Fairness, safety, privacy, inclusiveness, transparency, accountability. Everyone agrees with the words. The work is attaching each one to a real AI use, a named person and some evidence.
Pick one AI use that is already running. Score it on six questions, fill in a one-page register with evidence and an owner for each principle, and name the one person who can stop it. Repeat for the next use, and let the recurring gaps shape your policy.
Responsible AI principles usually arrive as a slide: six words, six icons and a general sense that someone else is looking after them. Everyone agrees with the words. Fairness, safety, privacy and accountability are hard to argue against, which is exactly why they rarely change a decision on a Tuesday afternoon.
The set most people have in mind is Microsoft’s. Microsoft publishes six principles, and its page words them in one line each:[1]
These are Microsoft’s principles, not ours, and I’ll keep attributing them that way. I’m using them because they’re widely quoted, they’re short enough to remember, and each one can be turned into a question you can ask about an AI tool your team already uses. That last part is what this guide is for.
A principle starts doing work when it’s attached to one specific AI use, one named person and one piece of evidence you could show someone. Here’s the same six, turned into the question a leader can put to a real use:
| Principle (Microsoft’s wording) | The question to ask of a specific use | A sign you’ve got an answer |
|---|---|---|
| Fairness: treat all people fairly | Who could get a worse result from this than someone else, and have we looked? | A comparison of outputs across the groups the use touches, with a date on it |
| Reliability and safety: perform reliably and safely | How does this fail, and who finds out when it does? | A short list of known failure modes and a named person who receives the reports |
| Privacy and security: secure, respect privacy | What data goes in, where does it go, and who can see it? | A written data-in, data-out description signed off by whoever owns data protection |
| Inclusiveness: empower everyone, whatever their background | Can everyone this is meant for actually use it, and is there another route for those who can’t? | An accessibility check and a stated alternative path |
| Transparency: understandable | Do the people affected know AI is involved, and can staff explain how an output was produced? | Disclosure wording that’s live, and a staff explanation someone can read aloud |
| Accountability: people accountable | Which named person answers for this, and can they stop it? | A name, a review date and the authority to switch the use off |
Principle wording is Microsoft’s, from its Responsible AI principles page. The questions and signs are Future Factors’ own translation for people who deploy AI rather than build it.
The rest of this piece is about getting from that table to something your team can run.
The principles are the public face of something larger. Microsoft’s Responsible AI Standard (version 2, dated June 2022) is the internal rulebook behind them, and it breaks each principle into numbered goals for the teams building AI systems.[2] Accountability, for example, holds the goals on impact assessment, oversight of significant adverse impacts, fit for purpose, data governance and management, and human oversight and control. Transparency covers intelligibility for decision making, communication to stakeholders and disclosure of AI interaction.
So the principles are the headline and the work sits in the goals underneath. Fairness, in that document, breaks into quality of service, allocation of resources and opportunities, and minimising stereotyping outputs. When someone tells you their AI is “fair”, the useful follow-up is which of those they mean and how they checked.
There’s a gap, though. Microsoft’s Standard is written for people building AI systems, with an internal Office of Responsible AI and impact assessment templates for product teams. Most readers of this guide are buying a tool, switching on a feature or letting a team build a workflow, which means you inherit the principles without the machinery. You can ask a vendor for evidence, but you still hold accountability for how the tool is used in your workplace.
Microsoft’s set isn’t the only one. The US National Institute of Standards and Technology published its AI Risk Management Framework on January 26, 2023, and a generative AI profile on July 26, 2024.[3] The OECD adopted its AI Principles in 2019 and updated them in 2024, and they’re organised differently, around five values-based principles that include human rights and democratic values, transparency and explainability, robustness, security and safety, and accountability.[4] The themes overlap heavily. Pick one set and attribute it, because a team that blends three vocabularies ends up with none.
A line like “be transparent” means one thing to the person writing customer emails and another to the person signing off a vendor contract. A leader who hands the whole list to everyone tends to get six boxes ticked by nobody in particular.
On an HR team, the tool that suggests which applications to look at first is mostly a fairness question. The recruiter needs to know whether anyone has compared the shortlist against the full applicant pool, and who to tell if the pattern looks off. In marketing, the same category of tool raises transparency, and the campaign lead decides what gets disclosed about who or what wrote the copy.
In finance, the pressure falls on reliability and accountability: a forecast drafted by AI looks as finished as one a person built, and the number still has an owner. Customer service managers tend to meet privacy first, because an agent pasting a complaint into a chat window is a quick route for personal data to leave the building. Here’s how I’d map it:
| Role | Principles that matter most day to day | The question that role should be able to answer |
|---|---|---|
| HR leader | Fairness, transparency | Has anyone compared outcomes for different groups, and do candidates or employees know AI is involved? |
| Marketing lead | Transparency, accountability | What do we disclose about AI involvement, and who approved this version? |
| Finance lead | Reliability and safety, accountability | Which numbers did a person check against source, and how often does the draft get them wrong? |
| Customer service manager | Privacy and security, inclusiveness | What customer data can an agent paste in, and what’s the route for customers who don’t want or can’t use the AI channel? |
| IT or security lead | Privacy and security, reliability and safety | Which tools are approved, where does data go, and who hears about failures? |
| Executive sponsor | Accountability | Who owns each AI use, and when did that person last review it? |
A Future Factors translation of Microsoft’s principles into role-level questions. It is our judgment, not part of Microsoft’s materials, and your own mix of roles may weigh the principles differently.
When two roles lean on the same principle, as marketing and HR both do with transparency, you probably want one shared disclosure wording rather than two.
Apply a principle to one AI use at a time, not to the whole company at once.
A company can’t be fair in general. A specific shortlisting tool can be checked for fairness, a specific chatbot can be tested for inclusiveness, and a specific prompt library can be reviewed for privacy. Principles stay vague when the unit of work is “our AI”.
Here’s a quick way to see where a particular use stands. Pick one AI use that’s already running, such as a tool drafting first replies to customer complaints. Score each of the six questions from the first table: 0 if the answer is no or nobody knows, 1 if it’s partly done or someone assumed it was handled, 2 if it’s done and you could show the evidence to a colleague.
| Principle | Question | 0 | 1 | 2 |
|---|---|---|---|---|
| Fairness | Have we looked at whether some people get worse results than others? | No one has looked | Someone thinks it’s fine | Compared, written down, dated |
| Reliability and safety | Do we know how it fails, and does someone receive failure reports? | No list, no recipient | Informal list or inbox | Named failure list and named recipient |
| Privacy and security | Do we know what data goes in, where it goes and who can see it? | Unknown | Roughly known | Written down and signed off |
| Inclusiveness | Can every intended user and affected person use it, or reach a person instead? | Not considered | Considered, not tested | Tested, with an alternative route |
| Transparency | Do affected people know AI is involved, and can staff explain the output? | No | Sometimes | Disclosed, and staff can explain it |
| Accountability | Is one named person answerable, with the authority to stop it? | Nobody, or "the team" | Named, but without a review date | Named, reviewed, can switch it off |
Scoring: 10 to 12 means the use is in good shape, so keep the review date. 7 to 9 means keep running it, with the gaps assigned to owners this month. 4 to 6 means pause any expansion until the zeros are fixed. 0 to 3 means treat the use as unmanaged. A Future Factors working tool, not a validated instrument. Adjust the bands to suit your own risk appetite.
The zeros matter more than the total. A use that scores 2 on five questions and 0 on privacy is a privacy problem, and the total hides that. If a zero is on accountability, fix it first, because it’s the cheapest fix and the other five depend on it.
You’ll also hit tensions. Checking for fairness can mean collecting demographic information that your privacy answer says you shouldn’t hold, and full transparency can reveal how to game a system. A list of principles doesn’t resolve those conflicts for you. The practical answer is to write down which way you went and why, and let the accountable person own that call.
If you’re deciding how much human review a given score should trigger, our guide to writing human-in-the-loop guidelines goes through that part, and the AI trust checklist covers the checks to run before you scale a use.
A score is a snapshot. What survives a change of staff or a vendor update is a register: one page saying what each principle means for this use and where the evidence lives. Here is one filled in for the same example, with a person editing and sending every reply.
| Principle | What it means for this use | Evidence we can show | Owner | Next review |
|---|---|---|---|---|
| Fairness | Complaints from different customer groups get replies of the same quality and tone | Quarterly sample of replies across customer segments, compared side by side | Customer service manager | January |
| Reliability and safety | Drafts don’t promise refunds or remedies the policy doesn’t allow | List of known wrong-promise cases and the report route to the team lead | Customer service manager | January |
| Privacy and security | Only complaint text and order number go in; no payment or health details | Data-in description signed by data protection owner; staff reminder in the tool’s start screen | Data protection owner | On any tool or data change |
| Inclusiveness | Customers who can’t use the web form still get a reply | Phone and email routes published; a test with a screen reader on the form | Head of customer experience | April |
| Transparency | Customers aren’t misled about who wrote the reply; agents can explain how a draft was produced | Disclosure line in the reply footer; one-page explainer for agents | Customer service manager | April |
| Accountability | One person answers for this use and can switch it off | Named in the register, with a documented stop procedure | Head of customer experience | Every quarter |
An illustrative register built on Microsoft’s six principles. The owners, routes and dates are examples to replace with your own. The columns are the part to copy.
The columns people tend to leave thin are evidence and next review. Evidence turns a principle from an opinion into a claim someone can check, and the review date stops the register being filled in once and forgotten. If you can’t name evidence for a row, write "none yet" and give it an owner.
If you can’t point to something you could show a colleague, the principle is still a hope.
You can get a first draft of a register from the vendor’s own documents. AI is good at laying paperwork side by side and spotting what’s missing, and a person has to decide what’s true.
| I’m attaching the vendor’s security and privacy documentation, their AI terms, and our internal description of how we use their tool for [use case]. Using Microsoft’s six responsible AI principles, draft a register with one row per principle: what the principle means for this use, what evidence the documents actually provide (quote the passage), what is missing, and a suggested owner by job title. Don’t assume a practice exists if the documents don’t say so. Mark anything unclear as [CHECK] and list the questions I should put to the vendor. |
Only attach documents your approved tool is allowed to handle. The result is a draft for the accountable person to verify, and it doesn’t count as vendor assurance.
Vendors will describe their practices in the language of these principles, which is a fair starting point. The register covers the part they can’t supply: your use, your data and your people.
The sixth principle is the odd one out. The first five describe properties of a system. Accountability says that people answer for it, and Microsoft’s own wording is about people, not systems: “People should be accountable for AI systems.”[1] In the Standard, the goal titled human oversight and control covers the ability of the people involved to oversee and control a system, including guarding against automation bias, the habit of trusting a machine’s output because it looks finished.[2]
No vendor does that part for you. This table separates what the AI does from what stays with a person, for the same complaint-reply use:
| What AI does | What the human still owns | How it gets checked |
|---|---|---|
| Drafts a first reply from the complaint text and the policy wording | Whether the reply is correct, kind and within what the company will actually do | The agent reads and edits every draft before sending; a team lead reads a small random sample each week |
| Suggests a category and urgency for each complaint | Which complaints are escalated, and any case involving a vulnerable customer | A named escalation owner reviews a weekly list of cases the AI rated low urgency |
| Summarises complaint trends for the monthly review | What the company changes because of them | The customer service manager checks the summary against a sample of the underlying complaints |
| Flags replies that may contain personal data it shouldn’t | Deciding what happens to a flagged reply and reporting a breach | The data protection owner sees every flag and logs the outcome |
The split is our recommendation for this example. Adapt it to your own use, and keep the third column specific enough that someone could be caught not doing it.
A principle without a named owner is a poster.
Training builds the capability to review drafts well, workflow design gives that review a fixed place in the day, and reinforcement from the team lead turns it into a habit. A team can build the register on its own, though working through real examples with a trainer tends to shorten the learning curve.
Measure review beyond the checkbox. Use: are drafts being reviewed at all? Persistence: still reviewed three months in? Impact: did reviewers change or catch anything? A review that rarely changes a draft deserves a closer look.
Don’t start by rolling the principles out company-wide. I’d start with one AI use that already exists, and one afternoon.
Then repeat for the next use. After three, the same gaps tend to recur, and that’s where a policy earns its place. Our guide to managing the responsible use of AI covers the day-to-day sorting of what’s fine, what needs a check and what’s off limits, and the governance guide for teams without a legal department covers who decides.
Pick one AI use this week and put a name next to every one of the six words.
No. Microsoft’s six principles are a company’s published framework, not a law or a regulatory standard, and the same goes for most named principle sets. They often overlap with legal duties such as privacy and discrimination law, but meeting the principles doesn’t mean you meet the law. Check your obligations with someone qualified and treat the principles as a shared vocabulary.
The themes overlap, and the packaging differs. NIST’s AI Risk Management Framework, released in January 2023, is organised as a risk management process. The OECD’s five principles, updated in 2024, are framed more around values and policy. In our view Microsoft’s six are the most direct to turn into questions about a single tool. Choose one for your team, attribute it and stick with it.
Yes, at a smaller scale. For a team of five the register can be half a page and the accountable person can be the team lead. A one-line note that you checked the data going in still counts as evidence.
Write down which way you went and why, and name the person who owns that call. A common case is wanting demographic data to test fairness while the privacy answer says to hold as little personal data as possible. Neither wins automatically, and a recorded decision someone can revisit beats an unspoken one.
Ownership works at the level of each use. The manager running the workflow owns its register, the data protection owner holds the privacy row, and one senior sponsor makes sure every use has an owner and a review date. A board can come later if the volume justifies one.
Sources were read on October 8, 2026: Microsoft’s Responsible AI principles page and the Microsoft Responsible AI Standard v2 (General Requirements, June 2022), NIST’s AI Risk Management Framework page and the OECD AI Principles page. The six principles and their one-line wording are Microsoft’s. We have not quoted Microsoft’s Standard beyond the goal titles. The principle-to-question table, role table, scored check, register and ownership table are Future Factors working tools based on our own judgment, not Microsoft’s materials and not research-validated instruments. The scenes and the complaint-reply example are illustrations, not client stories. No statistics are used in this piece.
Weekly tips. Real examples. Practical help for busy professionals.
We care about your data, check out our privacy policy.