AI Ethics and Governance: Turning Principles Into Oversight

AI ethics and governance are usually spoken of as one subject, and most organisations treat them that way: publish a set of principles, appoint a committee, consider the matter handled. The record suggests otherwise. The principles are now widely agreed. What keeps failing is the machinery meant to enforce them, and in several well documented cases the thing that broke was not a model but the governance body itself. This piece separates the two terms, lays out the layers that turn a principle into oversight, and looks at what happened when ethics boards were dissolved, overruled or removed.

Ethics and governance are not the same job

The UK government defines AI ethics as a set of values, principles and techniques that guide moral conduct in the development and use of AI. It is a statement of what should happen. The same guidance notes that harm rarely comes from deliberate choice; it comes from misuse, questionable design and consequences nobody considered.

AI governance is the apparatus that makes an organisation answer for those values. A widely cited academic definition describes it as a system of rules, practices, processes and technological tools that keeps an organisation's use of AI aligned with its strategy, the law and the ethical principles it claims to follow. The Johns Hopkins Berman Institute draws the line from the other side: ethics is a prerequisite to governance, but not every ethics question implies a governance choice.

The working distinction is simple. Ethics decides what ought to happen. Governance decides who makes sure it does, with what authority, and what evidence they leave behind.

The principles problem

Agreement on principles arrived early. When Anna Jobin, Marcello Ienca and Effy Vayena at ETH Zurich mapped the global corpus of AI ethics guidelines in 2019, they found convergence around five principles: transparency, justice and fairness, non-maleficence, responsibility and privacy. They also found substantive divergence on how those principles should be interpreted and, crucially, how they should be implemented.

That second finding is the whole field in miniature. A 2021 study of organisations deploying AI observed that research on AI ethics had been mostly conceptual, and that in practice principles were translated through four sets of activity: governance, design and development, competence building, and stakeholder communication. The problem is not that nobody knows what responsible AI looks like. It is that a principle on a website does not, by itself, change what ships. For a closer look at the principles themselves, see the core AI ethics principles.

The layers that turn a principle into oversight

Between a value and a decision on a real system sit several layers. Each one does something the layer above cannot.

Principles

Principles set direction. They are cheap to publish and impossible to audit on their own, because they say nothing about who acts, when, or on what evidence. Their value is in giving the layers below something to measure against.

Law

Law is the layer that attaches consequences. The EU AI Act is the most developed example, and its obligations on organisations that use AI, not only those that build it, are where ethics becomes operational. Under Article 26, deployers of high-risk systems must assign human oversight to people with the necessary competence, training and authority, monitor the system in operation, and suspend it and inform the provider and the market surveillance authority when they have reason to believe it presents a risk.

Article 27 goes further for public bodies, private entities providing public services and two further categories listed in point 5 of Annex III. Before first use, they must carry out a fundamental rights impact assessment describing the process the system will serve, how often it will be used, who is likely to be affected, the specific risks to them, the human oversight measures, and the arrangements for internal governance and complaints if those risks materialise. The results are notified to the market surveillance authority.

The broadest duty is the plainest. Article 4 requires every provider and deployer to take measures to build AI literacy among staff who operate AI on their behalf. It has applied since 2 February 2025, with supervision and enforcement from 3 August 2026. Amendments that entered into force in mid July 2026 removed the requirement for a "sufficient" level of literacy, but kept the obligation itself.

Standards and management systems

Law says what must be true. Standards say how an organisation proves it. ISO/IEC 42001, published in December 2023, is the world's first AI management system standard. It does not grade individual models. It requires the organisation to set AI policies and objectives and run them through a Plan, Do, Check, Act cycle, the same structure that quality and information security management have used for decades. Its value for governance is that it turns oversight into something an external auditor can examine.

For the public accountability frameworks that sit alongside these standards, we compare AI accountability frameworks from GAO, NIST and the OECD side by side.

Process inside the project

The final layer is where decisions are actually made: inside the team building or buying the system. The Alan Turing Institute's Process Based Governance framework, developed for UK government departments, is the clearest public model. It asks each AI project to keep a process log holding a project summary, named roles and responsibilities, a data factsheet, a context based risk assessment, a stakeholder impact assessment, a bias self assessment, a data protection impact assessment, and explicit timeframes for review and monitoring. The same framework sits at the centre of the Institute's series of eight practice workbooks.

The log matters more than any single assessment in it. It is the record that survives when the people who made a decision have moved on, and it is what a regulator, a court or an investor will ask to see.

When the governance body is what fails

Most governance guidance ends by recommending an ethics board. The ASEAN guide on AI governance, for instance, suggests a multidisciplinary AI Ethics Advisory Board or Ethics Committee drawing on ethics, law, technology and other disciplines. That is sound advice. It is also incomplete, because three of the most visible ethics bodies in the industry failed in ways the guidance does not discuss.

Google: a council that lasted a week

On 26 March 2019, Google announced an eight member Advanced Technology External Advisory Council to consider hard questions under its AI Principles, with four meetings planned for the year. By 4 April it had ended the council, saying it could not function as intended. The trigger was the selection of members: more than 2,000 Google workers signed a petition objecting to one appointment. The lesson is about legitimacy: a body chosen without a credible selection process can be discredited before it does any work.

Axon: a board that was overruled

Axon, the maker of the Taser, had set up an AI Ethics Board of outside members. In 2022 a two thirds majority of that board voted to recommend against a pilot study of Taser equipped drones. Weeks later, after the Uvalde school shooting, the company publicly announced work on such drones anyway. Nine of the board's 12 members resigned, citing concern that the drones would harm over policed communities and that Axon had publicised the plan without consulting them. Axon paused the project. The board had done its job; it simply had no power to stop the company acting against its advice.

Microsoft: a team that was removed

Microsoft's ethics and society team sat inside its AI organisation with a specific purpose: making sure the company's responsible AI principles showed up in the design of products that shipped. It had roughly 30 people at its peak in 2020, was cut to about seven in a reorganisation, and was eliminated in March 2023 as part of layoffs affecting 10,000 employees. The company kept its Office of Responsible AI, which writes the rules. What disappeared was the group whose job, as one former member put it, was to show product teams how the principles applied.

What the failures teach about design

Read together, the three cases describe the conditions a governance body needs to survive contact with commercial pressure.

1. Legitimacy in how members are chosen. Google's council fell on its composition before it met. Selection criteria, published in advance, are part of the governance design.
2. Decision rights, not only advice. Axon's board reached a clear majority view and was bypassed. An advisory body that can be ignored will eventually be ignored when the stakes are highest.
3. A place in the pipeline. Microsoft kept the office that writes principles and lost the team that carried them into products. Oversight that sits outside the build process is the first thing cut.
4. A duty that does not depend on goodwill. This is where law changes the calculation. Article 26 places human oversight with people who must have authority, and Article 27 writes internal governance and complaint mechanisms into a mandatory assessment. Those duties survive a reorganisation.

In each case the organisation, not the board, remained responsible for what it did, which is the point we develop in who is responsible when AI gets it wrong.

A minimum governance kit

For an organisation that wants governance to be more than a principles page, the sources above converge on a short list. None of it requires a large team.

1. An inventory. A list of every AI system built, bought or embedded, because nothing outside the list can be governed.
2. A named owner per system. One person accountable, with the authority to pause it.
3. Risk tiering. Proportionate effort: the Turing framework scales its governance actions to the potential harm of each project.
4. An impact assessment before use. For public services in the EU this is now mandatory; elsewhere it is still the cheapest moment to find a problem.
5. Human oversight with real authority. The people reviewing outputs need training and the right to override.
6. Monitoring and an incident route. A defined path for suspending a system and telling someone outside the team.
7. Literacy for everyone who touches the system. Already a legal duty in the EU.
8. A review body with decision rights. It can be an existing risk committee; the ASEAN guide notes that existing structures can be adapted rather than replaced.
9. A process log. The record that outlasts the people.

If the case for doing any of this still needs making inside an organisation, the documented harms in why AI ethics is important make it more persuasively than principles do. Whether more of it should be imposed by statute is a separate argument, which we set out in should AI be regulated.

Where ethics and policy share a room

The cases above have one structural feature in common: the people setting principles, the people building products and the people writing law were rarely in the same conversation. EX Future Summit is designed around that gap. Its program runs nine tracks, with AI Ethics, Government and AI and Society sitting alongside research, finance and health tech in one schedule. The summit runs on 18 to 20 November 2026 online and in rooms in Las Palmas and Bali, as a single thirty hour broadcast between the two islands, and online attendance is free for verified researchers and students.

FAQ

What is the difference between AI ethics and AI governance?

AI ethics is the set of values and principles describing how AI should be designed and used. AI governance is the system of rules, roles, processes and tools that makes an organisation actually follow them and answer when it does not. Ethics can exist without governance; it just cannot be enforced without it.

Is ISO/IEC 42001 certification required by law?

No. ISO/IEC 42001 is a voluntary management system standard. The EU AI Act sets binding duties, and many organisations use 42001 as a structured way to show that they have a working system for meeting them, but certification is not itself a legal requirement.

Does a small organisation need an AI ethics board?

Not necessarily a separate board. It needs a named person accountable for each AI system, with the authority to pause it, and a place where hard calls get reviewed. The ASEAN guide notes that existing risk management structures can be adapted for this rather than building new ones.

Who must carry out a fundamental rights impact assessment under the EU AI Act?

Under Article 27, deployers of high-risk AI systems that are public bodies or private entities providing public services, plus deployers in two further categories listed in Annex III, must complete one before first use and notify the market surveillance authority of the results. It must be updated if the relevant facts change.