Skip to content
Ameen Abozaid
Englishالعربية
SRA-022

Responsible AI and AI compliance

  • 7 Lessons
  • 3.5 h practice (estimate)
Start module
On this page 9 topics

Overview

Topics

  • Privacy
  • residency of model calls
  • transparency
  • bias
  • human oversight
  • auditability
  • regulation at concept level

Learn first

3.5 h of practice (estimate)

Learning outcomes

  1. Apply responsible-AI principles (transparency, fairness, human oversight, accountability) as concrete design controls.
  2. Handle privacy for AI: what data may be sent to which model, where it is processed, and how long it is retained.
  3. Classify AI use cases by risk, following the risk-based approach of emerging AI regulation such as the EU AI Act, and work with legal partners on obligations.
  4. Design auditability: record inputs, outputs, versions, and human decisions for AI-assisted outcomes.

Lessons

  1. 01Responsible AI as engineering
  2. 02Privacy and residency of model calls
  3. 03Risk-based classification of AI use cases
  4. 04Transparency, bias, and human oversight
  5. 05Auditability of AI decisions
  6. 06Demo: risk-classifying the marketplace's AI features
  7. 07Demo: designing human oversight for automated seller suspensions

Lab and exercises

Lab

SRA-022-LAB1 · Responsible AI controls

Outcomes: 1–4 · Time: ~2 h

  1. Build a register of Commerce 2030 marketplace AI features and propose a risk class for each.
  2. Draw the data flow and residency analysis for each feature: what is sent to which model, where, and retention.
  3. Draft transparency notices and design human oversight with an appeal path for high-impact decisions.
  4. Design audit records and evidence for AI-assisted outcomes.
  5. Review with a role-played legal and compliance advisor and revise.

Acceptance: reviewed with a role-played legal and compliance advisor; every high-risk use has human oversight and an audit trail.

Exercises (case-based; six exercises)

IDOutcomeTask
SRA-022-EX011Map the four principles to concrete controls, owners, and tests for a seller-listing assistant.
SRA-022-EX022A team wants to send full support chats to a hosted model. Write the review: data classes, terms to check, redaction, residency.
SRA-022-EX033Classify five marketplace AI uses by risk and justify each class; list what you need legal to confirm.
SRA-022-EX043Decide which uses need a transparency notice and write the notice text for the support assistant.
SRA-022-EX051Design human oversight and appeal for automatic seller account suspension, including reviewer evidence and time limits.
SRA-022-EX064Define the audit record and retention for AI-assisted refund decisions and explain how it supports an appeal.
Show solutions
  • EX01 Transparency: label AI drafts. Fairness: evaluate quality across languages. Oversight: seller reviews before publishing. Accountability: named owner, incident process, logging. Each has a test or metric.
  • EX02 Allow only needed fields; redact personal identifiers; check provider retention, location, and training use (verify); use regional or self-hosted options if residency requires; get legal sign-off.
  • EX03 Examples: listing assistant minimal or limited risk; support assistant limited (disclosure); search ranking minimal; fraud scoring and seller suspension higher scrutiny because they affect income. Legal confirms class and obligations.
  • EX04 Notices where people interact with AI or receive AI-generated content, for example "This reply was drafted by an AI assistant; you may ask for a human agent."
  • EX05 Model recommends; trained reviewer decides for material actions; reviewer sees evidence and explanation; notice with reasons; appeal decided by a different human within a set time; metrics on overturns.
  • EX06 Record request id, time, model and prompt versions, inputs reference, output, reviewer and decision, reason; tamper-resistant storage; retention per legal advice; allows reconstructing why the refund was decided.

Outcome 1 is also covered by the quiz; outcome 4 by the lab audit design.

Workplace evidence: a responsible-AI or AI privacy control you designed and got adopted.

Quiz

Outcomes: O1 responsible-AI controls · O2 privacy and residency of model calls · O3 risk-based classification · O4 AI auditability.

A self-check for you: nothing is graded, saved or sent anywhere. Choose an answer, then check it. You can try again as often as you like.

  1. 1A responsible-AI principle becomes engineering when it has:O1
  2. 2Human oversight that only clicks "approve" is:O1
  3. 3For decisions that materially affect people you need:O1
  4. 4Before sending personal data to a hosted model, first check:O2
  5. 5A privacy-friendly practice for model inputs is to:O2
  6. 6A risk-based approach means obligations:O3
  7. 7The correct basis to classify a use case is:O3
  8. 8Who confirms the risk class and obligations?O3
  9. 9Why record model and prompt versions in audit records?O4
  10. 10Which is the best use of AI audit records?O4

Practical part

Six case exercises SRA-022-EX01 to EX06 plus the lab, reviewed as a controls package by a role-played legal and compliance advisor. Pass: at least five of six exercises correct, quiz at least 8/10, and a package in which every high-risk use has human oversight and an audit trail.

Common mistakes

Sending personal data to a model without checking terms and residency; fully automated decisions that affect people with no appeal path; treating compliance as a final checklist.

Assessment

Controls review.

Workplace evidence

A responsible-AI or AI privacy control you designed and got adopted.

Career relevance

AI security, privacy, and compliance architecture (ARC-046).

Type to search levels, phases, modules and lessons.