Responsible AI
A model that is 95% accurate is still wrong 5% of the time, and those errors land on real people — a rejected loan, a frozen wallet, a misread prescription. Responsible AI is deciding before launch who carries that cost.
Fairness: measure it, do not assume it
Bias enters through data, not malice. If past approvals favoured applicants from one city, a model trained on them learns that preference and applies it at scale. Audit the outcomes by group:
import pandas as pd
df = pd.DataFrame({
"group": ["A", "B", "A", "B", "A", "B", "A", "B"],
"approved": [0, 1, 0, 1, 1, 1, 0, 1],
})
rates = df.groupby("group")["approved"].mean()
print(rates)
print("Ratio:", round(rates.min() / rates.max(), 2)) # 0.5 -> investigate
Dropping the sensitive column does not remove the bias: pincode, surname, or even the price of the phone used can act as proxies. Measure the outcome, not the inputs.
Privacy and India's DPDP Act, 2023
The Digital Personal Data Protection Act, 2023 is India's law for digital personal data, and it changes how you design a system, not merely how you word the privacy policy.
| Term | Who it means |
|---|---|
| Data Principal | The individual the data is about |
| Data Fiduciary | The organisation deciding why and how data is processed — usually you |
| Data Processor | A vendor processing on the fiduciary's behalf, such as a cloud or annotation partner |
| Significant Data Fiduciary | A larger or higher-risk fiduciary the government notifies, with extra duties |
Duties that show up in engineering decisions:
- Give a clear notice and take consent for a stated purpose; withdrawing consent must be as easy as giving it.
- Purpose limitation and minimisation — do not feed a model columns you cannot justify against that purpose.
- Honour Data Principal rights: access, correction, erasure and grievance redressal. "It is baked into the model weights" is not an answer, so keep training sets reproducible enough to drop a record and retrain.
- Report personal data breaches to the Data Protection Board and to the affected individuals.
- Children's data requires verifiable parental consent, and tracking or targeted advertising to children is barred.
- Penalties run to hundreds of crores of rupees, so this is a board-level risk, not a checkbox.
Rules under the Act are being phased in, so confirm the current notified text before finalising a design.
Transparency, oversight and security
Keep a one-page model card: purpose, training data, known limits, metrics per group, named owner. For any decision touching a person's money, health or job, keep a human who can see the reason and overrule it — and make sure that reviewer is rewarded for disagreeing, not for clearing the queue. On the security side, treat any text the system ingests (a supplier PDF, a customer email) as data and never as instructions, and keep personal data out of prompts sent to third-party APIs unless the contract and the consent allow it.
Pre-launch checklist
| Question | Evidence you should be able to produce |
|---|---|
| What decision does this make, and who is affected? | A model card |
| How does it perform per group? | Metrics split by the groups that matter |
| What personal data is used, under what consent? | Data inventory and the notice text |
| How does someone contest a decision? | A documented appeal route with a named owner |
| What happens when it fails? | Fallback path, rollback plan, monitoring alerts |
Common mistakes
- Auditing fairness once at launch and never again as the data drifts.
- Deleting the sensitive attribute and declaring the model unbiased.
- Collecting "everything, just in case" — under DPDP that is a liability, not an asset.
- Human oversight that exists on paper only, where the reviewer clears 400 cases an hour.
Practice
Take any AI feature you are planning and fill in the checklist table above. For the privacy row, list every personal field it touches and write one sentence justifying each against the stated purpose; then delete the fields you could not justify.