The six principles of responsible AI

On January 6, 2027, the AI review group is due to meet to decide whether the Ask Finch pilot may go ahead, and Arjun wants Maya ready to present the case. So on December 22, the last working day before the break, the AI hour becomes a rehearsal. Around the table are Carmen Ortiz, the privacy officer; Sunil Rao, the IT security manager; and Dana Whitcombe, the chief financial officer. Carmen opens with a question that is not about technology at all: "How will we know this is fair to our customers, and who answers for it when it isn't?" Arjun says that Microsoft organizes its answer to that question around six principles, and that the AI-901 exam expects candidates to know each one and the considerations behind it.

Where the principles come from

Microsoft first published its responsible AI principles in 2018 and turned them into an internal rulebook, the Microsoft Responsible AI Standard, whose second version was published in 2022. The standard sets requirements for Microsoft's own teams, such as impact assessments before building AI systems and documentation for customers. Microsoft publishes transparency notes for many of its AI services, explaining what each service is designed for, how it works, its limitations and how to use it responsibly. Customers building on Azure remain responsible for their own uses, and the principles give them a practical checklist.

Fairness

AI systems should treat all people fairly. A system is unfair if it works better for some groups than for others, or if it allocates opportunities, resources or information unequally in ways that cannot be justified. Unfairness usually comes from data: if a model learned mostly from one kind of customer, it may serve others worse. It can also come from design choices, such as which outcome a system is told to optimize.

For Ask Finch, fairness questions are concrete. Does it answer as well in Spanish as in English? Does it understand customers who write in short, informal or misspelled messages as well as those who write in full sentences? Does it give the same returns answer whatever name the customer gives? Fairness is tested by measuring quality separately for different groups and comparing.

# Comparing answer quality across groups in a test set of 400 chat questions
results = {  # group: (questions, answered correctly)
    "English, full sentences": (200, 188),
    "English, short or informal": (120, 104),
    "Second language": (80, 62),
}
for group, (n, ok) in results.items():
    print(f"{group:28s} correct {ok / n:.2f}")
best = max(ok / n for n, ok in results.values())
worst = min(ok / n for n, ok in results.values())
print(f"gap between best and worst group: {best - worst:.2f}")

English, full sentences      correct 0.94
English, short or informal   correct 0.87
Second language              correct 0.78
gap between best and worst group: 0.16

The gap tells the team where to work: more examples of informal and second-language questions in testing, prompts that ask the model to answer in the customer's language, and documents in that language for grounding. Microsoft provides tools for fairness assessment, and Foundry's evaluation features can break results down by group.

Reliability and safety

AI systems should perform reliably and safely, as intended, including in unusual conditions, and should resist manipulation. Reliability means consistent quality across the situations the system will meet; safety means avoiding harm, including from rare failures. Considerations include testing with realistic and difficult inputs, defining clear limits on what the system will do, monitoring it once it is live, and having a way to shut it off or fall back quickly. For Ask Finch, reliability means the same correct answer to the same policy question every time, and safety means refusing electrical, gas and structural advice and handing such questions to people.

Privacy and security

AI systems should be secure and respect privacy. They often handle personal data, and models can sometimes reveal information from their inputs in unexpected ways. Considerations include collecting only the data needed, being open about how it is used, protecting it in storage and in transit, controlling who and what can access it, and resisting attacks such as prompt injection. In the United States, state privacy laws, such as Iowa's consumer data protection act, give customers rights over their data, and the Federal Trade Commission has acted against companies that misused data or made misleading claims about AI. For the pilot, Carmen requires that chat transcripts be kept for 90 days, masked of payment details, and stored in the company's own Azure subscription.

Inclusiveness

AI systems should empower everyone and engage people, including people with disabilities and people from different backgrounds, languages and circumstances. Inclusiveness asks who might be left out, and designs for them from the start rather than as an afterthought. Considerations include accessibility, such as working with screen readers and keyboard-only navigation, plain language, support for several languages, and alternatives for people who cannot or do not want to use the AI. Maya points out that some of the company's most loyal customers are retired tradespeople who prefer the phone. Ask Finch must never be the only way to reach the company.

Transparency

AI systems should be understandable. People should know when they are dealing with an AI, what it is for and what it cannot do, and those who build and operate it should understand how it reaches its outputs well enough to explain and correct them. Considerations include disclosing AI use, documenting the system's purpose, data and limits, explaining outputs where they affect people, and making it easy to report problems. For Ask Finch, transparency means the chat window says clearly that the customer is talking to an AI assistant, explains that it can make mistakes, shows which policy page an answer came from, and offers a person at any time.

Accountability

People should be accountable for AI systems. An organization that designs, deploys or uses an AI system remains responsible for how it operates, and should have governance in place: named owners, review before launch, monitoring, and a process for dealing with harm. Accountability ties the other five principles together, because principles without owners are only intentions. At Harrow & Finch, the review group approves each AI system before launch, Maya is named as the business owner of Ask Finch, Arjun as the technical owner, and every complaint about an AI answer is logged and reviewed weekly.

From principles to practice: the impact assessment

Principles only help if they change decisions, so the review group uses a short impact assessment for every AI system, modeled on the template Microsoft publishes as part of its Responsible AI Standard. Maya fills in the first one for Ask Finch during the rehearsal, and it turns out to be the most useful document of the project. It asks plain questions. What is the system for, and what is it not for? Who will use it, and who will be affected by it without using it? What are the benefits? What could go wrong, for whom, and how badly? What data does it use, and on what authority? How will each risk be reduced, measured and monitored? Who owns it, and when will the assessment be reviewed?

Writing the answers forces specific choices. The section on people affected without using the system makes Maya think of her own agents: if Ask Finch handles the easy questions, the agents will spend their days on the hard and angry ones. The assessment records a plan to rotate agents between chat review and phone work, and to measure their workload as well as customer satisfaction. Arjun notes that this is accountability in action. Nobody outside the company would have asked the question, but the company owns the consequences.

Explanation and human oversight

Some AI outputs inform people; others decide things about them. The more an output affects someone, the stronger the case for explaining it and for a person to be able to review or overturn it. A chat answer about store hours needs little explanation. A model that decided whether a customer's return was accepted would need much more: the customer should be told why, and should be able to ask a person to look again. Ask Finch is designed so that it never makes such decisions. It explains the policy, links to its source and hands anything that needs judgment, such as an exception for a loyal customer, to an agent with authority to grant it.

Human oversight only works if the humans are able to exercise it. Reviewers need time, training and the authority to say no, and they need to see enough of the AI's reasoning, such as the passages it relied on, to judge it. Arjun warns of automation bias, the tendency of people to accept a system's suggestions without checking, especially when it is usually right. Maya's team will be trained to treat Ask Finch's suggested replies as drafts, and the weekly review will include a sample of conversations the assistant handled confidently, not only those that went wrong.

Sunil adds a security footnote to the rehearsal. Each principle has a security side: a system that can be manipulated is neither reliable nor safe, and a system that leaks data fails privacy whatever its design intended. He asks that Ask Finch be included in the company's regular security testing, with the same care as the website, and that its access keys be stored in Azure Key Vault rather than in application settings.

The policy landscape

Responsible AI is increasingly shaped by law as well as principle. In the United States there is no comprehensive federal AI law. A December 2025 executive order set out a national policy approach and challenged some state AI laws, while states continue to legislate; Colorado, for example, replaced its 2024 AI act with a narrower law taking effect in January 2027. Organizations also use voluntary frameworks such as the NIST AI Risk Management Framework. Companies that sell into Europe also watch the European Union's AI Act, which sets obligations by level of risk. Laws in this area change quickly, so Carmen keeps a short register of the rules that apply and reviews it every quarter.