AI ethics is often presented as a set of broad principles: fairness, transparency, privacy, human oversight. But for companies using or developing AI, the real challenge is more practical: how do these principles translate into everyday decisions?

The Ethics Guidelines for Trustworthy AI, prepared in 2019 by the independent High-Level Expert Group on AI appointed by the European Commission, are a useful starting point. They identify seven requirements for trustworthy AI:

• human agency and oversight;
• technical robustness and safety;
• privacy and data governance;
• transparency;
• diversity, non-discrimination and fairness;
• societal and environmental well-being;
• accountability.

These principles are no longer only ethical guidance. The AI Act refers to them explicitly in Recital 27, and many of them have become legal obligations for high-risk AI systems. Following the Digital Omnibus on AI (Regulation (EU) 2026/1744), in force since 27 July 2026, those obligations will apply from 2 December 2027 to the high-risk use cases listed in Annex III, and from 2 August 2028 to AI systems that are products, or safety components of products, covered by the EU legislation listed in Annex I. We explained what the Omnibus changes in The Digital Omnibus on AI: What Regulation (EU) 2026/1744 Actually Changes. For companies, the seven principles can be turned into seven practical questions.

1. Human oversight: who is responsible?

Before deploying an AI system, companies should identify who remains responsible for its output. AI may recommend which candidate should be interviewed, flag a potentially fraudulent transaction or generate a customer response. In each case, someone should know what the system is doing and what happens when it is wrong.

Ask:

• Who reviews AI outputs?
• Can a human override the system?
• When is human intervention mandatory?
• What happens when the system produces an unexpected result?

The key issue is not simply having a person “in the loop”, but ensuring that human oversight is meaningful. For high-risk systems, Article 14 of the AI Act requires systems to be designed so that they can be effectively overseen. Article 26 requires deployers to assign oversight to people with the necessary competence, training and authority. We looked at how this works in practice in AESIA Guidelines on the AI Act – Guide No. 6: Human Oversight.

2. Robustness and safety: what happens when AI gets it wrong?

AI systems can make errors, produce unreliable outputs or behave differently in situations that were not anticipated during development. Companies should therefore identify potential failure scenarios before deployment.

Ask:

• What are the main ways this system could fail?
• How serious would the consequences be?
• Are there safeguards and fallback procedures?
• Is the system monitored after deployment?

An AI system should not be considered ready simply because it performs well in testing. Under the AI Act, high-risk systems must achieve an appropriate level of accuracy, robustness and cybersecurity throughout their lifecycle (Article 15). They must also operate within a risk management system that is updated over time (Article 9), which we discussed in AESIA Guidelines on the AI Act – Guide No. 5: Risk Management. Where the AI system is part of a product with digital elements, further rules apply. The Cyber Resilience Act sets security requirements, covered in Cyber Resilience Act: what the Commission’s guidance means for manufacturers. The new Product Liability Directive treats software, including AI, as a product, as we explained in Product Liability: 9 December 2026 — Are You Ready?.

3. Data governance: where do the data come from?

AI ethics starts with data. Companies should know what data an AI system uses, where those data come from and whether they are appropriate for the intended purpose.

Ask:

• What data are being used, and what is their source?
• Are they accurate and sufficiently representative?
• Are personal data involved?
• Who has access to the data, and how long are they retained?

Good AI governance begins with good data governance. Article 10 of the AI Act sets quality requirements for the training, validation and testing data of high-risk systems, and the GDPR applies whenever personal data are involved. We have looked at what this means in practice in AESIA Guidelines on the AI Act – Guide No. 7: Data and Data Governance. We also examined a specific issue, whether a trained model can “forget” personal data, in our article on the Italian Data Protection Authority’s opinion on AI training in the Province of Trento: Un modello di IA può dimenticare? (in Italian).

4. Transparency: do users know what AI is doing?

People interacting with or affected by AI should receive appropriate information about its use. This does not mean explaining every technical detail of a model. It means providing information that is meaningful in the particular context.

Ask:

• Does the user know that AI is being used?
• Is it clear what the AI system can and cannot do?
• Can important decisions or recommendations be explained?
• Is there sufficient documentation for internal users?

Transparency should be designed into the product and the user experience rather than added at the end. Some of it is already mandatory. Since 2 August 2026, Article 50 of the AI Act has required that people be told when they are interacting with an AI system, and that certain AI-generated content be marked or disclosed. For generative AI systems already on the market before that date, the obligation to mark synthetic content applies from 2 December 2026. For high-risk systems, Article 13 requires clear instructions for deployers, and individuals affected by decisions based on their output will have a right to an explanation (Article 86).

5. Fairness: who could be disadvantaged?

An AI system may appear neutral while producing systematically different outcomes for different groups. Companies should therefore consider potential bias both before and after deployment.

Ask:

• Could some groups be disproportionately affected?
• Are the training or input data representative?
• Have outcomes across groups been tested?
• Is there a process for detecting and correcting problematic results?

Fairness is not a one-off technical test: it requires continuous monitoring. The consequences of getting it wrong are well documented. In When AI Goes Wrong: Six Cases Every Company Should Know we look at what happened when recruitment, credit and public benefit systems reproduced past discrimination.

6. Societal and environmental impact: what happens beyond the user?

The impact of an AI system can extend beyond the person directly interacting with it. Companies should consider wider consequences, including effects on employees, consumers, communities and the environment. The 2019 Guidelines explicitly include societal and environmental well-being among the requirements for trustworthy AI.

Ask:

• Who else could be affected by this system?
• Could the system contribute to exclusion or other social harms?
• What are its environmental implications?
• Is the use of AI proportionate to the problem it is intended to solve?

This is the principle that the AI Act translates least directly into obligations, which is precisely why it deserves attention. Article 27 requires a fundamental rights impact assessment before certain high-risk systems are deployed. This applies to public bodies, private entities providing public services, and banks and insurers using AI for creditworthiness assessments or for life and health insurance pricing. The assessment identifies the people and groups likely to be affected, the specific risks of harm and the measures to address them, including human oversight and complaint mechanisms. Even where it is not mandatory, it offers a structured way to consider the wider effects of a system. In Fundamental rights impact assessment and AI: a new methodology for EU-funded research we present a methodology that applies this approach to research and innovation projects. Its use in project proposals is discussed in AI Act and GDPR in EU-Funded Projects: What Evaluators Expect.

7. Accountability: what happens when something goes wrong?

The final question is perhaps the most important: who is accountable? AI should not create a responsibility gap in which everyone can point to the system and say that “the algorithm made the decision”.

Companies should establish:

• clear ownership of the AI system;
• documentation of important decisions;
• monitoring and audit procedures;
• channels for reporting problems;
• procedures for correcting or withdrawing the system when necessary.

Accountability means being able to reconstruct what happened, identify who was responsible and take corrective action. For high-risk systems, the AI Act turns this into concrete duties: logging (Article 12), a quality management system for providers (Article 17), post-market monitoring (Article 72) and the reporting of serious incidents (Article 73). For the quality management system, providers can now rely on the first harmonised standard under the AI Act, which we discussed in AI Act: the first harmonised standard is published. What changes with EN 18286. Accountability also has a civil liability dimension, which Italy has addressed in Artificial Intelligence and Civil Liability: The New Italian Framework under Legislative Decree No. 160/2026. Failing to meet AI Act obligations can also lead to significant fines, as explained in Le sanzioni dell’AI Act: le domande più frequenti (in Italian).

Turning AI ethics into an internal process

The seven principles work best when they are built into the company’s AI lifecycle rather than treated as a standalone ethics policy:

• Before deployment: identify the purpose, affected groups, data sources and potential risks.
• During development: test accuracy, robustness, bias, privacy and security.
• Before launch: establish human oversight, transparency measures and accountability.
• After launch: monitor performance, incidents, complaints and unintended effects.
• When something changes: reassess the system rather than assuming that the original assessment remains valid.

This approach reflects the broader logic of the European framework: trustworthy AI should be considered throughout the system’s lifecycle, not assessed only at the end. Two tools support it. In 2020 the High-Level Expert Group published the Assessment List for Trustworthy AI (ALTAI), a practical self-assessment tool based on the seven requirements. For systems that affect people’s rights, the fundamental rights impact assessment provides a structured complement focused on the people affected by the system. Both depend on people within the organisation who understand how the systems work. Article 4 of the AI Act, as amended by the Omnibus, requires providers and deployers to take measures to support the AI literacy of their staff. For a step-by-step approach to compliance within a company, see AI Act in azienda: la guida pratica per mettersi in regola (in Italian).

A simple AI ethics checklist

Before deploying an AI system, a company should be able to answer seven questions:

1. Human oversight: who can intervene?
2. Safety: what happens when the system fails?
3. Data: where do the data come from?
4. Transparency: what do users need to know?
5. Fairness: who could be disadvantaged?
6. Impact: what are the wider consequences, and on whose rights?
7. Accountability: who is responsible?

These questions do not replace legal compliance, but they prepare for it. Asked early, they bring to light issues that would otherwise remain invisible until after deployment. For high-risk systems, they anticipate much of what the AI Act will require from December 2027, or from August 2028 for AI embedded in regulated products.

AI ethics therefore starts with a simple principle: do not ask only whether AI can be used. Ask whether it should be used in this way, for this purpose, with these safeguards, and who will be responsible for the answer.

Data Valley supports companies and public bodies in assessing and governing their AI systems, from risk classification and data governance to human oversight, fundamental rights impact assessments and AI Act compliance. Learn more in From regulation to strategy: how Data Valley supports organisations in the European digital framework.

‍