Re-AI Training Programme — L4.4 AI ethics, bias, and your legal responsibilities under EU law

Welcome to lesson 4.4, AI ethics, bias, and your legal responsibilities under EU law. Using AI responsibly protects your customers, your reputation and you. You will learn why ethics matters and how bias creeps into AI. You will see how the EU AI Act sorts AI into risk levels. You will learn what Article 50 and the GDPR ask of you. And you will learn to run a simple ethics audit, which is a careful check of an AI tool.

By the end of this lesson, you will be able to do four things. First, explain where bias in AI comes from, and name four types of bias. Second, place an AI tool in the correct risk level under the EU AI Act. Third, apply the duties of transparency, data protection under the GDPR and human oversight to your own AI work. And fourth, run a five-step ethics audit using a 20-point checklist.

First, some key terms. Bias is when an AI treats some groups unfairly, usually because of skewed training data. The EU AI Act is the EU law that regulates AI by level of risk. A risk tier is one of the Act's four levels: unacceptable, high, limited or minimal risk. Transparency means being open that AI is involved, and labelling AI-generated content. The GDPR is the EU law that protects personal data. It covers lawful use, minimal data and people's rights. And human oversight means keeping a person responsible who can review and override AI decisions.

Trust is your most valuable asset. Using AI responsibly protects your customers, your reputation and you. This matters legally and for business, not just morally. According to the OECD AI Principles from 2024, fair, transparent AI that respects privacy keeps customers. People trust those who use AI carefully. But one unfair or careless result can quickly undo that trust. And the EU AI Act sets real duties. Ignoring them risks penalties, as well as harm to people.

Bias means an AI treats some groups unfairly. It usually comes from the data, not from bad intentions. First, it starts in the data. AI learns from examples made by humans. If those examples reflect unfairness from the past, the AI can learn it and repeat it. For example, imagine a hiring AI trained mostly on CVs from one group of people. It may quietly score similar candidates higher, and put others at a disadvantage. This is dangerous because AI is fast and confident. Biased decisions can be made at large scale before anyone notices.

Bias comes in several forms, and recognising them helps you catch them. Data bias is when training data has too many or too few people from some groups, skewing results. Sampling bias is when the data was collected in a way that misses part of the real population. Historical bias is when the data reflects past inequality, and the AI treats it as normal. Automation bias is different. It is a human failing, not the AI's. It happens when people trust the machine too much and stop questioning it. The answer to that is human oversight. For every AI output you rely on, ask: who might this treat unfairly?

The EU AI Act sorts AI by risk: the higher the risk, the stricter the rules. Place your project in a tier before you build. The top tier is unacceptable risk. These are banned, such as government social scoring, or AI that manipulates vulnerable people. These bans have applied since 2 February 2025. High risk means strict duties, like risk checks, human oversight and records. Examples are AI used in hiring, credit scoring, grading or essential public services. Limited risk means you must tell users it is AI. Examples are customer-service chatbots and AI-generated content. Minimal risk has no special rules. Think of spam filters or AI in games. Your chatbot from lesson 4.1 is limited risk.

Most tools you build in this course, such as a customer-service chatbot, are limited risk. Your main legal duty is transparency. The GDPR also applies whenever personal data is involved. So say clearly that an AI is responding. Label AI-generated content where the law requires it. Check outputs for bias, and protect personal data. But be careful. If your AI helps decide on jobs, credit or grades, it is high risk. A CV-screening bot for a client, for example, would be high risk. Get expert advice before building one.

Now, transparency under Article 50 of the AI Act. This duty applies from 2 August 2026. Simply, be honest about AI. First, say it is AI. Chatbots and AI assistants must make clear that users are talking to a machine, unless it is obvious. Second, label AI-made content. Deepfakes, which are fake but realistic images, audio or video, must be disclosed as AI-made. So must AI text published to inform the public. And AI tools must mark their output. Third, why it matters. Transparency lets people judge AI output for themselves. It is the foundation of trustworthy AI.

You have four duties. First, be transparent. Tell people clearly when they deal with AI or AI-generated content. Second, check for bias. Test that your AI treats different groups fairly, not just fairly on average. Third, protect data. Collect only what you need, and store personal data securely, as the GDPR requires. Fourth, keep a human in the loop. A person reviews important AI decisions and can override them before they take effect. For high-risk AI, bias checks and human oversight are legal duties. For everything else, they are good practice.

If your AI touches personal data, the GDPR applies. First, have a lawful reason. You need a valid basis to use someone's data, usually clear consent or a genuine business need. Second, collect only what you need, called data minimisation. Data you do not hold cannot leak. Third, respect people's rights. People can ask what data you hold, correct it, or have it deleted. Fourth, if AI alone decides something important, like a loan, people can ask for a human to review it. That is Article 22 of the GDPR. So if a bank's AI refuses a loan, the customer can ask for an explanation and a human review, and can challenge it.

An ethics audit is a simple, repeatable check in five steps. Step one, set the scope: pick one tool, such as your chatbot, and define what it does and who it affects. Step two, check the data. Is any group missing or shown unfairly? Step three, test for bias: try inputs from different groups and look for unfair differences. Step four, confirm it says it is AI and protects personal data. Step five, log the gaps and fix them. Write down what is wrong, plan changes, and check again after fixing. In exercise 4.4 you will use a 20-point checklist on your chatbot from exercise 4.1.

Responsible and irresponsible AI use are separated mostly by honesty, fairness and care. Responsible use tells people clearly when AI is involved. It tests outputs for bias and fixes problems. It collects and protects data carefully. And it keeps a human accountable for decisions. Irresponsible use hides that AI made the decision. It ignores who might be treated unfairly. It hoards personal data carelessly. And it lets the machine decide with no one checking. Aim to be responsible in everything you build.

Please pause the video and answer these four questions. In your own words, where does bias in AI usually come from? What are the four risk tiers of the EU AI Act, from highest to lowest? What must you disclose under Article 50, and from what date? And can you name the five steps of a simple AI ethics audit? When you are ready, press play.

Here are some trusted resources. The European Commission has a page on the AI Act and how it works. There is also an AI Act explorer, where you can read the full text article by article. And you can read the OECD AI Principles. You will find all the links on the lesson page.

Here are the key takeaways. Ethics protects people and protects you. Trust, fairness and the law all depend on it. Bias usually comes from the training data, so test outputs across different groups. The EU AI Act ranks AI by risk, and most tools you build are limited risk. From 2 August 2026, under Article 50, you must disclose AI and label AI-made content. And remember your four duties: be transparent, check for bias, protect data, and keep a human in the loop.

Now let's put it into practice on the platform. First, try the activity called which risk tier, which duty? Then do exercise 4.4, where you run an AI ethics audit. It takes about one hour. Finally, take the lesson quiz. It has five questions, and you need 70 per cent to pass. You can retake it as many times as you like. Well done for finishing the last lesson!

Co-funded by the European Union.