Two votes in eight days changed the tone of the AI ethics conversation. On March 13, the European Parliament approved the Artificial Intelligence Act, 523 votes in favour, 46 against and 49 abstentions. On March 21, the UN General Assembly adopted, by consensus, its first resolution on "safe, secure and trustworthy" AI. One is a binding law in the making; the other is a non-binding statement of intent. Together they mark the moment AI ethics stopped being mostly a matter of corporate principles and conference panels.

For people who build software, this raises a practical question: what does "ethical AI" mean on a Tuesday afternoon, when you are deciding whether to ship a chatbot, how to label generated content, or what to do when the model is confidently wrong?

This post is an attempt at a working answer. It covers the ethical lenses that sit underneath the debate, the principles nearly every framework shares, what the AI Act actually asks for, three cases from the last two months that make the abstractions concrete, and a checklist to apply to your next feature.

A note on scope: this is not legal advice. The AI Act still needs formal endorsement by the Council and publication in the Official Journal, and the details that matter for compliance will come from the final text, guidance and standards.

1. Why "ethics" and not just "quality"

It is tempting to treat AI ethics as a subset of quality: a model that is biased or hallucinates is simply a bad model. That framing is useful but incomplete, for three reasons.

  • Harms fall on people who are not your users. A hiring screen affects candidates who never see the system. A deepfake harms the person depicted, not the person who generated it.
  • Trade-offs are real. Accuracy, fairness, privacy and helpfulness pull against each other. Choosing between them is a value judgment, not an optimisation problem with one right answer.
  • Scale changes the moral weight. A mistake a human makes once, a deployed model can make a million times before anyone notices.

Ethics is the discipline of making those value judgments deliberately, with reasons you can state and defend, instead of letting them be made by default.

2. Four lenses for thinking about AI decisions

Moral philosophy has argued about right action for 2,500 years. You do not need to settle the argument to use it. Each classic tradition asks a different, useful question about an AI feature.

Lens Core question Applied to an AI feature Typical blind spot
Consequentialism (Bentham, Mill) What outcomes does this produce, for everyone affected? Expected benefits vs. expected harms, including to non-users Averages hide the people who are badly hurt
Deontology (Kant) Does this respect people as ends, not merely as means? Consent, honesty, not deceiving users about what they are talking to Can ignore large consequences for the sake of a rule
Virtue ethics (Aristotle) What would a person of good character do here? What habits are we building? Does this team cut corners under deadline pressure? Would we be comfortable explaining it? Vague when you need a concrete decision
Ethics of care (Gilligan, Noddings) Who is vulnerable, and what do our relationships with them require? Children, people in crisis, people who cannot easily contest a decision Hard to scale to large populations

A simple practice: for any significant AI decision, ask all four questions. Where they agree, you can move fast. Where they disagree, you have found the part of the decision that deserves a meeting.

The AI Act itself mixes these lenses. Its risk tiers are consequentialist (regulate in proportion to harm). Its bans on manipulation and social scoring are deontological (some things should not be done to people regardless of the benefits). Its emphasis on vulnerable groups reflects the ethics of care.

3. The principles almost everyone agrees on

Since 2016, governments, companies and NGOs have published well over a hundred sets of AI principles. The OECD AI Principles (2019), the UNESCO Recommendation on the Ethics of AI (2021), the NIST AI Risk Management Framework (January 2023) and the Bletchley Declaration (November 2023) use different words, but they converge on a short list.

Principle Plain meaning A question to ask your team
Fairness The system does not systematically disadvantage people based on protected or irrelevant characteristics Have we measured performance separately for the groups this affects?
Transparency People know when they are dealing with AI and roughly how it reaches its outputs Would a user know this text, image or voice was generated?
Accountability A named human or organisation answers for the outcome If this goes wrong, whose phone rings?
Privacy Personal data is collected and used only as needed, lawfully Do we know what is in the training and retrieval data?
Safety and robustness The system behaves acceptably under stress, misuse and unusual inputs What happens when someone tries to break it on purpose?
Human oversight Humans can understand, intervene and override in consequential decisions Can a person stop or reverse this decision, and do they actually do it?
Beneficence The system should actually help people, not just avoid harm Who is better off because this exists?

The agreement is real, but it is agreement at the level of nouns. The hard work is in the verbs: how you measure fairness, what counts as adequate transparency, which human is accountable. That is where regulation and engineering practice come in.

4. What the EU AI Act asks for, in one page

The AI Act takes a risk-based approach. Obligations scale with the potential for harm, and most AI systems fall into the lowest tiers.

Tier Examples What applies
Unacceptable risk (banned) Social scoring; manipulative techniques that cause significant harm; exploiting vulnerabilities of age or disability; untargeted scraping of facial images; emotion recognition at work and in schools; biometric categorisation to infer sensitive traits; most real-time remote biometric identification by police in public spaces Prohibited, with narrow law-enforcement exceptions
High risk AI in hiring and worker management, education and exams, credit scoring, access to essential services, critical infrastructure, law enforcement, migration, justice, and safety components of regulated products Risk management, data governance, technical documentation, logging, transparency to deployers, human oversight, accuracy and robustness, conformity assessment
Transparency obligations Chatbots, deepfakes, AI-generated text published to inform the public, emotion recognition People must be told they are interacting with AI; synthetic content must be marked as such
Minimal risk Spam filters, recommendation of video game levels, most internal tooling No new obligations; voluntary codes encouraged

General-purpose AI models, the foundation models behind chatbots, have their own chapter. All providers must publish technical documentation, a summary of training content and a copyright policy. Models above a compute threshold (10^25 FLOPs of training compute) are presumed to pose "systemic risk" and face extra duties: evaluations, adversarial testing, incident reporting and cybersecurity.

Penalties are sized to get board attention: for prohibited practices, up to 35 million euros or 7% of worldwide annual turnover, whichever is higher.

Timing matters for planning. Based on the text approved by Parliament, the Act enters into force 20 days after publication in the Official Journal, expected around mid-year. The bans then apply after 6 months, the general-purpose model rules after 12 months, and most high-risk obligations after 24 months, with some product-related obligations at 36 months.

Three things builders often get wrong about it:

  • "It only affects EU companies." It applies to providers placing AI on the EU market and to deployers in the EU, wherever the provider is based. Like GDPR, it travels.
  • "It regulates the technology." Mostly it regulates uses. The same model can be minimal risk in a writing assistant and high risk in a CV screening tool.
  • "Open source is exempt." Partly. Free and open-source models get lighter treatment, but not if they are high risk, prohibited, or general-purpose models with systemic risk.

5. The rest of the map

The EU is the most detailed regime, not the only one. As of March 2024:

  • United States. No federal AI law. Executive Order 14110 (October 30, 2023) directs federal agencies to set standards and requires developers of the most powerful models to share safety test results with the government. NIST's AI Risk Management Framework is voluntary but widely used as a reference. In February, the FCC ruled that AI-generated voices in robocalls fall under existing robocall rules, after a fake Biden voice call targeted New Hampshire primary voters in January.
  • United Kingdom. A "pro-innovation", sector-led approach, plus the AI Safety Institute set up after the Bletchley Park summit in November 2023.
  • China. Specific rules for recommendation algorithms (2022), deep synthesis (2023) and generative AI services (August 2023).
  • Standards. ISO/IEC 42001, published in December 2023, is the first management system standard for AI. Expect it to become to AI governance what ISO 27001 is to information security: the thing customers ask about in procurement.
  • United Nations. The March 21 resolution, led by the United States and co-sponsored by more than 120 countries including China, is non-binding. Its significance is political: every member state signed up to the same vocabulary of human rights, safety and trustworthiness.

6. Three cases from the last two months

Principles are easiest to understand through failures. Three recent ones each illustrate a different principle.

Accountability: the chatbot is not a separate legal entity

On February 14, British Columbia's Civil Resolution Tribunal ruled in Moffatt v. Air Canada. The airline's website chatbot had told a customer he could apply for a bereavement fare refund after travelling; the airline's actual policy said otherwise. Air Canada argued, in the tribunal's words, that the chatbot was "a separate legal entity that is responsible for its own actions". The tribunal called this "a remarkable submission" and found the airline liable for negligent misrepresentation. The award was small, about 812 Canadian dollars, but the principle is large.

Lesson: you own what your AI says on your behalf. If a chatbot answers policy questions, the policy and the chatbot need to agree, and someone needs to be checking.

Fairness: overcorrection is also a failure

In late February, users found that Google's Gemini image generator produced historically inaccurate images, such as racially diverse depictions of 1940s German soldiers and of America's founders, in response to requests about specific historical groups. Google acknowledged it had "missed the mark" and on February 22 paused generation of images of people.

The underlying intent was reasonable: image models trained on internet data tend to produce stereotyped defaults, and nudging toward diversity for generic prompts ("a doctor", "a CEO") addresses a real problem. The failure was applying that nudge without regard to context.

Lesson: fairness is not a single dial you turn up. It depends on the task. Representing diversity in generic prompts and representing history accurately are different requirements, and a system needs to handle both. Test with prompts designed to find the edges of your mitigations, not only the cases they were built for.

Consent and dignity: deepfakes at scale

In late January, sexually explicit AI-generated images of Taylor Swift spread across X, one reportedly viewed tens of millions of times before removal. In the same weeks, the fake Biden robocall told New Hampshire voters not to vote in the primary. Neither required cutting-edge technology. Both exploited the gap between how easy generation has become and how slow detection, labelling and takedown still are.

Lesson: if your product generates images, audio or video of people, misuse is not an edge case. It is a primary design input. Provenance (content credentials such as C2PA, watermarks), likeness policies, abuse reporting and rate limits belong in version one.

7. Generative AI raises some new questions

Most AI ethics frameworks were written for classifiers and scoring systems. Large language models stretch them in four ways.

  1. Hallucination as an honesty problem. A model that states falsehoods fluently is not lying, but a product that presents those statements as reliable is making an implicit promise it cannot keep. Design for calibrated trust: cite sources, show uncertainty, and keep humans in the loop for consequential answers.
  2. Training data and consent. The New York Times sued OpenAI and Microsoft in December 2023 over the use of its articles in training. Whatever courts decide, the ethical question stands: creators did not consent to this use, and many feel the bargain of the open web has changed.
  3. Anthropomorphism. Chatbots that say "I feel" or simulate friendship can create attachment and dependence, particularly among lonely or young users. Respecting people as ends includes not engineering emotional reliance to raise engagement.
  4. Diffuse responsibility. A model provider, a fine-tuner, an application developer and a deployer can each point to the others. The AI Act's split between "providers" and "deployers" is partly an attempt to assign responsibility along this chain. Inside a company, the same problem appears between platform teams and product teams.

8. A builder's checklist

Ethics becomes practice when it is part of how features are specified, built and launched. Use this as a starting template and adapt it to your domain.

Before building

  • [ ] Write one paragraph on who is affected, including people who are not users.
  • [ ] Classify the use case against the AI Act tiers, even if you are not in the EU. It is a good proxy for risk.
  • [ ] Decide what the system must never do. Write it down as testable statements.
  • [ ] Name the accountable owner for outcomes, not just for uptime.

While building

  • [ ] Document data sources, licences and personal data, and why each is needed.
  • [ ] Measure quality per relevant subgroup, not only overall.
  • [ ] Red-team: give a few people an afternoon to make it misbehave, including people outside the team.
  • [ ] Test your mitigations at their edges, the Gemini lesson.

Before launch

  • [ ] Tell users when they are dealing with AI, and label generated media.
  • [ ] Give users a way to contest, correct or escalate to a human.
  • [ ] Check that what the AI says matches what your policies say, the Air Canada lesson.
  • [ ] Prepare an incident playbook: how you pause, roll back and communicate.

After launch

  • [ ] Log enough to investigate a complaint, and no more personal data than you need.
  • [ ] Review a sample of real interactions every week.
  • [ ] Re-run fairness and safety tests when the model, prompt or data changes.

9. Common objections, briefly answered

  • "Regulation will kill innovation." Possibly in some places, and that cost should be watched. But most AI applications sit in the minimal-risk tier with no new obligations. For high-risk uses (hiring, credit, exams), the requirements look a lot like good engineering practice: documentation, testing, logging, human review.
  • "Ethics is subjective." Some of it is contested. Much of it is not: few people think it is acceptable to deceive customers, discriminate in hiring or distribute non-consensual intimate images. Start with the uncontested core.
  • "We are too small to worry about this." Small teams ship to large audiences. And the habits a team forms early, virtue ethics would say, tend to be the ones it keeps.
  • "The model provider is responsible." For some things. You are responsible for how you deploy it, what you tell users, and what happens when it fails in your product.

Why this matters

  • The rules are arriving. The EU AI Act sets the first comprehensive legal baseline, and its reach extends to anyone serving EU users. The first bans are expected to apply before mid-2025.
  • Principles are converging. Fairness, transparency, accountability, privacy, safety and human oversight appear in every major framework. Arguing about the list is no longer the bottleneck.
  • Liability follows deployment. Air Canada shows courts will not accept "the AI did it" as a defence.
  • Mitigations need testing too. Gemini shows a well-meant fix can create a new failure.
  • Generative AI raises the stakes on consent and honesty. Deepfakes, training data and anthropomorphism are design decisions, not afterthoughts.

Final Thoughts

It is easy to treat AI ethics as compliance: a checklist the legal team hands you before launch. The AI Act will make some of it exactly that, and that is not a bad thing. Clear rules settle arguments that would otherwise be refought on every project.

But the deeper point of ethics is not to satisfy a regulator. It is to take seriously that the systems we build act on real people, many of whom never chose to use them. The four lenses, the shared principles and the checklist are tools for asking, before shipping, the question the people affected would ask if they were in the room. Put them in the room, at least in your design document, and most of the hard cases get easier.

Sources