Applying a risk-based standard to institutional controls for ethical artificial intelligence

Against the background of the recommendation on the Ethics of Artificial Intelligence adopted in November 2021, education authorities and providers should review how a risk-based standard to institutional controls for ethical artificial intelligence is defined, implemented and evidenced. A decision concerning the control should recognise that interpretation should begin with the intended outcome, then identify the controls and evidence needed to show that the outcome is achieved across the declared scope. The public-interest question is whether access, learning, fair treatment and reliable information are protected in proportion to the identified risk.

The formal status of the recommendation on the Ethics of Artificial Intelligence adopted in November 2021 should be preserved in any public account. Adoption records an agreed instrument or policy position; it does not necessarily make every provision directly enforceable in every jurisdiction. For the control, the instrument should be used to identify the intended direction, the actors addressed and the implementation measures that remain necessary. Domestic law and authorised guidance continue to determine specific legal duties.

The Recommendation on the Ethics of Artificial Intelligence was adopted in November 2021. It establishes a global ethical framework addressing human rights, fairness, transparency, accountability, privacy, data governance, human oversight and environmental and social effects. In education, these principles require use-specific assessment: a system supporting routine administration does not carry the same risk as one influencing admission, assessment, progression or learner welfare.

The governing expectation for the relevant requirement should be capable of consistent application. Oversight of the assurance matter should reflect the principle that the assessment question is whether the control operates across the relevant sites, programmes, delivery modes and learner groups, including material exceptions. Definitions should provide a stable basis for decisions while allowing relevant differences to be identified and justified.

The present position

The quality significance of a risk-based standard to institutional controls for ethical artificial intelligence follows from a basic distinction between availability and effective provision. A decision concerning the assurance matter should recognise that technology may support teaching, administration and access, but consequential educational decisions must remain accountable, explainable and open to effective review. A single entry control or reported outcome cannot demonstrate consistent operation across the learner journey.

A focused examination of the stated expectation requires a clear analytical discipline. A decision concerning the control should recognise that materiality should be judged by the possible effect on learning, safety, rights, recognition, public resources and the reliability of a consequential decision. Frequency is relevant, but a rare event may still be material where the effect is serious or irreversible. The decision question, affected scope and measure should align; otherwise the conclusion may be unsupported despite substantial documentation.

A narrow control over the relevant requirement may create false assurance. In the present context, unclear responsibility between providers and suppliers, loss of meaningful human review and opaque use of personal or inferred data may produce acceptable aggregate reporting while individual learners remain exposed to material disadvantage. Testing should include exceptions and adverse cases, not only routine or successful operation.

The question to be decided should determine the records collected and the scope examined. For the relevant requirement, the most relevant material is likely to include pre-deployment and periodic performance testing, records of human review and overrides, learner information and accessible challenge routes, and an inventory of systems and their intended uses. Each source has limitations; confidence depends on corroboration between independent records and transparent treatment of uncertainty.

Application in practice

Implementation of a risk-based standard to institutional controls for ethical artificial intelligence can be tested without imposing unnecessary reporting. A competent review of the stated expectation should define escalation thresholds before reviewing cases, consider severity, reach, duration, recurrence and detectability, and record the reason for the final classification. Reassess materiality when new evidence changes the likely scope or consequence. Existing records may be used if reliable and relevant, but data collected for another purpose may not answer the assurance question.

Interpretation of the assurance matter should produce a test that another competent reviewer can apply to comparable evidence. The test should separate mandatory conditions, recommendations and illustrative methods. A finding should describe the evidence and affected scope; it should not rely on undefined terms such as adequate, appropriate or effective without explaining the basis of judgement.

Decisions concerning the relevant requirement should remain traceable to the information available for the stated reference period. Any revised finding should identify precisely what has changed and why the earlier conclusion no longer applies. A break in method or coverage must not be presented as if it demonstrated a change in educational performance.

What should be examined

Interpretation of a risk-based standard to institutional controls for ethical artificial intelligence should avoid two errors: treating a formal commitment as proof of effect, and treating one adverse case as proof that every part of the system has failed. For the control, a technical capability is not evidence that a use is educationally justified. Accuracy measured in one setting may not transfer to another population, language, curriculum or decision context. In reviewing the control, a prescribed method should not be treated as the only acceptable method where another approach establishes the same outcome with equivalent evidence.

Where the stated expectation involves partners, suppliers or several public bodies, responsibility should be mapped across the complete service. Agreements should allocate information exchange, incident escalation, learner communication, record custody and corrective authority. Division of delivery responsibilities must not create gaps in learner protection.

The appropriate response to the assurance matter is therefore one of controlled implementation and review. Neither administrative activity nor general assurance should obscure the intended result or its effect on learners. An evidential gap should lead to a qualified conclusion and continued action, not administrative closure.