Why is a responsible AI statement not enough?
A responsible AI statement is not enough because it describes intentions, and nothing in it tells a busy colleague what to do on Tuesday afternoon. Controls are what turn the statement into behaviour.
Picture a fictional 60-person insurance broker, Meridian Cover. Its claims team starts using an AI assistant to draft replies to customer emails about claim status. The operations lead, Sam, is asked by the directors to 'make sure we use AI responsibly'. What Sam has today is a sentence on the intranet, 'Meridian uses AI ethically and responsibly', a shared login to the assistant, no record of which replies were AI-drafted and a complaint from a customer who was told a claim was approved when it was still under assessment.
What are the core responsible AI practices?
The core responsible AI practices are a written use policy, a register of where AI is used, a human review step matched to risk, short documentation of each use, monitoring with sampled checks, and an incident route. The NIST AI Risk Management Framework groups this kind of work into four functions: Govern, Map, Measure and Manage.
Govern: write the policy and name owners
Say which tools are approved, what data may go in and who owns each AI use. NIST describes Govern as building the culture, policies and accountability that the other functions rely on.
Map: record each use and its context
Keep a one-line register entry per use: purpose, users, tool, data involved and who could be affected if it goes wrong.
Measure: check quality on a schedule
Sample outputs regularly against a short checklist and record the error rate, rather than relying on complaints to reveal problems.
Manage: act on what you find
Fix the prompt, tighten the review step or pause the use, and log incidents so the same mistake is not repeated.
What does weak and strong responsible AI look like in practice?
Weak version: Sam emails the claims team a reminder to 'double-check AI replies' and adds a line to the staff handbook. Nobody knows what double-checking means, the shared login means nobody can tell who sent what, and the next wrong status update is found only when another customer complains.
Strong version: Sam writes a one-page control sheet for this single use. Policy: the assistant may draft replies, but claim decisions, amounts and dates are copied only from the claims system, never from the draft. Review: every reply is read by the handler before sending, and replies about approvals or refusals go to a senior handler. Documentation: a short note records the purpose, the approved prompt and the review rule. Monitoring: each Friday, Sam samples 20 sent replies and checks status, tone and promises. Incidents: any wrong statement to a customer is logged within a day with the fix taken. Each handler has their own login, so drafts are traceable.
| Control | Owner | Evidence | How often |
|---|---|---|---|
| Use policy | Operations lead | One-page control sheet | Reviewed quarterly |
| Human review | Claims handler | Handler name on each reply | Every reply |
| Senior sign-off | Senior handler | Approval note | Approval and refusal replies |
| Sampled check | Operations lead | Checklist results | Weekly, 20 replies |
| Incident log | Operations lead | Log entry and fix | Within one working day |
How do you know your responsible AI controls are working?
Your controls are working when you can answer three questions with evidence: who reviewed this output, how often do outputs fail the checklist, and what changed after the last incident? If any answer is 'we assume so', that control exists only on paper.
Look for the warning signs too: sampled checks that always pass, which can mean the checklist is too loose; review steps people skip when busy; and register entries that have not changed since the tool was updated.
What are the common responsible AI mistakes in small teams?
The most common mistake is copying a large company's framework and then never using it. Others: shared logins that remove accountability, review rules that treat a birthday message and a claim decision the same way, monitoring that waits for complaints, and incidents fixed quietly without updating the prompt or policy. Start with one high-value use, set five controls and extend from there.
Where does responsible AI fit in the Tosheo.ai catalogue?
Responsible AI sits in the Responsible AI and Policy category, in the AI literacy course, after the ethical AI lesson and before human in the loop review design. The hands-on task asks you to write a control sheet for an AI use in your own role, and the rubric feedback checks that every control has an owner, evidence and a frequency. Managers on the Team plan can assign it to everyone who uses a shared tool.