Ai ethics law product

The principle that identifiable people or organisations must answer for what an AI system does, with clear ownership, records and ways to correct harm. It rules out blaming the algorithm and requires named responsibility for outcomes.

Example. A company assigns a named product owner responsible for its loan model, with logs that show who approved changes and why.

Related: AI governance, Transparency (AI), AI audit, Contestability

The percentage of new users who reach the first moment of real value in a product, such as completing a first successful task. It shows whether onboarding works, and is often a leading indicator of retention.

Example. Of 1,000 new sign-ups to an AI writing tool, 400 generate and export a document in their first week, an activation rate of 40%.

Related: Retention rate, North Star metric, Churn rate, Task success rate

An examination of an AI system, by internal or external reviewers, against defined criteria such as accuracy, fairness, security, legal compliance and documentation. It may involve inspecting data, models, processes and outputs, and produces findings and recommendations.

Example. An auditor reviews a lender's model documentation, tests its outputs by group and reports gaps in monitoring.

Related: Bias audit, AI governance, Algorithmic impact assessment, Model risk management

The policies, roles, processes and controls an organisation or government uses to make sure AI is developed and used safely, lawfully and in line with its values. It covers approvals, risk reviews, documentation, monitoring and accountability for AI decisions.

Example. A bank has an AI review committee that must approve any new model touching credit decisions and keeps an inventory of all models in use.

Related: Responsible AI, AI risk assessment, Model risk management, AI audit

An event where the development or use of an AI system led to, or nearly led to, harm, such as discriminatory outcomes, safety failures, privacy breaches or serious misinformation. Organisations track and learn from incidents, and public databases catalogue them.

Example. A chatbot exposes another customer's order details in a reply, and the team logs it as an incident, fixes the retrieval bug and informs affected users.

Related: AI Incident Database, Post-market monitoring, Data breach notification, Red teaming

A public collection of reports of real-world harms and near-harms caused by AI systems, maintained so that developers and researchers can learn from past failures instead of repeating them. It is used in risk assessments to find similar historical cases.

Example. Before launching a facial-recognition feature, a team searches the database for past incidents involving similar systems to anticipate failure modes.

Related: AI incident, AI risk assessment, Responsible AI, Red teaming

A structured review that identifies what could go wrong with an AI system, such as bias, privacy leaks, misuse or errors, estimates how likely and how severe each risk is, and decides on mitigations. It is repeated as the system and its use change.

Example. Before adding an LLM assistant to a hospital app, a team lists risks like wrong medical advice and data leakage, rates them, and adds a doctor-review step.

Related: NIST AI Risk Management Framework, Algorithmic impact assessment, AI governance, Red teaming

Systematic and repeatable errors in an automated system that lead to unfair outcomes for particular people or groups, such as giving one group worse loan terms or lower hiring scores. It usually comes from skewed training data, flawed labels or design choices rather than from any deliberate intent, which is why it must be measured.

Example. A resume-screening model trained on ten years of past hires from a mostly male team scores women's resumes lower, even though gender was never an input column.

Related: Historical bias, Fairness metric, Protected attribute, Bias mitigation

A documented evaluation, done before deployment, of how an automated system may affect people and communities, covering fairness, privacy, safety and rights, along with proposed safeguards. Public bodies and regulators increasingly ask for one for consequential systems.

Example. A city planning to use an algorithm for allocating welfare inspections first publishes an assessment of who may be affected and how errors will be corrected.

Related: Data protection impact assessment, AI risk assessment, Bias audit, AI governance

The ability of a person who received an unfavourable automated decision to take realistic actions that would change it. Good recourse needs suggested changes to be feasible for that person, for example not asking them to lower their age.

Example. A credit app tells a rejected user to clear one overdue payment and wait 60 days, which is something they can actually do.

Related: Counterfactual explanation, Contestability, Explainable AI, Right to explanation

Irreversibly transforming personal data so that no individual can be identified, by any means reasonably likely to be used. Truly anonymous data is generally outside privacy law, but it is hard to achieve, as combining datasets can re-identify people.

Example. A hospital publishes only aggregate counts of cases per district, with no records that could point to any patient.

Related: Pseudonymization, Re-identification, k-anonymity, Differential privacy

Decisions made by technical means with no meaningful human involvement, for example an algorithm that approves or rejects a loan. The GDPR gives people safeguards against decisions made solely by automated means that produce legal or similarly significant effects, including the right to human review.

Example. An online lender rejects an application instantly by algorithm; the applicant can ask for a person to review the decision.

Related: Right to explanation, Human oversight, Profiling, GDPR

The human tendency to over-trust suggestions from an automated system and to accept them even when other evidence points the other way. In AI products it means reviewers stop checking outputs carefully, so errors slip through despite a human being nominally in the loop.

Example. A loan officer approves an AI's recommended rejection without reading the file, even though the applicant's documents clearly show stable income.

Related: Overreliance on AI, Human oversight, Algorithm aversion, Trust calibration

A structured, often independent, examination of an automated system's outcomes to see whether it treats groups unequally. It reports selection rates or error rates by group. Some jurisdictions require such audits for automated hiring tools.

Example. Before launching an AI interview scorer, a company hires an external firm to compute pass rates by gender and age band and publish a summary.

Related: Fairness metric, Four-fifths rule, AI audit, Algorithmic impact assessment

The set of techniques used to reduce unfair behaviour in a machine learning system. They are applied before training by fixing the data, during training by changing the objective, or after training by adjusting the outputs. Each usually trades some accuracy for fairness.

Example. A team reweights training rows so an under-represented group counts more, then checks that approval-rate gaps shrink without accuracy falling much.

Related: Reweighing, Adversarial debiasing, Post-processing fairness, Fairness metric

A model whose internal workings are too complex or hidden for people to follow, so we can see inputs and outputs but not why a given output was produced. Deep neural networks and large ensembles are typical examples, and they often need separate explanation tools.

Example. A gradient-boosted ensemble of 500 trees predicts default risk accurately, but no one can read its reasoning directly.

Related: Interpretability, Post-hoc explanation, Surrogate model, Explainable AI

A process by which a provider demonstrates that a product meets the legal requirements before it is placed on the market. Under the EU AI Act, high-risk AI systems must pass one, sometimes checked by an independent body, before receiving the CE marking.

Example. Before selling a medical-triage AI in the EU, its maker documents testing and risk controls and completes the required conformity procedure.

Related: EU AI Act, High-risk AI system, CE marking, Post-market monitoring

A person's clear, voluntary and informed agreement to the processing of their personal data for a stated purpose. Valid agreement is specific, easy to understand and as easy to withdraw as to give, and it cannot be bundled with unrelated conditions.

Example. An app shows a plain-language screen asking, 'May we use your voice recordings to improve speech recognition?' with separate accept and decline buttons.

Related: Data Principal, Consent Manager, Dark patterns, Purpose limitation

Under India's DPDP Act, a person registered with the Data Protection Board who acts as a single, accessible and transparent point through which a data principal can give, manage, review and withdraw consent across services. It is accountable to the data principal.

Example. A user opens a consent manager app to see all companies she has permitted to use her data and withdraws permission from one of them.

Related: Data Principal, Consent, DPDP Act 2023, Data Fiduciary

The ability of people affected by an automated decision to challenge it and obtain human review and correction. Building it requires giving people notice, reasons, a channel to appeal and reviewers with authority to change the outcome.

Example. A rejected job applicant can click 'request review' and a recruiter reassesses the case within a set number of days.

Related: Algorithmic recourse, Human oversight, Right to explanation, Accountability (AI)

The legal question of whether copying copyrighted books, images, code or articles to train AI models is permitted, and who owns AI outputs. Courts and legislators in different countries are still deciding, so teams keep records of data sources and licences.

Example. A publisher sues an AI company over training on its articles; meanwhile another firm signs a licence with the publisher to use the same content.

Related: Fair use, Text and data mining exception, Data licensing, Datasheet for datasets

The total cost of serving an AI product, including model calls, infrastructure and human escalations, divided by the number of user requests it successfully resolved. It ties model spend to outcomes and reveals whether automation is actually economical.

Example. If a support bot costs Rs 60,000 a month and resolves 20,000 queries, the cost per resolved query is Rs 3.

Related: Deflection rate, Task success rate, Unit economics, Escalation rate

An explanation stating the smallest change to an input that would flip the model's decision, for example 'your loan would have been approved if your income were Rs 50,000 higher'. It is intuitive for affected people and points to actionable steps.

Example. A rejected applicant is told the outcome would change if the requested amount were reduced from Rs 8 lakh to Rs 6 lakh.

Related: Algorithmic recourse, Local explanation, Counterfactual fairness, Explainable AI

A criterion under which a decision is fair to a person if it would have stayed the same in a hypothetical world where only their protected attribute, and whatever it causally influences, were different. It relies on a causal model of how attributes affect other features.

Example. A hiring model is counterfactually fair if changing an applicant's gender in a causal model of the world, while keeping their skills, would not change the recommendation.

Related: Individual fairness, Protected attribute, Counterfactual explanation, Proxy variable

Sending personal data from one country to another, including by storing it on a foreign cloud or calling an overseas AI API. Many laws restrict it or attach conditions; details depend on the law in question, so teams check both origin and destination rules.

Example. An Indian startup sending customer chats to an AI provider's servers abroad must check what the applicable law and contracts allow.

Related: Data residency, Standard contractual clauses, GDPR, DPDP Act 2023

A survey-based measure of how satisfied customers are with an interaction or product, typically the percentage answering 4 or 5 on a five-point scale. It is widely used to check that automation improves, not harms, customer experience.

Example. After a chatbot conversation, 420 of 500 respondents choose 4 or 5, giving a CSAT of 84%.

Related: Net promoter score, Deflection rate, Explicit feedback, Task success rate

User-interface designs that trick or pressure people into choices they would not otherwise make, such as hiding a decline button or pre-ticking consent boxes. Regulators treat them as undermining valid consent, and they are a red flag in AI product reviews.

Example. A consent banner shows a large green 'Accept all' button but buries the reject option under three menus.

Related: Consent, Privacy by design, Responsible AI, Purpose limitation

The obligation to report a personal data breach, meaning unauthorised access, loss or disclosure, to the regulator and often to the affected people. Under India's DPDP Act, fiduciaries must inform the Data Protection Board and affected data principals; the GDPR has its own strict timing rules.

Example. When an attacker downloads a customer table, the company informs the regulator and sends affected users a message describing what happened.

Related: Data Protection Board of India, GDPR, DPDP Act 2023, Incident response

Under the GDPR, the organisation that decides why and how personal data is processed. It carries the main legal responsibility for compliance, and must have contracts with any processors acting for it.

Example. An online retailer that decides to use order data to recommend products is the controller for that processing.

Related: Data processor, Data subject, GDPR, Data Fiduciary

Under India's DPDP Act, any person or organisation that alone or together with others decides the purpose and means of processing personal data. It carries the main duties, such as giving notice, obtaining valid consent, securing data and handling individuals' requests.

Example. A food-delivery company that decides to collect customers' addresses and order history is the data fiduciary for that data.

Related: Data Principal, Data Processor, Significant Data Fiduciary, DPDP Act 2023

A self-reinforcing loop in which a product's use generates data that improves the model, which improves the product, which attracts more use and more data. Realising it requires consent, data quality controls and evaluation to avoid feeding back errors.

Example. A recipe app logs which suggestions people cook and rate highly, uses that to improve its recommendations, and gains more users as a result.

Related: Explicit feedback, Implicit feedback, Feedback loop, Data minimization

The principle of collecting and keeping only the personal data that is needed for a stated purpose, and no more. It reduces breach exposure and legal risk, and in AI products means not logging or training on data you have no need for.

Example. A pet-care app asks only for the pet's age and symptoms, and does not collect the owner's exact home address.

Related: Purpose limitation, Storage limitation, Privacy by design, Personal data

Under India's DPDP Act, the individual to whom the personal data relates; for a child or a person with a disability, this includes the parent or lawful guardian acting on their behalf. These individuals have rights over their data, such as access, correction and erasure.

Example. A user of a fitness app is the data principal for the health and activity data the app collects about her.

Related: Data Fiduciary, DPDP Act 2023, Data subject, Consent

An organisation that processes personal data on behalf of another and under its instructions, rather than for its own purposes. A cloud host or an AI API vendor handling a client's customer data is typically a processor, and must be bound by a data processing agreement.

Example. A company that runs a client's customer-support chatbot and stores the chats only for that client is the client's data processor.

Related: Data controller, GDPR, Data processing agreement, Data Fiduciary

The body established under India's DPDP Act to handle enforcement, including inquiring into personal data breaches and complaints, and imposing penalties for non-compliance. It works as a digital-first adjudicating authority under the law.

Example. After a complaint about a mishandled data breach, the Data Protection Board can inquire into the matter and direct remedial steps.

Related: DPDP Act 2023, Data Fiduciary, Data breach notification, Data Principal

A documented assessment of the privacy risks of a planned processing activity and the measures to reduce them. The GDPR requires one when processing is likely to pose high risk to individuals, and it is widely used as a good-practice step for AI features.

Example. Before launching a system that scores employee productivity from monitoring data, an employer completes an assessment listing risks to workers and safeguards.

Related: Privacy by design, GDPR, Algorithmic impact assessment, Significant Data Fiduciary

A record of where data came from, who collected it, under what terms and how it was changed on its way into a dataset or model. Good provenance lets teams check licences, consent and quality, and trace problems back to their source.

Example. A team's training set documents that each of its 20,000 images came from a licensed vendor, with the date and consent terms.

Related: Datasheet for datasets, Data licensing, Data lineage, Content provenance

The requirement or practice of keeping data stored, and sometimes processed, within a specific country or region. Laws and customer contracts may demand it, which affects choices of cloud region and AI vendor for products serving Indian or European users.

Example. A fintech chooses a Mumbai cloud region so that customer records stay in India, and checks that its LLM provider offers in-country processing.

Related: Cross-border data transfer, Data sovereignty, GDPR, DPDP Act 2023

In the GDPR, the living person to whom personal data relates. Such individuals hold rights over their data, including access, correction, erasure and objection, which organisations must be able to honour.

Example. A customer in France who asks a company for a copy of the data it holds about her is exercising rights as a data subject.

Related: Data controller, Data Principal, Right of access, Right to erasure

A structured document describing how a dataset was created, what it contains, how it was collected and labelled, recommended uses, and known limitations. Modelled on datasheets in electronics, it makes hidden assumptions and risks visible before the data is used.

Example. A datasheet for a set of 50,000 voice clips records the regions of the speakers, consent obtained and the fact that children were excluded.

Related: Model card, Data provenance, Representation bias, Responsible AI

The share of customer queries resolved by an automated channel, such as a chatbot, without a human agent having to step in. It shows workload saved, but must be paired with satisfaction measures so unresolved customers are not counted as deflected.

Example. A bank's chatbot handles 6,500 of 10,000 monthly queries without a human agent, a deflection rate of 65%.

Related: Containment rate, Escalation rate, CSAT, Task success rate

A fairness criterion requiring that the rate of positive predictions be the same across groups, regardless of the true outcomes. For instance, the share of applicants shortlisted should be equal for each group. It is easy to compute but ignores real differences in qualification.

Example. If 30% of male applicants are shortlisted, demographic parity asks that about 30% of female applicants are shortlisted too.

Related: Equalized odds, Equal opportunity, Disparate impact, Fairness metric

A mathematical guarantee that the result of an analysis or training run barely changes whether or not any one person's data is included, usually achieved by adding calibrated random noise. A smaller privacy parameter epsilon means stronger privacy and less accurate results.

Example. A phone maker collects usage statistics with noise added so the total is accurate for millions of users, yet no individual's contribution can be inferred.

Related: Privacy budget, DP-SGD, Membership inference attack, Federated learning

A practice that looks neutral but disproportionately harms a protected group, regardless of intent. It is a legal concept in US anti-discrimination law and is now widely used to test automated decisions, by comparing selection rates between groups.

Example. A screening test selects 60% of one group but only 30% of another; the second group's rate is half of the first, raising a disparate impact concern.

Related: Four-fifths rule, Disparate treatment, Demographic parity, Protected attribute

A training algorithm that makes a neural network differentially private by clipping each example's gradient to a maximum size and adding random noise before every update. It limits how much any single training record can influence the model, at some cost in accuracy.

Example. A hospital trains a diagnosis model with clipped, noised gradients so that the model cannot memorise any one patient's record.

Related: Differential privacy, Privacy budget, Gradient clipping, Membership inference attack

India's law on the processing of digital personal data, enacted in 2023. It sets duties for organisations that decide why and how data is processed, gives individuals rights such as access, correction and erasure, and creates a Data Protection Board. It applies to digital personal data.

Example. An Indian edtech app collecting students' details must give notice, obtain valid consent and follow the Act's obligations for handling that data.

Related: Data Principal, Data Fiduciary, Consent Manager, Data Protection Board of India

Subordinate rules made under India's DPDP Act that spell out the operational details of the law, such as the content of notices, how consent managers work, and how breaches are reported. They set the practical procedures organisations follow to comply.

Example. A product team uses the Rules' requirements to design its consent notice and breach-reporting process, checking the current official text for details.

Related: DPDP Act 2023, Consent Manager, Data Fiduciary, Data breach notification

How much users change AI-generated content before using it, measured for example by the share of characters or words modified. A low share suggests outputs are close to what people want, while a high one shows they need substantial fixing.

Example. Support agents change on average 12% of the words in AI-drafted replies before sending them.

Related: Acceptance rate, Implicit feedback, Task success rate, Human override rate

A relaxed form of equalized odds that requires only equal true positive rates across groups, so people who truly deserve the positive outcome have the same chance of receiving it regardless of group. It focuses on not denying benefits to qualified people.

Example. Among applicants who would truly repay a loan, the model should approve the same fraction, say 90%, in every community.

Related: Equalized odds, Demographic parity, Fairness metric, True positive rate

A fairness criterion requiring that a classifier has the same true positive rate and the same false positive rate for every group. In other words, qualified and unqualified people are treated alike whichever group they belong to, which links fairness to the model's error rates.

Example. A fraud model catches 80% of real fraud and wrongly flags 5% of honest customers in every language group; if it wrongly flags 15% in one group, equalized odds is violated.

Related: Equal opportunity, Demographic parity, Predictive parity, True positive rate

The share of AI-handled interactions that are passed to a human because the system cannot resolve them, is unsure or the user asks. Tracking reasons for escalation shows where the AI falls short.

Example. A voice bot passes 18% of calls to human agents, mostly for refund disputes.

Related: Deflection rate, Containment rate, Human override rate, Fallback behavior

The European Union's regulation of artificial intelligence, which takes a risk-based approach: it bans certain practices, imposes strict duties on high-risk systems, sets transparency duties for some others and leaves minimal-risk systems mostly free. It can apply to non-EU firms whose AI is used in the EU.

Example. An Indian company selling a CV-screening tool to a German employer must check whether the tool counts as high-risk under the EU AI Act.

Related: High-risk AI system, Prohibited AI practices, General-purpose AI model, Conformity assessment

The set of methods and design practices that let people understand why an AI system produced a particular output. It supports debugging, trust, regulatory compliance and appeals by affected people, and ranges from simple interpretable models to techniques that explain black-box predictions after the fact.

Example. A bank shows a rejected applicant that 'low credit history length and high existing debt' were the main reasons for the decision.

Related: Interpretability, Post-hoc explanation, SHAP, LIME

Signals users deliberately give about output quality, such as thumbs up or down, star ratings or written comments. It is clear but sparse and skewed toward strong opinions, so it complements behavioural signals.

Example. After each answer, a chatbot shows thumbs up and down buttons; 4% of users click one, and most clicks are thumbs down.

Related: Implicit feedback, CSAT, Data flywheel, Acceptance rate

A US legal doctrine that allows limited use of copyrighted material without permission depending on factors such as purpose, amount used and effect on the market for the original. Whether AI training qualifies is being argued in courts and is not settled.

Example. A company argues that copying millions of web pages to train a model is fair use, while the authors argue it harms the market for their work.

Related: Copyright and AI training data, Text and data mining exception, Data licensing, Open-source license

An open-source Python library for assessing and improving fairness of machine learning models. It provides tools to compute metrics broken down by group, visualise disparities and apply mitigation algorithms, and works alongside common libraries such as scikit-learn.

Example. An engineer passes a trained classifier's predictions and a gender column into Fairlearn's metric-by-group tool to view accuracy and selection rate for each group.

Related: AI Fairness 360, Fairness metric, Bias mitigation, Scikit-learn

A family of results showing that several intuitive fairness criteria, such as equal error rates and equal predictive value, cannot all hold at once when groups have different base rates, except in trivial cases. It means fairness always involves choosing which trade-off to accept.

Example. In a risk-scoring system where two groups have different actual default rates, making scores equally reliable for both groups forces unequal false positive rates between them.

Related: Predictive parity, Equalized odds, Fairness metric, Base rate

A number that quantifies whether a model treats groups comparably, for example by comparing approval rates or error rates between men and women. Different metrics encode different ideas of fairness and often cannot all be satisfied at once, so teams must choose deliberately.

Example. A team reports that a loan model approves 62% of applicants in one group and 48% in another, and tracks that 14-point gap as a fairness metric.

Related: Demographic parity, Equalized odds, Equal opportunity, Predictive parity

The simple approach of dropping protected attributes such as gender or caste from a model's inputs in the hope of making it fair. It often fails because other features act as proxies for the removed ones, and without the attribute you cannot even measure group differences.

Example. A team deletes the gender column from a hiring model, but the model still rates women lower using hobbies and career gaps that correlate with gender.

Related: Proxy variable, Protected attribute, Demographic parity, Bias mitigation

What an AI product does when it cannot answer confidently or when a component fails, such as asking a clarifying question, offering a simpler option, showing a safe default or handing over to a human. Designing it well prevents dead ends and harmful guesses.

Example. When a shopping assistant is unsure what the user wants, it lists three product categories to choose from instead of guessing.

Related: Escalation rate, Confidence indicator, Human oversight, Guardrail

A training approach in which many devices or organisations each train a model on their own local data and share only model updates with a central server, which combines them. Raw data never leaves its owner, which helps privacy, though updates can still leak information.

Example. Several hospitals jointly train a scan-analysis model, each keeping patient images on its own servers and sending only weight updates.

Related: Differential privacy, Secure multi-party computation, Data minimization, Membership inference attack

A rule of thumb from US employment guidance: if one group's selection rate is below 80% of the rate of the most favoured group, that suggests possible adverse impact. Engineers borrow it as a quick screening test on model outcomes, not as proof of discrimination.

Example. If 50% of one group's applicants are hired and 35% of another's, the ratio is 0.7, which is below 0.8 and warrants investigation.

Related: Disparate impact, Demographic parity, Fairness metric, Bias audit

The European Union's data protection law, in force since 2018, that governs how personal data of people in the EU is collected and used. It sets principles, lawful bases and individual rights, and applies to organisations anywhere that offer services to or monitor people in the EU.

Example. An Indian SaaS firm with paying customers in Germany must handle those customers' personal data according to the GDPR, even though its servers are in India.

Related: Data subject, Data controller, Lawful basis, Data protection impact assessment

In the EU AI Act, an AI model trained on broad data that can competently perform a wide range of tasks and be built into many downstream systems, such as a large language model. Its providers face specific duties such as documentation and information for downstream users.

Example. A foundation language model offered through an API to thousands of developers is a general-purpose AI model under the Act.

Related: EU AI Act, Systemic risk (GPAI), Foundation model, System card

A description of how a model behaves across the whole dataset, such as which features matter most on average or how predictions change as one feature varies. It helps teams check whether the model has learned sensible patterns overall.

Example. A global importance chart shows that income and repayment history dominate a credit model, while pin code has a small but non-zero effect.

Related: Local explanation, Permutation importance, Partial dependence plot, Interpretability

Under the EU AI Act, an AI system in areas the Act lists as sensitive, such as hiring, education, credit access or essential services, or one that is a safety component of a regulated product. Providers must meet requirements on risk management, data quality, documentation, human oversight and accuracy.

Example. An AI tool that ranks applicants for jobs is treated as high-risk, so its provider must keep technical documentation and enable human oversight.

Related: EU AI Act, Conformity assessment, Human oversight, Post-market monitoring

Unfairness that already exists in the real world and is faithfully captured in the data, so a model trained on that data reproduces it even when sampling and measurement are perfect. It shows that accurate data can still lead to harmful predictions if the past itself was unjust.

Example. A model trained on decades of loan approvals in which certain communities were rarely approved learns to keep rejecting applicants from those pin codes.

Related: Algorithmic bias, Representation bias, Label bias, Proxy variable

A form of encryption that lets a computer perform calculations directly on encrypted data and produce an encrypted result that, when decrypted, matches the result of computing on the original data. It allows outsourced processing without exposing the data, but is very slow.

Example. A bank sends encrypted account features to a cloud service that scores them without ever seeing the numbers, and only the bank can decrypt the score.

Related: Secure multi-party computation, Confidential computing, Federated learning, Differential privacy

Design and process measures that let people monitor an AI system, understand its outputs and override or stop it when necessary. Effective oversight needs trained reviewers with real authority and enough information, not a rubber stamp.

Example. A loan-approval system flags borderline cases to a credit officer who can see the reasons and overrule the model.

Related: Automation bias, High-risk AI system, Contestability, Automated decision-making

Signals about quality inferred from user behaviour rather than stated opinions, such as whether they copy an answer, rephrase the question, abandon the session or edit the result. It is plentiful but noisy and needs careful interpretation.

Example. When users immediately re-ask the same question in different words, the team counts it as a sign the first answer was unhelpful.

Related: Explicit feedback, Acceptance rate, Edit rate, Data flywheel

The principle that similar individuals should receive similar predictions, judged by a task-relevant similarity measure. Unlike group metrics, it looks at pairs of people, but it is hard to apply because defining who counts as similar is itself a value-laden choice.

Example. Two applicants with the same income, repayment history and job stability should get near-identical credit scores, whatever their community.

Related: Group fairness, Counterfactual fairness, Fairness metric, Protected attribute

The degree to which a human can understand how a model turns inputs into outputs, ideally by inspecting the model itself. A small decision tree or a linear model is interpretable, whereas a deep network with millions of weights is not, at least without extra tools.

Example. A logistic regression with five features lets an analyst read off that each extra missed payment lowers the approval score by a fixed amount.

Related: Explainable AI, Intrinsically interpretable model, Post-hoc explanation, Black-box model

A privacy property of a released table: every record is indistinguishable from at least k-1 others on the quasi-identifiers, the attributes like age band and pin code that could be linked to outside data. Larger k makes singling out harder, though it can still leak sensitive values.

Example. A table is 5-anonymous if every combination of age band, gender and pin-code prefix appears for at least five people.

Related: Anonymization, Re-identification, Differential privacy, Data minimization

Distortion in the target labels of a dataset, caused by human annotators' subjective judgements, inconsistent guidelines or prejudiced past decisions. A model treats labels as ground truth, so any bias in them is learned and amplified.

Example. Annotators rate the same sentence as more 'toxic' when it is written in a dialect they are unfamiliar with, so a toxicity classifier flags that dialect unfairly.

Related: Measurement bias, Ground truth, Algorithmic bias, Inter-annotator agreement

A legally recognised reason for processing personal data, such as consent, a contract, a legal obligation or legitimate interests. Under the GDPR, an organisation must identify one before processing; other laws use different lists of grounds.

Example. An online shop processes a customer's address under the contract basis because it is needed to deliver the order, but asks for consent for marketing emails.

Related: GDPR, Legitimate interest, Consent, Data controller

A technique that explains a single prediction of any model by perturbing the input many times, seeing how the model's output changes, and fitting a simple interpretable model, such as a sparse linear one, that approximates the model near that point.

Example. To explain why a spam filter flagged one email, LIME removes words at random and finds that the word 'lottery' pushes the score most.

Related: SHAP, Local explanation, Surrogate model, Post-hoc explanation

An explanation of why a model made one specific prediction for one specific input, for example which features drove this particular customer's score. It contrasts with global explanations, which summarise the model's behaviour overall.

Example. For one rejected loan applicant, a local explanation says that a recent missed payment lowered the score the most.

Related: Global explanation, SHAP, LIME, Counterfactual explanation

Techniques for removing the influence of specific training data from a trained model without retraining from scratch, motivated by deletion requests and copyright claims. Exact unlearning means retraining without the data; approximate methods are cheaper but harder to verify.

Example. After a user asks for their data to be deleted, a team retrains only the affected shard of a sharded ensemble instead of the whole model.

Related: Right to erasure, Membership inference attack, Data retention policy, Personal data

A short standard document that accompanies a trained model and describes its intended uses, training data, evaluation results across groups and conditions, limitations and ethical considerations. It helps others decide whether the model suits their use and where it may fail.

Example. A model card for a resume screener states that it was tested only on English resumes and lists lower accuracy for non-technical roles.

Related: Datasheet for datasets, System card, Responsible AI, AI governance

The single metric that best captures the core value a product delivers to users and that the team aligns on improving over time. For an AI product it should reflect real user success, not just usage or model scores.

Example. For an AI resume builder, the North Star might be the number of users who send an application using a generated resume each week.

Related: Task success rate, Activation rate, Retention rate, Guardrail metric

An intergovernmental set of principles for trustworthy AI adopted by the OECD, covering inclusive growth, human rights and fairness, transparency, robustness and accountability. They have influenced national policies and many companies' internal AI principles.

Example. A company drafting its AI policy maps its own commitments onto the OECD principles to show alignment with international norms.

Related: Trustworthy AI, Responsible AI, AI governance, UNESCO Recommendation on the Ethics of AI

Users accepting AI outputs without adequate checking, even when the outputs are wrong, because they overestimate the system's reliability. Product design can reduce it with confidence cues, sources and friction on high-stakes actions.

Example. A junior lawyer submits a brief containing case citations generated by an AI assistant without verifying that the cases exist.

Related: Automation bias, Trust calibration, Human oversight, Confidence indicator

A chart showing how a model's average prediction changes as one feature is varied across its range while the other features keep their observed values. It reveals the direction and shape of a feature's effect, though it can mislead when features are strongly correlated.

Example. A plot for a loan model shows approval probability rising steadily with income up to Rs 12 lakh and then flattening.

Related: Individual conditional expectation, Global explanation, Permutation importance, Interpretability

Information about an identifiable living person. Privacy laws such as the GDPR and India's DPDP Act regulate how it may be collected, used and shared. The precise wording of the definition differs by law, but the core idea is identifiability of an individual.

Example. A user's email address, purchase history and device identifier are all personal data if they can be linked back to that user.

Related: Personally identifiable information, Sensitive personal data, Data Principal, Data subject

Any information that can identify a specific person, alone or combined with other data, such as a name, phone number, email, address or government ID number. AI teams must find and protect it in training data, logs and prompts.

Example. A support-chat log containing a customer's name and mobile number is PII and must be masked before it is used to fine-tune a model.

Related: Personal data, Anonymization, Pseudonymization, Data minimization

An explanation produced after a model is trained, by probing the model rather than by reading its structure. Methods such as LIME, SHAP and saliency maps approximate why the model behaved as it did, but they are approximations and may not reflect the true internal reasoning.

Example. After training a complex churn model, a team applies SHAP to see which features pushed one customer's prediction up.

Related: LIME, SHAP, Surrogate model, Explanation faithfulness

A fairness criterion requiring that precision, the share of positive predictions that turn out correct, is equal across groups. A high score then means the same thing for everyone. It can conflict with equalized odds when groups have different base rates.

Example. If 70% of applicants flagged as 'low risk' actually repay in one group, predictive parity expects roughly 70% in the other group too.

Related: Equalized odds, Fairness metric, Precision, Fairness impossibility theorem

In differential privacy, a limit on the total privacy loss allowed across all queries or training steps on a dataset, usually expressed by the parameter epsilon. Each analysis spends part of the budget; when it is used up, no more answers should be released.

Example. An analytics team sets a budget of epsilon = 2 for a dataset; every released statistic consumes a share, and further queries are blocked once the budget is exhausted.

Related: Differential privacy, DP-SGD, Anonymization, Membership inference attack

An approach in which privacy protections are built into a system from the start, through choices such as minimal collection, encryption, access controls and default-private settings, rather than added after launch. The GDPR makes a form of it a legal expectation.

Example. Before building a health-tracking feature, the team decides to process data on the device and to store nothing that identifies the user on servers.

Related: Data minimization, Data protection impact assessment, Differential privacy, Federated learning

AI uses that the EU AI Act bans outright because they are judged to threaten fundamental rights or safety, such as certain manipulative techniques and government-run social scoring. The list is defined in the Act and is narrower than everything people find objectionable.

Example. A system designed to score citizens' overall trustworthiness across their social behaviour, for a public authority, would fall in the banned group.

Related: EU AI Act, High-risk AI system, Risk-based approach to AI regulation, Responsible AI

A personal characteristic, such as gender, caste, religion, race, age or disability, on which discrimination is prohibited or ethically unacceptable in decisions like hiring or lending. Which attributes are legally protected varies by country. Fairness audits compare model outcomes across the groups defined by these attributes.

Example. An audit of a loan-scoring model splits approval rates by gender and religion to see whether any group is treated markedly worse.

Related: Proxy variable, Disparate impact, Demographic parity, Fairness through unawareness

An input feature that is not itself sensitive but is strongly correlated with a protected attribute, so it lets a model discriminate indirectly. Removing the protected column is therefore not enough to make a model fair.

Example. A pin code or surname can act as a proxy for community or religion, so a lender's model may effectively discriminate on those grounds without ever seeing them.

Related: Protected attribute, Fairness through unawareness, Algorithmic bias, Disparate impact

Replacing direct identifiers, such as names, with codes or tokens while keeping the mapping separately, so the data cannot be linked to a person without extra information. It lowers risk but the data is still personal data under the GDPR.

Example. A research team replaces patient names with random IDs and stores the lookup table in a separate, access-controlled system.

Related: Anonymization, Personal data, Re-identification, Data masking

The principle that personal data may be used only for the specific purposes for which it was collected and disclosed, not silently repurposed. For AI teams it raises the question of whether data collected for one service can be reused to train a model.

Example. Contact details given to receive order updates cannot simply be reused to build a marketing prediction model without a valid basis.

Related: Data minimization, Consent, Lawful basis, Storage limitation

Working out who a supposedly anonymous record belongs to by linking it with other data, such as combining a date of birth, pin code and gender with a public list. It is why removing names alone does not make a dataset anonymous.

Example. A released 'anonymous' delivery dataset is matched with public social-media posts about the same orders, revealing customers' identities.

Related: Anonymization, k-anonymity, Pseudonymization, Differential privacy

A form of unfairness that arises when some groups are under-represented or poorly covered in the training data, so the model learns their patterns badly and performs worse for them. It is a data-collection problem, fixed by gathering more representative examples rather than by tuning the model alone.

Example. A speech recogniser trained mostly on urban Hindi speakers makes far more errors on Bhojpuri-accented speech because it saw few such recordings.

Related: Algorithmic bias, Sampling bias, Historical bias, Intersectional fairness

An approach to building and deploying AI that puts ethical and social considerations, such as fairness, privacy, safety, transparency and accountability, into everyday engineering and business practice. It covers policies, tooling and review processes, not just principles on a slide.

Example. Before launching a hiring assistant, a company runs a fairness test, documents limitations, sets up human review and defines who is accountable for problems.

Related: AI governance, Trustworthy AI, Algorithmic impact assessment, Model card

The percentage of users who continue to use a product over a given period after starting, often shown as cohort curves. Strong retention suggests real value; for AI products it shows whether novelty has worn off.

Example. Of 500 users who joined in January, 200 are still active in March, a two-month retention rate of 40%.

Related: Churn rate, Activation rate, DAU/MAU ratio, North Star metric

The right of an individual to obtain confirmation that an organisation is processing their personal data and to receive a copy of it and related information. Products need a process to find all data held on a person, including in logs and AI systems.

Example. A user emails a company asking for everything it holds on her, and the company must locate her records across databases and export them.

Related: Right to erasure, Data portability, Data subject, Data Principal

The right of a person, in certain circumstances, to have their personal data deleted by an organisation. It is set out in the GDPR, and India's DPDP Act gives a comparable right to have data erased. For AI systems it raises hard questions about data already used to train models.

Example. A user closes her account and asks the company to delete her profile, order history and chat transcripts from its systems.

Related: Machine unlearning, Right of access, Storage limitation, Data Principal

The idea that people affected by an automated decision should be able to obtain a meaningful account of how it was reached. Its exact scope in law is debated: some rules give rights to information about the logic involved rather than a full explanation of each decision.

Example. A customer whose insurance claim was auto-rejected asks the insurer what factors led to the decision and how to have a person review it.

Related: Explainable AI, Automated decision-making, Contestability, Algorithmic recourse

A visualisation, mainly for image models, that highlights which pixels most influence a prediction, usually by computing the gradient of the output with respect to the input. It helps check whether a model looks at the right region, but can be noisy.

Example. A saliency map of a chest X-ray classifier lights up a text marker in the corner instead of the lungs, revealing a shortcut the model learned.

Related: Grad-CAM, Integrated gradients, Post-hoc explanation, Explanation faithfulness

A category of personal data considered riskier if misused, such as health, biometric, religious or financial details, and therefore subject to stricter rules in many laws. The GDPR calls such data special categories; the exact list differs between laws.

Example. An app that stores users' medical reports must apply stricter consent and security controls than one storing only a display name.

Related: Personal data, GDPR, Data protection impact assessment, Lawful basis

Running a new model on real traffic in the background, without showing its outputs to users, so its predictions can be compared against the current system or human decisions. It shows real-world performance before any user is affected.

Example. A new fraud model scores every transaction silently for two weeks while analysts compare its flags with the live system's.

Related: Online evaluation, Canary release, A/B test, Post-market monitoring

A method that explains a prediction by assigning each feature a contribution value based on Shapley values from cooperative game theory. The contributions add up to the difference between the prediction and the average prediction, and can be aggregated for global views.

Example. For a house-price model predicting Rs 85 lakh against an average of Rs 70 lakh, SHAP might attribute +9 lakh to area and +6 lakh to location.

Related: Shapley value, LIME, Local explanation, Feature importance

Under India's DPDP Act, a data fiduciary or class of fiduciaries that the government designates as significant, considering factors such as the volume and sensitivity of data handled and risks to individuals. It faces extra duties, including appointing a data protection officer and an independent data auditor.

Example. A very large social platform handling data of hundreds of millions of Indians could be notified as a significant data fiduciary.

Related: Data Fiduciary, Data Protection Officer, DPDP Act 2023, Data protection impact assessment

Being open about how an AI system works and is used: telling people when they interact with AI, what data it uses, what it can and cannot do, and how decisions are made. It supports trust, accountability and informed choices.

Example. A chatbot begins each conversation by saying it is an AI assistant and describing what it can help with.

Related: Explainable AI, Model card, Accountability (AI), Responsible AI

The match between how much users trust an AI system and how reliable it actually is, so that they rely on it when it is right and doubt it when it is likely wrong. Interfaces aim for calibrated trust rather than maximum trust.

Example. An assistant marks low-confidence answers in amber and links sources, so users double-check exactly those answers.

Related: Overreliance on AI, Automation bias, Confidence indicator, Algorithm aversion

A requirement, under India's DPDP Act, that before processing a child's personal data the organisation obtains consent from the parent or lawful guardian, in a way it can verify. The Act defines a child as someone under 18 and restricts tracking and targeted advertising aimed at children.

Example. A kids' learning app asks a parent to confirm consent through a verification step before creating a child's account.

Related: Consent, DPDP Act 2023, Data Principal, COPPA

Embedding a hidden or visible signal in AI-generated text, images, audio or video so that the content can later be identified as machine-made. Such marks help fight misinformation, but they can be weakened by editing and are not foolproof.

Example. An image model adds an invisible pattern to every picture it creates, which a detector can later use to flag it as AI-generated.

Related: C2PA, Content provenance, Deepfake, Transparency (AI)