Cheat sheet · Ethics & Responsible AI

Responsible AI cheat sheet

The key ideas on one page — plus common pitfalls and interview tips. Skim it before an interview, or print it for revision.

Responsible AI is the practice of designing, building, and operating ML/AI systems that are fair, transparent, robust, private, accountable, and safe across their full lifecycle. This sheet covers the core pillars, fairness math (with the impossibility result), explainability, privacy/security, LLM/agentic governance, and the 2026 regulatory landscape interviewers probe.

Core Pillars & Mental Model

Six widely-cited pillars: Fairness, Transparency/Explainability, Accountability/Governance, Privacy, Security/Robustness, and Safety/Reliability. Microsoft, Google, and NIST frameworks all map to roughly these.
NIST AI RMF 1.0 (2023) organizes work into four functions: GOVERN (culture/policy, cross-cutting), MAP (context & risk), MEASURE (quantitative/qualitative assessment), MANAGE (prioritize & respond). The 2024 Generative AI Profile (NIST AI 600-1) extends it to GenAI risks.
Responsible AI is lifecycle-wide, not a final gate: problem framing -> data collection -> training -> evaluation -> deployment -> monitoring -> decommission. Harms can enter at every stage.
Distinguish allocative harm (denying resources/opportunities, e.g. loan denial) from representational harm (stereotyping, demeaning, erasing groups) - different mitigations apply.
Sociotechnical framing: most AI harms emerge from the system + humans + context, not the model in isolation. 'Fix the model' is rarely the complete answer.
Trade-offs are real and must be made explicit: fairness vs accuracy, privacy vs utility, transparency vs IP/security. Responsible AI is about documented, defensible choices, not perfection.

Fairness: Metrics & Math

Group-fairness definitions are mutually incompatible in general (impossibility result; Kleinberg et al. 2016, Chouldechova 2017): you cannot simultaneously satisfy calibration, equal FPR, and equal FNR across groups unless base rates are equal or prediction is perfect.
Demographic (statistical) parity: P(Yhat=1 | A=a) equal across groups. Ignores ground truth; good when base rates should not differ, problematic when they legitimately do.
Equalized odds: equal TPR AND FPR across groups, i.e. P(Yhat=1 | Y=y, A=a) independent of a for y in {0,1}. Equal opportunity is the relaxed version requiring only equal TPR (equal P(Yhat=1 | Y=1)).
Predictive parity / calibration: P(Y=1 | Yhat=1, A=a) equal across groups - what COMPAS satisfied, at the cost of unequal FPR/FNR across race.
Practical screen: the '80% rule' / disparate-impact ratio = (selection rate of unprivileged group / privileged group); a ratio < 0.8 flags adverse impact (US EEOC Uniform Guidelines).
Mitigation stages: pre-processing (reweighing, resampling, suppression), in-processing (adversarial debiasing, fairness constraints/regularizers, exponentiated-gradient reduction), post-processing (per-group threshold optimization, reject-option classification).
Always check intersectional and subgroup performance, not just single protected attributes - Gender Shades (Buolamwini & Gebru 2018) exposed darker-skinned-women error spikes hidden by aggregate accuracy.

Explainability & Transparency

Intrinsic (glass-box: linear/logistic, GAMs, shallow trees, EBMs) vs post-hoc (explain a trained black box). Prefer intrinsic for high-stakes decisions when accuracy permits.
SHAP: Shapley-value attributions from cooperative game theory; uniquely satisfies local accuracy, missingness, and consistency. Global importance = mean(|SHAP|) per feature. Exact Shapley is exponential, but TreeSHAP is exact and fast for tree ensembles.
LIME: fits a local sparse linear surrogate on perturbed samples around one instance - fast and intuitive, but unstable (sensitive to sampling and kernel width).
Counterfactual explanations ('what minimal change flips the decision') are actionable and align with recourse/GDPR needs; check feasibility and actionability (don't suggest changing immutable attributes).
Global tools: partial dependence plots (PDP), accumulated local effects (ALE, robust to correlated features), permutation importance (beware inflated/deflated values under correlated features).
Documentation artifacts: Model Cards (Mitchell et al. 2019), Datasheets for Datasets (Gebru et al.), and System Cards - interviewers love these as governance evidence.
Caveat: explanations can mislead or be gamed; faithfulness (does it reflect the true model?) differs from plausibility (does it look reasonable to a human?).

Privacy, Security & Robustness

Differential privacy (DP): a mechanism M is (epsilon, delta)-DP if for all adjacent datasets D, D' and any output set S: P(M(D) in S) <= e^epsilon * P(M(D') in S) + delta. Lower epsilon = stronger privacy, less utility. DP-SGD clips per-sample gradients then adds calibrated Gaussian noise.
Key attack surface: membership inference (was this record in training?), model inversion (reconstruct training inputs), training-data extraction (verbatim memorization in LLMs), and model/IP stealing via query APIs.
Adversarial robustness: small crafted perturbations (FGSM, PGD) flip predictions. Defenses: adversarial training, input sanitization, randomized smoothing (certified). Robustness usually costs clean accuracy.
Data poisoning & backdoor attacks corrupt training data/labels to implant triggers - mitigate with data provenance, anomaly/influence detection, and supply-chain controls.
Privacy-preserving ML toolbox: federated learning (data stays local), secure aggregation, homomorphic encryption, and synthetic data - each with distinct threat models and utility costs.
Minimize and govern PII: data minimization, purpose limitation, retention limits. Anonymization vs pseudonymization matters - re-identification risk means 'anonymized' data is rarely truly anonymous.

Responsible GenAI / LLM-Specific

New risk classes: hallucination/confabulation, prompt injection (direct & indirect via retrieved content), jailbreaks, training-data leakage, toxic/biased generation, and unsafe tool/agent actions.
Mitigation layers: RLHF/RLAIF and Constitutional AI for alignment, system prompts + guardrails (input/output classifiers like Llama Guard), grounding via RAG with citations, and refusal/abstention for low-confidence queries.
Treat prompt injection as the #1 LLM risk (OWASP LLM Top 10 2025 lists LLM01 Prompt Injection first): never trust retrieved/user content as instructions; separate data from instructions, apply least-privilege tools, and keep human-in-the-loop for high-impact actions.
Evaluation: red-teaming, automated benchmarks (TruthfulQA, ToxiGen, BBQ for bias, HELM for holistic eval), and LLM-as-judge with caution - judges carry their own biases (verbosity, position, self-preference).
Provenance & disclosure: content watermarking (e.g. SynthID), C2PA Content Credentials, and clear AI disclosure are increasingly required (EU AI Act Article 50 transparency duties for synthetic content and chatbots).
Agentic systems multiply risk: scope tool permissions, sandbox execution, log/audit every action, set spend/rate limits, and require confirmation for irreversible operations.

Governance, Regulation & Operations (2026)

EU AI Act (in force Aug 2024, phased): risk tiers = unacceptable (banned, e.g. social scoring - prohibitions applied Feb 2025), high-risk (conformity assessment, logging, human oversight), limited (transparency), minimal. GPAI/foundation-model obligations and the GPAI Code of Practice apply from Aug 2025; most high-risk obligations phase in through Aug 2026-2027.
Voluntary frameworks for an auditable program: NIST AI RMF, ISO/IEC 42001 (AI management system, published Dec 2023), and ISO/IEC 23894 (AI risk management).
US landscape is fragmented and shifting: Biden's EO 14110 was revoked in Jan 2025 and replaced by a deregulatory EO plus the July 2025 'America's AI Action Plan', so enforcement leans on sector regulators (EEOC, FTC, CFPB) and state law.
State laws to know: NYC Local Law 144 (bias audits for automated hiring tools, in effect since 2023) and the Colorado AI Act (first comprehensive US state AI law; effective June 30 2026 after a delay), with Texas (TRAIGA) and others following.
Operationalize: an AI inventory/registry, model risk tiering, impact assessments (DPIA / algorithmic impact assessment), an AI review board, and incident response for AI failures.
Continuous production monitoring: track data drift, concept drift, fairness-metric drift across cohorts, performance decay, and abuse - with alerting and rollback paths.
Accountability requires human-in/on-the-loop oversight with real authority to override, a named accountable owner per model, and audit trails.

Common pitfalls

Treating fairness as one number: the metrics are mathematically incompatible, so you must choose the definition that fits the context and justify it - claiming a model is simply 'unbiased' is a red flag.
Fairness through unawareness: dropping the protected attribute does NOT remove bias because proxies (zip code, name, purchase history) leak it - and you then can't even measure disparity.
Confusing explainability with faithfulness: a plausible SHAP/LIME plot may not reflect the model's true reasoning; explanations can be unstable or adversarially manipulated.
Assuming anonymization = privacy: aggregated/'anonymized' data is often re-identifiable; only formal guarantees like differential privacy bound the risk.
Ignoring intersectional subgroups: aggregate accuracy hides severe failures for small intersecting groups (e.g. darker-skinned women).
Bolt-on ethics: running a fairness check only at the end instead of across the lifecycle (data, training, deployment, monitoring).
Over-trusting RLHF/guardrails: alignment reduces but does not eliminate jailbreaks, prompt injection, or hallucination - defense-in-depth is required.
Using LLM-as-judge naively: judges have position, verbosity, and self-preference biases; validate against human labels.
Forgetting drift: a fair, accurate model at launch degrades; without monitoring, harms reappear silently.
Equating compliance with responsibility: passing an EU AI Act checklist is necessary but not sufficient for actual safety and trust.

Interview tips

Expect 'define and contrast demographic parity, equalized odds, and calibration, then explain why you can't have all three' - know the impossibility result and when each metric is appropriate.
Be ready to walk a realistic scenario (hiring, lending, healthcare): identify harms, pick a fairness metric, choose pre/in/post-processing mitigation, and state the trade-off you accept.
Know SHAP vs LIME (game-theoretic & consistent vs local surrogate & unstable) and when you'd instead choose an intrinsically interpretable model.
Define differential privacy precisely (epsilon, delta) and sketch DP-SGD (per-sample clip + Gaussian noise); interviewers test the privacy-utility trade-off.
For GenAI roles, hit the OWASP LLM Top 10 highlights - prompt injection, sensitive-data disclosure, insecure output handling - with concrete mitigations for an agentic system.
Show you can operationalize: NIST AI RMF, ISO 42001, model cards, AI registries, impact assessments, and production monitoring - not just theory.
Demonstrate sociotechnical thinking: the fix may live in the data, the process, or human oversight, not only the model.
Have a current-events answer on EU AI Act risk tiers and timeline, and acknowledge the fragmented, deregulatory-leaning US picture (revoked EO 14110, state laws like Colorado AI Act).
Discuss measurable monitoring: which fairness/drift metrics you'd log, alert thresholds, and your rollback/incident-response plan.
Frame Responsible AI as documented, defensible decisions under conflicting objectives - not a solved checklist.

Read the full lesson