Page 369 - CyberSecurityEssentialsEnglish

TABLE 8-4: TURNING RESPONSIBLE AI PRINCIPLES INTO DECISION QUESTIONS

Principle The decision question Evidence that answers it

Validity and Does it work for the intended Acceptance tests on
reliability purpose in real conditions? representative and edge cases.

Could it cause harm, and can A stop control, limits, and
Safety
we stop it? incident scenarios.

Security and Can it be manipulated or Threat modeling and

resilience degraded? adversarial testing.

Accountability and Who decides, and what is A named owner, a register, and
transparency recorded? logs.

A statement of purpose,
Can we explain the decision
Explainability factors, limits, and appeal
usefully to the person affected?
route.

What data is used, and by what Classification, minimization, and
Privacy
right? a lawful basis.

Does performance differ across Disaggregated testing and
Fairness
groups in a harmful way? analysis of complaints.

● Remember: Section summary
• Key idea: Principles become manageable when they are turned into a repeating cycle
with evidence at each stage.
• Practical decision: Run the four functions as a loop, and start it again whenever the
model, the data, or the purpose changes.

• Mistake to avoid: Treating governing as an approval given once at the beginning of a
project.

8.5 Risk Classification and Meaningful Human Oversight
◆ Key idea: the level of oversight follows the risk, not the tool.

Classification rests on who is affected and how badly, whether the effect can be reversed,
what data is touched, and how much autonomy the system holds.

⚠ An important note on this classification

The classification that follows is a simplified management tool inspired by risk-based
frameworks. It is not a unified legal classification valid in every country or sector. It must
be tied to local law, sectoral requirements, and contracts.

368