Data, Analytics and AI
Responsible AI and AI governance
Responsible AI means being able to explain and defend an automated decision to the person it affects, and to a regulator who asks. Below, fairness, transparency, privacy, safety and accountability appear as working requirements rather than value statements, alongside the NIST framework that organises them and the EU AI Act's tiers of risk, with a note on why entry-level AI exams now weigh this material seriously.
Why this topic exists: Bias, transparency, privacy, safety and the frameworks that make them work (NIST AI RMF; AIF-C01's responsible-AI domain; SFIA 9's AI and data ethics skill; the EU AI Act).
Responsible AI covers the questions a system has to answer before it touches people: whose data trained it and with what permission, who is harmed when it errs, whether anyone can explain a given decision, and who carries the blame. SFIA 9 treats this as a skill of its own, AI and data ethics, instead of a paragraph inside machine learning. That placement matches practice. The people who do this work well are rarely the model builders; they are product owners, risk managers, lawyers and data stewards who have learned enough of the technology to ask precise questions of it.
The discipline has moved from principles to procedure. NIST released its AI Risk Management Framework in January 2023 for voluntary use, giving organisations a structure with the same broad shape as the security frameworks many already run, and followed it in July 2024 with a profile devoted to generative AI.
The NIST framework as a working checklist
| Function | What it asks an organisation to do | Typical evidence |
|---|---|---|
| Govern | Set policies, roles and a culture in which AI risk is somebody's job | An AI policy, named owners, an inventory of systems in use |
| Map | Understand each system in context: purpose, users, affected people, data and limits | A use-case record listing intended and foreseeable uses |
| Measure | Test and track the identified risks, including bias, robustness and privacy | Evaluation results broken down by group, red-team findings |
| Manage | Decide and act: mitigate, accept, transfer or stop, then keep monitoring | Signed-off risk decisions, incident and rollback records |
The EU AI Act reaches the same destination by another road. It sorts systems by risk, bans a short list of practices outright, places heavy duties of documentation, human oversight and data quality on high-risk uses such as recruitment and credit decisions, and asks lighter transparency of systems that converse with people or generate content. For anyone serving European users, classifying a project against those tiers belongs at the start of the work rather than the end. In practice that means a register of AI systems, an impact assessment before launch, and an owner with the power to switch a system off.
Fairness is measured, not declared
The beginner's mistake is assuming a model is fair because it never sees protected attributes such as sex or ethnicity. Postcodes, first names, job titles and purchase histories carry much of the same information, and a model will find it if it helps the score. Fairness has to be tested by comparing error rates and outcomes across groups, which means holding the sensitive data securely for testing even where the model itself must not use it. Privacy follows the same logic: records gathered for one purpose do not become training data simply because they happen to be available. AWS's AI Practitioner gives responsible use and AI governance a domain each, and those are where technically strong candidates tend to drop marks. For the data side of the same duties, lineage, consent and lawful use, see data governance, quality and privacy.
Next to this topic
- Data analysis fundamentalsAsk, prepare, process, analyse, share: the analyst's workflow as Google's programme and DP-900's core data concepts teach it, before any tool (SFIA Data analytics).
- SQL for analysisQuerying, joining, aggregating and windowing data is the analyst's first real tool and the language of every warehouse (DP-900 relational concepts; DMBOK Data Storage and Operations; the programming field owns database design).
- Data visualisation and business intelligenceDashboards, reports and the semantic models behind them: PL-300's four skill areas and DMBOK's Data Warehousing and BI area (Tableau, Power BI, Looker).
- Statistics and experimentationProbability, inference, regression and A/B tests separate a chart from a claim (Google's Advanced Data Analytics; SFIA Data science).
- Python for data workpandas, NumPy, notebooks and plotting: the working environment of analysis and machine learning (SFIA Data science; the AI pillar's argument for Python).
- Data engineering and pipelinesIngestion, transformation, warehouses, lakehouses and orchestration (DMBOK Data Integration and Interoperability; DEA-C01; DP-700; Databricks; Spark, Airflow, dbt).
- Data governance, quality and privacyOwnership, definitions, metadata, master data, quality rules and lawful use are DMBOK's centre and half its wheel; nobody hires for them until the numbers disagree.
- Machine learningSupervised and unsupervised learning, model evaluation, deep learning and the discipline of not fooling yourself (SFIA Machine learning; AIF-C01; Azure AI Fundamentals).
- Generative AI, LLMs and agentsFoundation models, prompting, retrieval, fine-tuning and agents: the newest layer of the field and the one AIF-C01 and Azure AI Fundamentals now test (the AI portal reads the concepts in order).
- Natural language processing and computer visionText and images are the two applied fields where classic machine learning met deep learning first, and where most production AI still lives (SFIA Machine learning; Azure AI Fundamentals AI-901 workloads).
- MLOps and AI engineeringGetting a model or an LLM application into production and keeping it there: deployment, monitoring, evaluation, cost (SFIA Machine learning and Data engineering; Applied Skills in Foundry; MLOps in the AI portal).
Concepts to know
Glossary entries with the reason each one matters here.
- Responsible AI
The topic's own concept.
- LLMs
Where most current risk debates live.
- Security Risk Assessment
The AI RMF is risk management for models.
Certifications that test it
Vendor exams and free certificates; facts, cost and the preparation path are on each page, and the certifications hub has them all.
Frequently asked
- Is responsible AI a job or a shared duty?
- Both, depending on size. Large organisations employ AI governance leads and review boards; in smaller ones the duty is shared by the product owner, the data protection officer and the engineers. Either way it works only when somebody holds the authority to delay or stop a launch.
- Does explainability mean using simple models?
- Not necessarily. Simple models are easier to explain, and for many regulated decisions they are the sensible choice. For complex models there are techniques that estimate which inputs drove a particular decision. What matters is that the explanation is accurate enough for whoever relies on it, whether a customer, a caseworker or an auditor.
- Does the EU AI Act apply outside Europe?
- It reaches providers and deployers whose systems are placed on the EU market or whose output is used in the EU, wherever they are based. A company elsewhere selling into Europe is in scope for those systems, much as European data protection law already works.
Courses in the directory
2 courses are filed here; the top 1 by our ranking, details and the provider link on each course page.
Last reviewed 26 September 2026 · Getting Digital