Free Guide
Why responsible artificial intelligence is a business issue, not just a philosophy debate.
Customers, employees, insurers, and regulators increasingly ask how a company uses artificial intelligence (AI). Responsible AI is how you answer with confidence: the technology is useful, people are protected, and someone is accountable when it goes wrong.
Trust
People buy from, work for, and share data with organizations they believe will not misuse it. Transparent AI use protects that trust.
Legal exposure
Unfair, deceptive, or discriminatory outcomes are illegal whether a person or an algorithm caused them. "The AI did it" is not a defense.
Quality
Most ethical failures are also quality failures: biased data, untested outputs, and no human checking the result.
Common Ground
The principles nearly every framework agrees on.
Security practitioners, standards bodies, governments, professional societies, and faith communities use different words, but they converge on the same core ideas.
| Principle | What it means in practice | Where you will see it |
|---|---|---|
| Human dignity and rights | AI serves people; it does not manipulate, exploit, or demean them. | United Nations Educational, Scientific and Cultural Organization (UNESCO), OECD, Rome Call, Montreal Declaration |
| Transparency | Tell people when AI is used and how it affects them. | NIST, OECD, European Union (EU) AI Act, Rome Call, IEEE |
| Accountability | A named person or team owns each AI system and its outcomes. | NIST, International Organization for Standardization and International Electrotechnical Commission (ISO/IEC) 42001, OECD, Association for Computing Machinery (ACM) Code of Ethics |
| Fairness and inclusion | Test for and correct unequal outcomes across groups. | NIST, UNESCO, Rome Call, Partnership on AI |
| Privacy | Collect and use only the data needed, with consent and protection. | NIST, OECD, UNESCO, Rome Call |
| Safety and security | AI is tested, defended against abuse, and fails safely. | OWASP, NIST, MITRE Adversarial Threat Landscape for Artificial-Intelligence Systems (ATLAS), ISO/IEC 42001 |
| Reliability | Outputs are accurate enough for the decision being made, and verified. | NIST, Rome Call, IEEE |
| Human oversight | People can review, override, and appeal consequential AI decisions. | EU AI Act, OECD, UNESCO, Colorado law |
| Sustainability | Weigh the energy and environmental cost of AI against its benefit. | UNESCO, OECD |
OWASP
Open Worldwide Application Security Project (OWASP) guidance for responsible, secure AI.
OWASP is a nonprofit, vendor-neutral community whose free, openly licensed guidance is built by volunteers worldwide. Its AI work treats security, privacy, and responsible use as one discipline.
OWASP AI ExchangeAn open, comprehensive body of knowledge on AI threats and controls, contributed to international standards work including the EU AI Act standards.Visit owaspai.org →
Top 10 for Large Language Model (LLM) ApplicationsThe most critical risks in LLM apps, led by prompt injection, sensitive information disclosure, and excessive agency.Read the Top 10 →
Top 10 for Agentic AIRisks and mitigations for AI agents that use tools and act on your behalf, released December 2025.See agentic risks →
OWASP GenAI Security ProjectThe flagship OWASP home for generative AI security: Top 10 lists, guides, and solution landscapes, all free.Visit ↗
LLM Cybersecurity & Governance ChecklistA plain checklist for leaders adopting AI: strategy, legal, privacy, security, and governance questions.Visit ↗
GenAI Red Teaming GuideHow to test AI systems for harmful, biased, or insecure behavior before customers find it.Visit ↗
Machine Learning Security Top 10Top risks for traditional machine learning models, such as data poisoning and model theft.Visit ↗
OWASP AI Testing GuideA methodology for testing the security, fairness, and trustworthiness of AI systems.Visit ↗
OWASP AI Maturity AssessmentHelps organizations measure and improve how responsibly and securely they build and use AI.Visit ↗
Ethical practices drawn from the OWASP community
- Openness: share what you learn about AI risks so others can defend themselves too. (OWASP AI Exchange: contribute)
- Governance first: run AI as a managed program with an owner, inventory, and risk process. (AI program)
- Least privilege and least model: give AI only the data, permissions, and capability the task needs. (Least model privilege, Data minimization)
- Assume the model can be manipulated: treat model output as untrusted input and validate it before acting. (LLM01 Prompt Injection, LLM05 Improper Output Handling)
- Responsible testing: red-team only systems you are authorized to test, and disclose findings responsibly. (GenAI Red Teaming Guide)
- Privacy by design: minimize, protect, and limit retention of personal data across the AI lifecycle. (OWASP AI Exchange: AI privacy)
- Human oversight for consequential actions: keep a person in the loop when an agent can send, pay, delete, or decide. (Oversight control, LLM06 Excessive Agency)
The OWASP “Top 10” family
| List | What it covers |
|---|---|
| OWASP Top 10 for LLM Applications (2025) | The most critical risks in large language model and generative AI applications, such as prompt injection and excessive agency. |
| OWASP Top 10 for Agentic AI | Risks for AI agents that plan and act using tools, memory, and permissions. |
| OWASP Machine Learning Security Top 10 | Risks to traditional machine learning models, such as data poisoning, model theft, and input manipulation. |
| OWASP Top 10:2025 (web applications) | The classic list of the most critical web application security risks, updated for 2025. |
| OWASP API Security Top 10 | Risks in application programming interfaces (APIs) that connect apps, partners, and AI agents. |
| OWASP Mobile Top 10 | Risks in mobile apps. |
| OWASP Top 10 CI/CD Security Risks | Risks in software build and delivery pipelines (continuous integration and continuous delivery). |
| OWASP Non-Human Identities Top 10 | Risks from machine accounts, API keys, and service identities, which AI agents increasingly use. |
OWASP and SANS, working together: In July 2025 the SANS Institute and the OWASP AI Exchange announced a partnership to build one shared, open set of AI security controls, combining the AI Exchange's 200-page body of knowledge with the SANS Critical AI Security Guidelines across six areas: access, data, deployment, inference, monitoring, and governance. The work feeds international standards, including the EU AI Act standards and ISO/IEC 27090. In April 2026, OWASP, SANS, NIST, the Cloud Security Alliance, the Center for Internet Security, and others formed MOSAIC (Multi-Organization Secure AI Coordination) to align AI security guidance, using the open OpenCRE taxonomy to connect their standards. Our founder is a member of the OWASP AI Exchange core team. Sources: SANS and OWASP partnership announcement; SANS MOSAIC announcement.
Communities
Professional, standards, and civic communities shaping AI ethics.
National Institute of Standards and Technology (NIST) AI Risk Management FrameworkU.S. voluntary framework built around Govern, Map, Measure, and Manage, with seven trustworthy-AI characteristics.nist.gov →
ISO/IEC 42001The ISO and IEC standard for an AI management system.iso.org →
Organisation for Economic Co-operation and Development (OECD) AI PrinciplesThe first intergovernmental AI standard, adopted in 2019 and updated in 2024, endorsed by dozens of countries including the United States.oecd.ai →
UNESCO Recommendation on the Ethics of AIThe United Nations Educational, Scientific and Cultural Organization's global standard on AI ethics, adopted by its member states in 2021.unesco.org →
IEEE 7000 and Ethically Aligned DesignInstitute of Electrical and Electronics Engineers (IEEE) standards for building ethical values into system design.ieee.org →
ACM Code of EthicsThe Association for Computing Machinery's code for computing professionals: avoid harm, be honest, respect privacy.acm.org →
Partnership on AIA nonprofit coalition of industry, academia, and civil society, including guidance on responsible synthetic media.partnershiponai.org →
MITRE ATLASAdversarial Threat Landscape for Artificial-Intelligence Systems: a knowledge base of real-world attacks on AI.atlas.mitre.org →
Montreal Declaration for Responsible AIA citizen-built declaration of ten principles, including well-being, autonomy, solidarity, and democratic participation.Read the declaration →
In Their Words
What leading organizations say about using AI responsibly.
These are established standards bodies, intergovernmental organizations, professional societies, research institutes, and faith communities. Their guidance overlaps far more than it differs.
| Organization | Their core guidance |
|---|---|
| UNESCO Recommendation on the Ethics of AI (2021) | Adopted by its member states. Puts human rights and dignity first, asks that AI do no harm and be proportionate to its purpose, calls for ethical impact assessments, and says AI should not be used for social scoring or mass surveillance. |
| OECD AI Principles (2019, updated 2024) | Endorsed by dozens of governments. AI should benefit people and the planet, respect human rights and democratic values, be transparent and explainable, be robust, secure, and safe, and have clear accountability. |
| European Union Ethics Guidelines for Trustworthy AI (2019) | Trustworthy AI must be lawful, ethical, and robust, meeting seven requirements: human agency and oversight; technical robustness and safety; privacy and data governance; transparency; diversity, non-discrimination, and fairness; societal and environmental well-being; and accountability. |
| Council of Europe Framework Convention on AI (2024) | The first legally binding international treaty on AI. Requires that AI systems respect human rights, democracy, and the rule of law throughout their lifecycle. |
| NIST AI Risk Management Framework | Treats responsible AI as risk management: build a governance culture, map where AI is used, measure risks, and manage them, aiming for AI that is valid, safe, secure, accountable, explainable, privacy-enhanced, and fair. |
| ACM Principles for Responsible Algorithmic Systems (2022) | Computing professionals should ensure legitimacy and competence, minimize harm, protect security and privacy, be transparent and explainable, keep systems maintainable, make decisions contestable and auditable, accept accountability, and limit environmental impact. |
| IEEE 7000 and Ethically Aligned Design | Engineers should identify stakeholder values early and design them into systems, rather than adding ethics after launch. |
| Partnership on AI | Industry, academic, and civil-society members recommend responsible practices such as disclosing synthetic media and obtaining consent. |
| Montreal Declaration for Responsible AI | Ten principles written with public input, including well-being, autonomy, privacy, solidarity, equity, diversity, prudence, and responsibility. |
| Ada Lovelace Institute | Independent research institute focused on making data and AI work for people and society, with emphasis on public participation and accountability. |
| The Alan Turing Institute | The United Kingdom's national institute for data science and AI; its public-sector guidance stresses fairness, accountability, sustainability, and transparency. |
| Rome Call for AI Ethics | A multi-faith and industry commitment to transparency, inclusion, responsibility, impartiality, reliability, and security and privacy. |
The ethical concerns they raise most often
- Bias and unfair outcomes for people in hiring, lending, housing, health, and policing
- Privacy and surveillance from collecting or inferring personal data at scale
- Deception and misinformation, including deepfakes and undisclosed AI-generated content
- Lack of accountability when no person owns or can explain an AI decision
- Safety and security failures, including manipulation of AI systems by attackers
- Over-reliance that erodes human judgment and skills
- Impacts on jobs and workers, and the need for training and fair transitions
- Environmental cost of the energy and water used to train and run large models
Country & Regional Guidance
AI ethics, policy, and legal resources by country.
If you serve customers in more than one country, these official sources explain local expectations. Rules change often; check the source before relying on it.
Legal support for AI questions
- Track the law: the IAPP Global AI Law and Policy Tracker and the National Conference of State Legislatures (NCSL) AI legislation tracker follow new AI bills and rules.
- Privacy and AI governance community: the Future of Privacy Forum publishes free analysis on AI, privacy, and data protection.
- Intellectual property: the U.S. Copyright Office explains how copyright applies to AI-generated content.
- Consumer protection: the Federal Trade Commission (FTC) warns businesses against deceptive AI claims and unfair AI practices.
- Get counsel: for contracts, regulated decisions, or cross-border data, work with a qualified attorney. Nexus works alongside your counsel to turn legal requirements into practical controls.
General information, not legal advice.
Moral Traditions
Faith communities and moral traditions on AI.
Many employees and customers think about technology through their faith or personal moral framework. Several religious communities have published AI principles, and they overlap strongly with secular frameworks.
Rome Call for AI Ethics
Launched in 2020 with the Pontifical Academy for Life, Microsoft, IBM, and the Food and Agriculture Organization (FAO) of the United Nations. Jewish and Muslim leaders joined in 2023, and leaders of Eastern faith traditions signed in Hiroshima in 2024. Its six principles are transparency, inclusion, responsibility, impartiality, reliability, and security and privacy.[1][2]
Shared moral ground
- Dignity: every person has worth that a system must not override.
- Honesty: do not deceive people about what is real or who they are talking to.
- Stewardship: use powerful tools responsibly and for the common good.
- Justice: protect the vulnerable and avoid unfair burdens.
- Responsibility: humans remain answerable for what their tools do.
Philosophical lenses
Ethicists commonly test AI decisions through several lenses: consequences (does it produce more benefit than harm?), duties and rights (does it respect people's rights regardless of outcome?), virtue (would a person of good character deploy it this way?), and care (how does it affect the people with the least power?). A use case that fails any lens deserves a second look.
Respecting your people
A responsible AI program makes room for employees with different values. Explain why AI is used, invite concerns through a clear channel, and avoid mandating AI for tasks where a human relationship is the point of the work.
Put It In Practice
A ten-point AI code of conduct for small and mid-sized businesses.
Adopt, adapt, and publish these commitments. They map to the NIST AI Risk Management Framework and the OWASP guidance above.
- We disclose AI use to customers and employees when AI interacts with them or helps make decisions about them.
- We keep humans accountable. Every AI system has a named owner.
- We keep a human in the loop for hiring, lending, health, safety, legal, and other consequential decisions.
- We never use AI to deceive, including fake reviews, impersonation, or undisclosed synthetic media.
- We protect data. Confidential and personal data goes only into approved tools, and only what is needed.
- We test before we trust, for accuracy, bias, and security, and again after major updates.
- We respect creators, intellectual property, and license terms in what we feed AI and what we publish.
- We secure our AI against prompt injection, data leakage, and over-permissioned agents.
- We make AI accessible and offer a human alternative when AI does not work for someone.
- We listen and correct. People can report AI concerns, and we fix what we find.
Red Lines
Uses a responsible business should rule out.
- Covert manipulation that exploits people's vulnerabilities, age, or emotional state
- Impersonating real people, voices, or brands without consent
- Fully automated rejections for jobs, credit, housing, or insurance with no human review or appeal
- Emotion recognition or biometric categorization of employees or customers without a clear legal basis
- Generating fake reviews, testimonials, or evidence
- Feeding regulated or confidential client data into unapproved AI tools
Several of these are prohibited or restricted under the EU AI Act and U.S. consumer-protection law. This page is general guidance, not legal advice.
Sources
References
Sources cited on this page (last reviewed October 31, 2026)
- RenAIssance Foundation, Rome Call for AI Ethics. romecall.org
- Holy See Press Office, AI Ethics for Peace: World Religions commit to the Rome Call, June 2024. press.vatican.va
- OWASP GenAI Security Project, Top 10 for LLM Applications 2025. genai.owasp.org
- OWASP AI Exchange. owaspai.org
- NIST, AI Risk Management Framework. nist.gov
- OECD, AI Principles. oecd.ai
- UNESCO, Recommendation on the Ethics of Artificial Intelligence. unesco.org
Related free guides: AI Explained for Business Leaders · How to Spot AI Fakes and AI Bots · AI Governance Checklist