice.

Your indicated that your organisation's size is small to medium. It is rare for such organisations to achieve this very good ethical position as they may lack resources to implement and such good ethical practice. You may therefore need to review the full extents of the requirements as we suggested above.

You may however be already very mature in your ethical position, through specific circumstances. In this case we suggest you use this as a unique selling point and publicise how good you are. An external assessment would re-enforce this position. This is where a very good to excellent ethical standing and associated reputation brings very positive outcomes. 

Your response to this theme suggests you are at a very high ethical level. However, your response(s) to other questions did not reflect a similar high level. This slight incoherence is something you should explore as it is likely that there may be gaps in your approach (for example you may have an extremely comprehensive policy regarding fairness, but an incomplete approach in checking bias in your initiative). 

In this case an overall ethical impact assessment would provide a wide picture of your ethical position and a report, based on evidence observed, would highlight key actions to reach and consolidate this high ethical position. 

You indicated that your business is relatively small in size. This may raise some risks in that you may have limited capacity to consider the entire range of controls (this includes legislation or existing guidance), and evaluate the ethical risks that an AI initiative can generate. 

You indicated that your organisation is medium to large. You should carefully consider the consequences of reputational damage caused by an adverse ethical issue as this type of risk tends to impact the entire organisation.

Your answer suggests you are using data without ensuring you have the right to do so. A number of existing legal constraints apply, linked to factors such as personal data, copyrighted or intellectual property issues, contractual issues, or generally data ownership. We therefore recommend you check the basis under which you are using your data. 

Additionally you should have an understanding of your data quality, and as you say that you do not carry out checks on your data, it is likely that your initiative's outcomes are subject to data related issues such as bias, obsolescence, or simply lack of accuracy. 

At this stage we recommend you focus on data management and then proceeed to your AI initiative with a stronger data foundation. 

An ethical impact assessment is useful even at this early stage as it would focus on providing you with a sound approach to data management which is a pre-requisite to obtaining good (and ethical) outcomes. 

Your answer suggests you are aware of specific constraints regarding data use. These constraints cover at least, but not limited to: 

- management (handling) of personal data,
- copyrighted or intellectual property issues,
- contractual issues, or more generally data ownership questions

as well as data quality:

- accuracy
- obsolescence
- bias and sufficient scope
- and numerous other requirements covering data and metadata.

We recommend that you ensure that the above is well documented. This will help you further develop your initiative, and refer to these documents when you design a similar project. Additionally, having documents in place will answer the potential data challenges that may occur (for instance a legal challenge on use of personal data). 

An ethical impact assessment would provide you with a focus and task prioritisation at the right time: before you embark on developing your initiative.

You mention that you use an established process locally (e.g. a checklist) to verify any constraints on your data and any compliance issues.

We recommend you review your checklist against existing guidelines, emerging standards, and decide what you should prioritise so that you can be confident that you are working towwards a good ethical standpoint, whilst tailoring data compliance points for your initiative.

Your checklist should contain at least:

- management (handling) of personal data, if it applies
- copyrighted data or intellectual property issues,
- contractual issues, or more generally data ownership questions

as well as data quality:

- accuracy
- obsolescence
- bias and sufficient scope
- and numerous other requirements covering data and metadata.

An ethical impact assessment would provide you with a toolkit which would consolidate your existing checks, and provide a path towards an organisation-wide approach. 

Your response indicates an advanced approach to data management which appears well suited for AI. the "large range of controls" should cover at the very least: 

- management (handling) of personal data, if it applies
- copyrighted data or intellectual property issues,
- contractual issues, or more generally data ownership questions

as well as data quality:

- accuracy
- obsolescence
- bias and sufficient scope
- scarcity management
- data residency
- associated security
- and other aspects related to data and metadata.

Data management may already be managed organisation-wide, but you may find that there are gaps if strategies and policies were set to comply with "what we must do" (legal stand) rather than "what we should do" (ethical stand).

An ethical Impact Assessment would provide you with a review of your current practice against an ethical, rather than legal/generic business context.

You answer states that you carry out specific tasks beyond robust data management, such as monitoring your initiative(s) to ensure they keep complying and that for instance data quality remains adequate. 

At this level, a very good ethical position also involves advanced stakeholder management, and include secondary stakeholders, defined as being impacted as a "knock-on effect". This vastly increases the scope of stakeholder management and, importantly, may also impact the scope of your strategies, policies and compliance regime to date.

An Ethical Impact Assessment can deliver "fine tuning" that may otherwise be overlooked by a busy organisation. This "fine tuning" can then be fully exploited to give you an advantage, increase your stakeholder's trust, and increase your own organisation's confidence in its delivery.

You also mention that you make (some of) your strategies, policies and processes available publicly. This is the ultimate step for an organisation which is excellent in its ethical position. 

Getting to this point requires extensive work, and we commend your investment in this domain. We recommend that you closely monitor the timeliness of these document and update them as necessary. We also recommend that you

- publicise and promote your outstanding ethical position to give you a competitve advantage and show you "lead by example"
- monitor any feedback to detect early signs showing you need to update what you publish. 

An Ethical Impact Assessment at this very advanced stage may not be entirely necessary, beyond independently verifying your ethical position and provide an outside perspective into your achievements. 

Your answer to this question suggests you have invested a lot of work in your very good to excellent ethical position. As a small or medium organisation this can be extremely challenging. We recommend you ensure the context in which you answered this question did not lead you to an optimism bias. 

There are cases where small to medium orgnisations excel given their inherent agility. If it is your case, do make sure you advertise this fact to further re-assure your stakeholders about your ability to maintain a top ethical position.

Your answer to this question suggests you have a very good to excellent ethical position. However, other questions you have answered introduce a moderation, as they do not reflect the same level of maturity. Your organisation's ethical position depends on many factors, which you can compare to a chain. If one of these factors is a weaker link it may affect the entire chain.

We recommend you consider what elements in your organisation are likely to affect the very good to excellent position you suggested in this theme (data) and address them. 

An Ethical Impact Assessment would consider all the elements of the chain and give you a full view of your organisation with strong points and where to improve. 

You declined to answer where you are based or where your stakeholders reside. If this is an oversight, please use the back button to fill these options, and this report will then have supplementary paragraphs regarding national considerations.

You indicated that you are either based in the UK or reaching out UK stakeholders. In the UK, ethical considerations based on the UK AI White paper include:

- Safety security and robustness
- Transparency (*) and explainability
- Fairness (*)
- Accountability (*) and Governance
- Contestability and redress

(those marked * also included in the Data Ethics Framework)

These headings cover many facets that require your organisation to check how it complies with these - and monitoring for new developments. 

A light-touch ethical impact assessment will provide further indications on how to address the detail of these considerations. 

You indicated that your AI initiative reaches (or is based in) Europe. The EU AI Act mandates a risk-based approach where initiatives are classed in 4 risk levels:

- Unacceptable risk (if your initiative falls in this category, it is prohibited)
- High risk (this has a high number of stringent requirements)
- Medium risk (has a lower requirement demand)
- Low risk (proceed under certain conditions)

It is therefore critical to establish the risk level for your initiative, and carry out the corresponding obligations.

Additional provisions also apply to General Purpose AI.

A tailored ethical impact assessment will provide guidance in this area.

You indicated that you have stakeholders outside the UK or that you are based outside the UK. Different legislation exists in different countries and this may affect your intent for your AI initiative. We suggest to check the legislation in any country your initiative will be accessible from.

Whilst you are not linked to the UK, the principles listed in the UK AI White paper remain a good guideline to steer your initiative's ethical standing:

- Safety security and robustness
- Transparency (*) and explainability
- Fairness (*)
- Accountability (*) and Governance
- Contestability and redress

ATTENTION: you have opted out of the survey and not requested us to contact you. Please check that this is correct. We really value your contribution so would ask you to re-consider joining the survey. If not, thank you for your time :-) 

Also, as will not keep your submission, please ensure you copy this report NOW if you wish to keep it.

ATTENTION: As you opted in to be part of our survey or requested us to contact you, you must submit this form for us to be able to get its details. 

If you would like a copy of your report emailed to you, please kindly let us know.

Thank you again for your participation and for your time.