AI ethics and the principles behind ISO 42001

ISO 42001  is built on ethical principles that are recognised internationally by organisations such as UNESCO  and the OECD . Not as abstract ideals, but as concrete starting points for how you develop and use AI. This page explains those principles and turns them into practice.

Why ethics in ISO 42001?

AI is not a neutral tool. It makes decisions that affect people. An algorithm that assesses credit applications decides who can buy a house. A system that screens job applications decides who gets work. A model that analyses medical images influences diagnoses.

Those decisions can turn out well or badly. They can be fair or discriminatory. They can be explainable or a black box. They can help people or harm them.

Ethical principles give direction to those choices. ISO 42001 translates those principles into concrete requirements and measures.

The six core principles

ISO 42001 and the wider AI ethics field converge on six principles. Different organisations name them differently (UNESCO , OECD , the EU, technology companies), but the core is the same.

1. Transparency

Transparency means it is clear how your AI works and which decisions it makes.

What it involves:

• People know when they are dealing with AI
• The operation of the system is documented
• The factors that influence decisions are known
• There are no hidden agendas

In practice:

• State on your website and in your products where AI is used
• Document your models: what are the inputs, what are the outputs, what is the logic?
• Make clear what the limitations are

Annex A controls: The controls in domain A.8 (Information for interested parties) cover this.

2. Explainability

Explainability goes a step further than transparency. It means that decisions are understandable to the people who are affected by them.

What it involves:

• The reasons behind an AI decision can be explained
• People can understand why they get a certain outcome
• The explanation is accessible, not only to experts

In practice:

• Provide an explanation with decisions: “Your application has been rejected because of X, Y and Z”
• Make feature importance visible
• Train staff to explain AI decisions to clients

The challenge: Some AI systems, especially deep learning models, are inherently difficult to explain. This is called a “black box”. The question then is: may you use such systems for decisions that affect people?

ISO 42001 asks you to make this trade-off conscious and to document it.

3. Fairness and non-discrimination

AI can discriminate, often without that being the intention. If the training data contains historical biases, the model learns those biases.

What it involves:

• AI may not systematically disadvantage certain groups
• Decisions are based on relevant factors, not on protected characteristics
• Bias is actively sought out and corrected

In practice:

• Analyse training data for representativeness
• Test models on different demographic groups
• Monitor outcomes for patterns of bias
• Have a process to correct bias when it is found

Subtle bias: Direct discrimination (a model that explicitly looks at gender) is easy to spot. Indirect discrimination is harder. A postcode can correlate with ethnicity. A choice of study can correlate with gender. These proxies can cause discrimination unintentionally.

4. Accountability

Accountability means that people are responsible for what AI does. AI is not an autonomous entity that makes decisions on its own, without human responsibility.

What it involves:

• Someone is always responsible for an AI system
• Decisions can be traced back
• There are mechanisms to hold people to account

In practice:

• Assign an owner to each AI system
• Document who makes which decisions
• Have an escalation process for problems
• Make sure logs record who did what and when

The EU AI Act makes this more concrete: board members can be held personally liable for AI failures.

5. Safety and reliability

AI must be safe and reliable. It must do what it is supposed to do, including in unexpected situations.

What it involves:

• Systems work predictably and consistently
• There are safeguards against misuse
• Failures are detected and handled
• Cybersecurity is in place

In practice:

• Test thoroughly before going live
• Monitor after deployment for deviations
• Have fallbacks for when AI fails
• Protect against adversarial attacks

The link with ISO 27001: This is where AI ethics meets information security. Many safety measures overlap. See ISO 42001 vs ISO 27001.

6. Privacy and data protection

AI learns from data, often personal data. Privacy is therefore fundamental.

What it involves:

• Personal data is collected and processed lawfully
• People have control over their data
• Data is protected against unauthorised access
• Data minimisation: only collect what is needed

In practice:

• Follow the Dutch GDPR (AVG, General Data Protection Regulation)
• Document which data you collect and why
• Implement privacy by design
• Consider techniques such as federated learning or differential privacy

From principles to practice

Principles are fine, but how do you turn them into daily practice?

The AI policy

Your AI policy (required under ISO 42001) must contain the ethical principles. Not as abstract text, but as concrete guidelines. You can read how to set up that policy together with the right roles and governance structure on the page Setting up AI governance.

Example: “We do not publish AI systems that make decisions about access to essential services without human control.”

“We test every model for bias before release and monitor it after release.”

The impact assessment

The AI impact assessment is where ethics becomes concrete. For each system you ask:

• Who is affected?
• Is it fair?
• Can people understand it?
• What happens if it goes wrong?

The control measures

The Annex A controls give concrete form to the principles:

• A.5 covers impact assessment
• A.7 covers data governance
• A.8 covers transparency
• A.9 covers responsible use

The culture

In the end, it comes down to culture. Do people think about ethics in their daily work? Do they dare to raise the alarm when something does not seem right?

You can have procedures, but if the culture is “ship it and see what happens”, they will not help.

Ethical dilemmas

Not everything is black and white. There are real dilemmas with no perfect answers.

Fairness versus performance: Sometimes a model performs better when it uses indirect proxies for protected characteristics. Which matters more?

Transparency versus misuse: Full transparency about how a system works makes it vulnerable to gaming and misuse. How far do you go?

Privacy versus safety: More data can produce a safer system. But it affects privacy. Where is the line?

Innovation versus caution: Innovating quickly means taking risks. Being cautious means missing opportunities. How do you balance them?

ISO 42001 does not resolve these dilemmas. But it forces you to make them explicit, think about them, and document your choices.

International frameworks

ISO 42001 does not stand alone. There are wider frameworks that underpin the ethical principles:

OECD AI Principles (2019): Adopted by 46 countries. Focus on inclusive growth, sustainability, human-centred design, transparency, safety and accountability.

UNESCO Recommendation on the Ethics of AI (2021): The first global standard. Adopted by 194 countries. Human rights and dignity as the foundation.

EU AI Act (2024): Legislation that makes the principles legally binding. Prohibited practices, high-risk requirements, transparency obligations.

Corporate frameworks: Microsoft, Google, IBM and others have published their own AI principles. They overlap strongly with the international frameworks.

Getting started in practice

If all of this feels overwhelming, start small:

1. Choose one AI system that has an impact on people
2. Ask the basic questions: Who is affected? Is it fair? Can we explain it?
3. Document your answers honestly, including the uncomfortable ones
4. Identify one improvement you can make
5. Carry it out and repeat

Ethics is not a checklist you finish once. It is an ongoing practice of asking questions and getting better.

Further reading

• AI impact assessment: ethics in practice
• Annex A controls: concrete measures
• EU AI Act: ethics in legislation
• Common mistakes: what to avoid