Principles of Responsible AI · Topic 2 of 2
Privacy, Security, Inclusiveness, Transparency and Accountability
AI-901 responsible AI: privacy and security, inclusiveness, transparency and accountability, with consent, managed identities and human oversight.
- 5 min
- Privacy: consent, minimisation, masking and encryption. Security: managed identities, Key Vault and least privilege.
- Inclusiveness: design for different abilities, with several input modes and diverse testing.
- Transparency: explain predictions, document the model and disclose AI generated content.
What it is
The other four principles are about data, people and trust. Privacy and security protect personal data and the system itself. Inclusiveness means the solution works for people of all abilities and backgrounds. Transparency means people can understand what the system does and its limits. Accountability means humans remain responsible for the system and its effects.
How it works
Privacy and security
AI systems often handle personal information, so people need control over it and the system needs protection.
- Consent. Ask people for permission for each purpose, and let them withdraw it. Asking for consent gives people control over how their personal information is used.
- Data minimisation. Collect and keep only what the solution needs.
- Protection. Encrypt data at rest and in transit, remove or mask personal details, and limit who can read it.
- Safe credentials. Do not put keys in code. Use a managed identity with Microsoft Entra ID, which needs no stored key, or keep any remaining key in Azure Key Vault.
- Least privilege. Give the app and its users only the access they need.
- Data handling by the platform. Microsoft states that prompts and completions sent to Azure models are not used to train the base models.
| Measure | Principle it supports |
|---|---|
| Ask for consent for each purpose | Privacy |
| Mask personal data in training sets | Privacy |
| Encrypt audio recordings at rest | Privacy and security |
| Use a managed identity instead of a key | Security |
Inclusiveness
An inclusive solution is usable by people with different abilities, languages and circumstances. Practical steps are:
- Test with users who have a range of abilities, and involve them in design.
- Offer more than one way to interact, such as both voice and text input.
- Support screen readers and captions.
- Make sure the system works for the languages and accents of its users.
A voice assistant that also accepts typed input, and has been tested with people who speak in different ways, supports inclusiveness.
Transparency
Users and developers should be able to understand what the AI does, what it was built for and where it can fail.
- Explain which inputs drive a prediction, so people can see why a result was reached.
- Document the model, including its intended use, limits and data, for example in a model card.
- Tell people they are dealing with AI, and when content was generated.
- Show sources. A grounded answer can cite the documents it used.
- Mark generated media. Images from Azure image generation models carry provenance information, known as content credentials, which states that they were AI generated.
Accountability
People, and not the model, are accountable for what an AI system does.
- A governance process approves models before deployment and defines who owns each system.
- Human review is required for high impact decisions, such as lending or medical advice.
- Audit logs record what the system did, so decisions can be reviewed.
- Incident response defines what happens when the system causes harm.
Telling the principles apart
| If the example says... | Principle |
|---|---|
| Treat similar groups equally | Fairness |
| Test with edge cases, content filters, red teaming | Reliability and safety |
| Consent, masking, encryption, managed identity | Privacy and security |
| Screen readers, voice and text input, diverse testers | Inclusiveness |
| Explain predictions, model cards, disclose AI | Transparency |
| Governance board, human review, audit trail | Accountability |
A worked scenario
A hospital builds a voice assistant that books appointments. It asks patients for consent before storing recordings, masks names in the logs, encrypts the audio at rest, and reaches its database with a managed identity. The team tests with patients who have speech and hearing differences, and offers typed input as well as voice. The assistant says that it is an AI and explains what it can and cannot do. A governance group approves each release, and a nurse reviews any case where the assistant suggests urgent action.
What to remember for the exam
- Privacy: consent, minimisation, masking and encryption. Security: managed identities, Key Vault and least privilege.
- Inclusiveness: design for different abilities, with several input modes and diverse testing.
- Transparency: explain predictions, document the model and disclose AI generated content.
- Accountability: governance, human review of high impact decisions and audit trails.
- Generated images carry provenance information that marks them as AI generated.
Look for who is answerable. "A person approves", "governance process" and "human review" are accountability. "Explain which inputs drive the prediction" is transparency.
How the exam asks about this
- "Which practice gives people control over their personal information?" Asking for consent for each purpose.
- "Two actions that support inclusiveness." Test with users of varied abilities and offer voice and text input.
- "Two actions that put accountability into practice." A governance process that approves deployments and human review of high impact decisions.
- "Explaining which inputs drive each prediction." Transparency.
Common mistakes
Calling encryption transparency. Encryption protects data, which is privacy and security.
Mixing up transparency and accountability. Transparency is about understanding the system. Accountability is about who is responsible.
Putting keys in code or config files. Use a managed identity or Key Vault.
Thinking accountability can be handed to the model. A person or organisation always owns the outcome.
Check yourself
Which action gives people control over how their personal data is used?
Asking for consent for each purpose.
Which two measures lower the risk of an API key being exposed?
Using a managed identity with Microsoft Entra ID, and storing any key in Azure Key Vault.
What does human review of high impact decisions support?
Accountability.
Topic 2 of 2 in Principles of Responsible AI
Test yourself on Principles of Responsible AI
The full Microsoft AI-901 question bank has 511 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.