- Separate technical, legal, operational, and user risks.
- Use a simple map inspired by NIST: govern, map, measure, and manage.
- Decide when an AI app can be published and when it must remain in pilot.
Four questions before publishing
- Govern: who decides, who reviews, and what is prohibited.
- Map: which users, data, tools, and decisions the system touches.
- Measure: which tests check for errors, bias, privacy, and abuse.
- Manage: which limits, logs, permissions, and processes reduce risk.
Minimum risk card
Practical Responsible AI
Do not turn it into an abstract manifesto. For each system, review bias, accessibility, explainability, privacy, ability to appeal, and harm from automating too much.
responsible_ai_check:
affected_users:
- customers
- employees
possible_biases:
- language
- technical_level
- accent_or_audio
mitigations:
- human review for sensitive decisions
- manual alternative available
- logs without full personal data
- brief explanation of limits to the user
appeal: "human support email"riesgo:
nombre: "responding with fabricated medical information"
sistema: "support chatbot"
usuarios_afectados: ["customers", "support team"]
datos: ["questions", "ticket history"]
probabilidad: medium
impacto: high
controles:
- limit domain
- respond with sources
- abstain when there is no evidence
- human review for sensitive cases
tests:
- questions without evidence
- malicious instructions
- personal data in prompt
responsable: "product team"
fecha_revision: "2026-07-03"