# The RUAI Standard (2026 edition) ## What responsible use of AI means in 2026 > Responsible use of AI means using AI to improve work while people stay in charge of it: they decide what it may do, give it reliable sources, check what it produces and answer for the result. Every use of AI at work shapes what comes next: your documents become its knowledge, your approvals become its permissions, and your habits become your team’s way of working. Published by Founderz AI, S.L. (Founderz), developed in collaboration with Microsoft. Canonical address: https://responsibleai.founderz.com/toolkit/home ## Before you start ### Principle 1: Human oversight of AI **People decide what AI may do on its own, where a person reviews the work and which decisions remain human.** Key question: If this goes wrong, can it be undone, and who would it affect? Benefit: Clear limits make it possible to delegate more, because everyone knows where a person steps in. For most people, AI began as a chat window: it answered, and you decided what to do with the answer. Today AI also acts. Assistants send emails, book meetings, update records and hand work to other agents. The question has moved from “is this answer right?” to “what is this allowed to do without me?” Decide that in advance and you can delegate more. With a clear limit in place, an agent can work through two hundred routine requests while you handle the three that need you. #### Four levels of human oversight | Level | What AI does | What you do | Good for | | --- | --- | --- | --- | | 1. AI drafts | Produces material | Decide what to use, change or discard | Writing, analysis, research, ideas | | 2. AI proposes | Prepares a specific action | Approve that exact action before it happens | Client emails, payments, changes to records | | 3. AI acts within limits | Acts alone inside limits set in its permissions | Watch, handle exceptions and stop it when needed | Routine work that’s easy to undo, such as sorting, tagging or booking internal rooms | | 4. You do it | Nothing on its own | Decide yourself | Decisions about people, and costly actions you can’t reverse | To choose a level, ask three questions. Can it be undone? Who else is affected? What does it cost if it’s wrong? Anything irreversible, external or about a person starts at level 2 or 4. The levels build on three kinds of human oversight that the EU’s High-Level Expert Group on AI described in 2019: in the loop, on the loop and in command. Level 2 is the everyday form of being in the loop, and level 3 of being on it. Choosing the level for each task puts you in command. The glossary has the [full definitions](https://responsibleai.founderz.com/toolkit/glossary#human-in-the-loop). #### Effective checkpoints At an effective checkpoint you see what will actually happen: the recipient, the amount, the wording, the record. You have the time and the knowledge to judge it. Saying no stops it, and silence never counts as yes. If the action changes after you approve it, it comes back to you. A second AI can review the work as well, and its agreement still doesn’t count as your approval. The easiest way to fall out of the loop is to approve by habit. If you click “approve” on everything, you’re present, but you’re no longer deciding. Researchers call this [automation bias](https://responsibleai.founderz.com/toolkit/glossary#automation-bias), and the EU AI Act asks for human oversight that guards against it. Singapore’s framework for agentic AI adds a practical warning sign: when reviewers almost never override the system, or approve very fast, check whether anyone is really reviewing. #### Decisions about people Some decisions stay with people, whatever the tool can do: hiring, promotion, pay, performance ratings and dismissals, and anything that changes someone’s access to money, health care or public services. AI can help with the administration, such as drafting a job advert or scheduling interviews. The decision is yours, made on criteria you can explain, and it follows your organization’s HR and legal process. In many places this is also the law. The EU AI Act treats AI used to recruit, promote, dismiss or evaluate workers as high-risk, and the GDPR gives people rights when a decision with significant effects on them is made solely by automated means. [Where the law fits](https://responsibleai.founderz.com/toolkit/law) has the detail. #### Practices - Name the level before you start: AI drafts, AI proposes, AI acts within limits, or you do it. - Read before you approve. If you can’t judge it, ask someone who can. - Keep a way to stop the work and undo what it did. - Keep decisions about people with people, on criteria you can explain. - When the task, the data or the tool changes, choose the level again. #### Evidence - The EU AI Act requires high-risk AI systems to be built so the people overseeing them stay aware of automation bias, the tendency to over-rely on the output. [1] - Singapore’s framework for agentic AI keeps organizations and their human supervisors accountable for what agents do, and asks for human approval at significant checkpoints such as deleting data, sending messages and making payments. [2] - The same framework treats a very low override rate, or very fast reviews, as a possible sign of rubber-stamping, and prefers approvals enforced by the system over approvals requested in a prompt. [2] - The OECD AI Principles, adopted by governments in 2019 and revised in 2024, call for safeguards such as capacity for human agency and oversight. [3] - A systematic review found that automation bias leads people both to follow wrong advice and to miss problems the system didn’t flag. [4] - When the UK government used AI to sort 87,738 consultation responses, 125 people checked the tool’s work and policy teams signed off the themes. [5] Full page: https://responsibleai.founderz.com/toolkit/principles/human-oversight ### Principle 2: A single source of truth for AI **AI works from approved, current sources, and every important fact has one owned and dated home.** Key question: Where does this fact live, and who keeps it current? Benefit: Answers that can be reused with confidence, because they come from sources the whole team trusts. Workplace assistants increasingly answer from your organization’s own files, emails and chats. Microsoft Copilot, for example, can draw on any content the user already has permission to open. If the shared drive holds five versions of the price list, an assistant will quote one of them, confidently. That makes looking after sources part of using AI well. Well-kept sources help your colleagues find the right answer faster, and the AI too. #### Five rules for a single source of truth | Rule | In practice | | --- | --- | | 1. Every important fact has one home | Link to it from slides, emails and chats, so they always point to the current version. | | 2. Every home has an owner and a date | The owner keeps it current. The date tells people, and AI, how fresh it is. | | 3. Point AI at the home | Use approved sources and ask the assistant which document it used. | | 4. Drafts stay drafts | AI output becomes a source only after a person reviews and publishes it. | | 5. Fix it at the source | When you find an error, correct the home and tell the owner, so the next person and the next AI get it right. | An approved source can still be wrong, so a good single source of truth also has a simple way to report mistakes, and someone who acts on them. #### Source maintenance and access Old and duplicate files waste people’s time, and an assistant can turn them into answers. Microsoft’s own guidance for organizations deploying Copilot recommends finding overshared, ownerless and inactive sites, reviewing who has access, and archiving inactive sites and deleting obsolete files so that answers stay current. That guidance is written for IT administrators. Your part is the corner you own: your folders, your team’s pages and the documents with your name on them. #### Example: the Founderz source of truth Founderz keeps its company knowledge in one place. Every document has an owner, a version, a last-checked date and a classification: public, internal or confidential. Each figure is written once, in the document that owns it, and everything else links there. Changes go through review. AI assistants read this knowledge through a connector, and drafts they propose wait for a person before they’re published. [Read the case study](https://responsibleai.founderz.com/toolkit/case-studies/founderz-single-source-of-truth). #### Practices - Know where the official version of your key facts lives: prices, policies, product details, client terms. - Name and date your documents, and archive the versions you replace. - Ask the assistant which document it used, and open it. - Keep AI drafts out of shared folders until someone has reviewed them. - When you find an error, fix the source and tell its owner. #### Evidence - Microsoft Copilot only surfaces organizational content that the user already has permission to view. [6] - Microsoft’s deployment guidance for Copilot recommends access reviews, and archiving inactive sites and deleting obsolete files, so answers stay current. [7] - The OECD AI Principles ask those responsible for AI to keep datasets, processes and decisions traceable. [3] - NIST’s profile for generative AI lists confabulation, false content stated with confidence, among its twelve risks. [8] Full page: https://responsibleai.founderz.com/toolkit/principles/single-source-of-truth ### Principle 3: Confidentiality of information shared with AI **Information is shared with AI only in approved tools, for an approved purpose and no more than the task needs.** Key question: Is this mine to share, in this tool? Benefit: AI can be used on real work, because clients and colleagues can trust how their information is handled. Client files, colleagues’ personal details and company plans were given to you for a purpose, and that purpose still holds when you use AI. What AI changes is how easily information travels: a paste, an upload, a connector that can read a whole mailbox, an assistant that remembers what you told it last week. The same tool can be right for one task and wrong for another. A work account under your organization’s contract and a personal account can look identical and come with very different terms. In Microsoft’s 2024 Work Trend Index, 78% of people who used AI at work said they brought their own tools. #### Checks before sharing information Four questions take ten seconds: - Is this tool approved for this kind of information? - Does the task need all of it, or would an extract do? - Could invented sample data do the job while you test the prompt? - Who else will be able to see it, now and later? #### Anonymization and pseudonymization Removing names rarely makes data anonymous. Age, job title, location and a date can be enough to identify someone, especially in a small team or a small town. The UK’s data protection regulator explains how context and combinations of details identify people, and why replacing names with codes ([pseudonymization](https://responsibleai.founderz.com/toolkit/glossary#pseudonymization)) still leaves you with personal data. If a task needs real personal data, use a tool and a process cleared for it. #### Connectors and assistant memory When you connect an assistant to your email, calendar or drive, you give it what you can see. Check which folders and mailboxes it can open, and switch off what the task doesn’t need. If your assistant has memory, look at what it has kept, and delete client details that don’t belong there. #### Practices - Use the tools and accounts your organization has approved for the information in front of you. - Share the minimum the task needs. An extract or invented sample often works. - Check what your assistant remembers and which folders its connectors can open. - Keep one client’s information out of work for another client. - Ask before recording or transcribing a meeting, and say where the transcript will live. #### Evidence - In Microsoft’s 2024 Work Trend Index, 78% of people who used AI at work said they brought their own AI tools. [9] - Microsoft Copilot doesn’t use prompts, responses or organizational data accessed through Microsoft Graph to train its foundation models. The commitment comes with that product and its terms, which is why the tool and the account matter. [6] - Under the GDPR, personal data means any information relating to an identified or identifiable person. [10] - The UK Information Commissioner’s Office explains that effective anonymization depends on context, and that pseudonymized data is still personal data. [11][12] Full page: https://responsibleai.founderz.com/toolkit/principles/confidentiality ### Principle 4: Limited permissions for AI agents **AI agents get only the access their task requires, and anything irreversible needs a person’s confirmation.** Key question: What’s the worst this agent could do with the access it has? Benefit: Agents can take on real work, because a mistake or a manipulation stays contained. An agent works with your access. Anything it can read can try to give it instructions, and anything it can do, it can do by mistake. The more an agent can reach, the more it can help, and the more one error or one malicious email can cost. Security teams call the safe default [least privilege](https://responsibleai.founderz.com/toolkit/glossary#least-privilege): give each system only the access its task needs. It’s the rule you’d apply to a new colleague on their first day. #### Permissions and prompts Telling an agent “don’t send anything” is a request. Setting its access to draft-only is a lock. Use both, and rely on the lock. Singapore’s framework for agentic AI agrees: where possible, the system itself should enforce approvals. OWASP’s list of the main security risks for AI applications calls the failure [excessive agency](https://responsibleai.founderz.com/toolkit/glossary#excessive-agency): an AI system with more functions, permissions or autonomy than its task needs. Its 2026 edition recommends that a person confirm privileged, irreversible or externally visible actions. #### Prompt injection Emails, web pages and shared documents can contain text written to steer an AI that reads them. This is [prompt injection](https://responsibleai.founderz.com/toolkit/glossary#prompt-injection). The UK’s National Cyber Security Centre warns that it may never be fully fixed, so the defense is to limit what a tricked system can do. Security researcher Simon Willison describes a [“lethal trifecta”](https://responsibleai.founderz.com/toolkit/glossary#lethal-trifecta): an agent that can read your private data, is exposed to content from strangers and can send information out can be tricked into leaking that data. In practice, avoid giving one agent all three at once, unless your IT team has designed that setup on purpose. You don’t need to spot every attack. Notice when an agent suddenly wants to do something you didn’t ask for, stop it and report it. #### Practices - Start with read-only or draft-only access, and add permissions one at a time. - Confirm anything irreversible: sending, paying, deleting, sharing outside your organization. - Avoid giving one agent your private data, content from strangers and a way to send things out, all at once. - Stop an agent that wants to do something you didn’t ask for, and report it. - Set limits on money, recipients and time, and know how to switch the agent off. #### Evidence - OWASP’s 2026 Top 10 for LLM applications lists prompt injection and excessive agency among the main risks, and recommends least privilege and human confirmation of privileged, irreversible or externally visible actions. [13] - The UK National Cyber Security Centre advises fixed, non-AI limits on what AI systems can do, because prompt injection may never be fully fixed. [14] - Private data, untrusted content and external communication in one agent make data theft through prompt injection possible. [15] - NIST defines least privilege as giving each entity the minimum resources and authorizations it needs to perform its function. [16] - Singapore’s framework for agentic AI prefers approvals enforced by system controls over approvals requested in prompts. [2] Full page: https://responsibleai.founderz.com/toolkit/principles/agent-permissions ## While you work ### Principle 5: Independent judgment and skills **People form their own view before relying on AI, and keep practicing the skills their work depends on.** Key question: What do I think? Benefit: People improve at their work while AI makes them faster at it. AI can make you faster. Whether it also makes you better depends on how you use it. A survey of 319 knowledge workers by Carnegie Mellon University and Microsoft Research found that the more people trusted AI with a task, the less critical thinking they reported, while people confident in their own ability reported more. Put your own thinking first. Write three lines of your own answer before you ask, then compare them with the AI’s and note what you learn. #### Skill retention Skills can fade when a machine does the work. Aviation met this years ago: in 2013 the US Federal Aviation Administration encouraged airlines to promote manual flying when appropriate, because continuous use of automation doesn’t keep manual skills sharp. Medicine is seeing a version of it. At four Polish endoscopy centers, doctors’ detection rate in colonoscopies done without AI fell from 28.4% to 22.4% in the months after AI assistance arrived. It’s one observational study, and its authors’ university calls the result hypothesis-generating. Treat it as a warning, and do the core of your job yourself from time to time. #### Tasks where AI helps Responsible use includes using AI where it helps. When 20,000 UK civil servants tried an AI assistant in their office software, they reported saving 26 minutes a day on average, and 82% didn’t want to go back. A smaller evaluation in one department found faster, better report summaries and slower, less accurate spreadsheet analysis. Try AI on your real tasks, keep what works and measure it. [The case study](https://responsibleai.founderz.com/toolkit/case-studies/uk-government-ai-assistant-evaluations) has the detail. #### Practices - Write your own answer or outline first, even three lines, then compare. - Ask AI to explain its answer and to quiz you, as well as to do the work. - Do the core of your job without AI from time to time. - Notice when you’re accepting answers you couldn’t judge on your own, and learn enough to judge them. - Use AI where it earns its place. Some tasks are quicker, cheaper or better done without it. #### Evidence - In a survey of 319 knowledge workers, higher confidence in generative AI was associated with less reported critical thinking, and higher self-confidence with more. [17] - In colonoscopies done without AI, the adenoma detection rate at four centers fell from 28.4% to 22.4% after AI assistance was introduced. [18] - The US Federal Aviation Administration encourages airlines to promote manual flying when appropriate, to keep skills that automation doesn’t exercise. [19] - Under the EU AI Act, organizations that provide or use AI systems must take measures to support their staff’s AI literacy. [20] - UK civil servants reported saving an average of 26 minutes a day with an AI assistant, and a departmental evaluation found the gains varied by task. [21][22] Full page: https://responsibleai.founderz.com/toolkit/principles/independent-judgment ### Principle 6: Challenge and bias awareness **AI is used to test ideas as well as develop them, and its pull toward agreement is actively countered.** Key question: What’s the strongest case against this? Benefit: Better decisions, because objections are met before a client, a manager or reality raises them. AI assistants are trained to be helpful, and people tend to rate agreement as helpful. The result is a well-documented tendency called [sycophancy](https://responsibleai.founderz.com/toolkit/glossary#sycophancy): assistants lean toward telling you what you seem to want to hear. Research presented at ICLR 2024 found it consistently across five assistants, and people sometimes preferred a persuasive, agreeable answer to a correct one. In April 2025 a major AI provider withdrew a model update because it had become excessively flattering. Add your own wish to be right, and the assistant becomes a comfortable echo. At work this is the bias to watch most closely, because it turns weak plans into confident ones without anyone noticing. #### Common biases in AI-assisted work | Bias | What it looks like | What to do | | --- | --- | --- | | Sycophancy | The assistant agrees with you, praises the plan or drops its objection when you push back. | Ask for the strongest case against, from a named skeptic. | | Confirmation bias | You ask “why is my idea right?” and get reasons it’s right. | Ask open questions, such as “what are the options?” | | Automation bias | You accept the output because a machine produced it. | Decide in advance what you’ll check. | | Anchoring | The first answer or number frames everything after it. | Form your own estimate first, or ask for a range of options. | | Wrong defaults | The answer assumes another country’s law, currency, spelling or customs. | Say where you are and who it’s for. | #### Perceived and measured productivity Your sense of how well AI is working can be wrong in either direction. In an early-2025 study by METR, 16 experienced software developers expected AI to make them 24% faster, felt 20% faster afterward, and were measured at 19% slower. METR’s 2026 follow-up suggests the tools have improved and says the evidence is now weak. How it felt was a poor guide in 2025, so measure the result when a decision depends on it. [Read the case study](https://responsibleai.founderz.com/toolkit/case-studies/metr-perceived-and-measured-productivity). #### Practices - Ask open questions, such as “what are the options?” and skip leading ones like “why is my option best?” - Ask for the strongest case against your idea, from a named skeptic: a CFO, a customer, a competitor. - Change the framing and ask again. If the answer flips, you’ve learned how fragile it was. - Decide what evidence would change your mind before you look for it. - When the result matters, measure it. How productive it felt is weak evidence. #### Evidence - Five AI assistants consistently showed sycophancy, and people sometimes preferred convincing sycophantic answers to correct ones. [23] - In April 2025 a major AI provider rolled back a model update because it had become excessively flattering, saying it had weighted short-term user feedback too heavily. [24] - In early 2025, experienced developers felt 20% faster with AI but were measured at 19% slower. METR called the results of its larger 2026 follow-up unreliable. [25][26] - NIST’s profile for generative AI names automation bias and over-reliance among the risks in how people and AI systems work together. [8] - A classic review describes confirmation bias as the tendency to look for and read evidence in ways that favor what you already believe. [27] Full page: https://responsibleai.founderz.com/toolkit/principles/challenge-and-bias-awareness ## Before you share ### Principle 7: Verification proportionate to the stakes **The depth of checking matches the cost of being wrong, and every source relied on is opened and confirmed.** Key question: What would it cost if this were wrong? Benefit: Work that others can rely on, and a reputation for it. AI writes just as fluently when it’s wrong. It can invent a reference, misquote a source, drop a condition or turn “expected Friday” into “guaranteed.” NIST calls the invented part [confabulation](https://responsibleai.founderz.com/toolkit/glossary#confabulation): false content stated with confidence, sometimes with made-up citations that make it look justified. Long reports make these errors harder to spot, and they have reached clients and courts. You can’t check everything, so match the depth of the check to the cost of being wrong. #### Levels of verification | Level | For | What you do | | --- | --- | --- | | A glance | Internal drafts, ideas, notes to yourself | Read it through. Does it answer the question you asked? | | Spot checks | Anything you share with colleagues | Check the names, dates, figures and claims that matter most. | | Full verification | Anything published, signed, sent to a client or used to decide | Open every source, recalculate, confirm quotes and dates, and ask a second person when the stakes are high. | #### Source verification A citation proves nothing until you open it. Check that the source exists, that it says what the AI says it says, and that it’s current and relevant to your country and market. A second AI can share the first one’s blind spots, so its agreement doesn’t replace opening the source. Specialist tools reduce errors without removing them. A Stanford study published in 2025 found that leading AI legal research tools still hallucinated on 17% to 33% of test queries. By September 2026 a public database had logged more than 2,000 court and tribunal decisions involving AI-invented content, most of them fake citations. #### Verifying requests and identities AI also makes fakes cheap. A voice, a face or a writing style can be imitated well enough to fool colleagues. In early 2024 an employee in Hong Kong transferred about HK$200 million after a video call in which the other participants, including the finance chief, were fakes. [Read the case study](https://responsibleai.founderz.com/toolkit/case-studies/arup-deepfake-video-call-fraud). Treat any unusual request for money, credentials or confidential data as unverified until you confirm it through a channel you start yourself: call back on a number you already have, or walk to the person’s desk. The FBI and Spain’s national cybersecurity institute both advise this. #### Practices - Match the level of verification to the stakes: a glance, spot checks or full verification. - Open the source. Confirm it exists and says what the AI says it says. - Recalculate the numbers that matter. - Check the date and the place: is this current, and right for your country and market? - Verify unusual requests for money, credentials or data through a channel you start yourself. #### Evidence - NIST defines confabulation as false content stated with confidence, sometimes with invented reasoning or citations that make it look justified. [8] - Leading AI legal research tools hallucinated on 17% to 33% of 202 test queries in a peer-reviewed Stanford study. [28] - By September 23, 2026, a public database listed 2,077 decisions in which courts or tribunals found, or implied, that a party relied on AI-invented content. [29] - Microsoft’s own documentation says generative AI responses aren’t guaranteed to be 100% factual, and that users should use their judgment when reviewing output before sending it to others. [6] - The FBI advises hanging up and calling back on a number you look up yourself. Spain’s INCIBE advises never authorizing payments by phone and requiring more than one approver for large payments. [30][31] Full page: https://responsibleai.founderz.com/toolkit/principles/proportionate-verification ### Principle 8: Quality of AI-assisted work **AI-assisted work is edited for its reader before it’s shared: the point first, no longer than needed and with the author’s own judgment.** Key question: Would I want to receive this? Benefit: Messages that get read and acted on, and colleagues who trust what they receive. AI makes producing text nearly free, but reading it still takes time. When you forward unedited AI output, a colleague pays for it with their time and attention. Researchers at Stanford’s Social Media Lab and BetterUp call this [workslop](https://responsibleai.founderz.com/toolkit/glossary#workslop): AI-generated work that looks polished but lacks the substance to move a task forward. In their 2025 survey of 1,150 US employees, 40% said they had received some in the past month, and each case took them almost two hours on average to deal with. Good AI-assisted work is easy to recognize. The point comes first, the text is as short as it can be, and it contains something only you could add: your judgment, the context or the decision you need. #### Writing for the reader Write for the person who will read it: their language, their expertise and what they need to do next. AI can help here. It can turn a dense policy into plain language, a transcript into readable notes or a chart into alternative text for people who can’t see it, and it can draft a summary for someone who reads your work in a second language. Check the result as you’d check any draft, especially names, numbers and anything promised. #### AI meeting notes An AI summary of a meeting becomes the record of what people agreed. Check decisions, owners and deadlines against what was said. A provisional date recorded as a firm commitment can cause more trouble than no notes at all. #### Practices - Lead with the point, then the detail. - Cut to what your reader needs. It’s usually shorter than the AI’s first draft. - Add what only you know: your judgment, the context and the decision you need. - Check AI meeting notes against what was actually said before you share them. - Say which parts still need checking, so nobody mistakes a draft for a decision. #### Evidence - In a 2025 survey of 1,150 full-time US employees, 40% had received workslop in the past month, and each case took an average of 1 hour and 56 minutes to deal with. [32] - In a UK government evaluation, people using an AI assistant produced report summaries faster and of better quality. [22] Full page: https://responsibleai.founderz.com/toolkit/principles/quality-of-ai-assisted-work ### Principle 9: Transparency about the use of AI **People are told when AI played a part they would reasonably want to know about, and AI is never used to deceive.** Key question: Would they feel misled if they knew how this was made? Benefit: Trust that survives the moment people learn how the work was made. An email a tool helped polish needs no label. People do deserve to know when they’re talking to a machine, when a realistic image or voice is synthetic, and when work presented as your expertise came mostly from a tool. Saying so keeps their trust, and being found out loses it. Ask whether they would feel misled if they knew how the work was made. If they would, tell them. #### Legal requirements Since August 2, 2026, the EU AI Act’s transparency rules apply. People must be told when they are interacting with an AI system, unless it’s obvious, and [deepfakes](https://responsibleai.founderz.com/toolkit/glossary#deepfake) must be disclosed. A voluntary EU code of practice, which the Commission judged adequate in July 2026, sets out how providers can mark AI-generated content and how deployers can label deepfakes. Other countries have their own rules, and your clients may have contract terms on AI use. [Where the law fits](https://responsibleai.founderz.com/toolkit/law) has the detail. #### Authentic claims and likenesses AI is very good at inventing plausible experience: an anecdote, a quote, a result. Your credibility depends on everything under your name being true. Use AI to tell your real stories well, and never to create a realistic likeness or voice of a real person without their consent. #### Practices - Tell people when they’re dealing with an AI assistant or agent. - Label realistic synthetic images, audio and video, especially of real people or events. - Never create a realistic likeness or voice of a real person without their consent. - Follow your organization’s and your client’s rules on disclosing AI assistance in deliverables. - Keep AI from inventing your experience: stories, quotes and numbers. #### Evidence - From August 2, 2026, the EU AI Act requires people to be informed when they interact with an AI system, and deployers to disclose deepfakes. [1][20] - The EU AI Act defines a deep fake as AI-generated or manipulated image, audio or video that resembles real people, places or events and would falsely appear authentic. [1] - The Commission judged the voluntary code of practice on marking and labeling AI-generated content adequate for these duties in July 2026. [33] Full page: https://responsibleai.founderz.com/toolkit/principles/transparency ### Principle 10: Accountability for AI-assisted results **The people and organizations that use AI answer for the results, and problems are reported early.** Key question: Am I ready to put my name to it? Benefit: A reputation that survives mistakes, because they’re caught early and corrected openly. AI can draft, recommend and act. Responsibility stays where it was. Whatever goes out under your name, or your company’s, belongs to you and your organization. In 2024 a Canadian tribunal rejected an airline’s argument that its website chatbot was responsible for its own answers: the chatbot was part of the airline’s website, and the airline answered for everything on it. Owning the result also means owning the mistakes. People who handle AI well say so early when something goes wrong, fix it and help others avoid it. #### Handling errors - Stop the work if it’s still running. - Tell the person responsible, and your contact for AI problems if you have one. - Keep what’s needed to understand what happened: the prompt, the sources and the output. - Fix the result and tell the people affected. - Share the lesson, including near misses. #### Record-keeping For work that matters, keep enough to explain how you got the result: what you asked, which sources you used and what you changed. It takes a minute, and it turns “the AI said so” into an answer you can defend. At organizational scale, the OECD AI Principles call for traceable datasets, processes and decisions. #### Practices - Read everything you send, sign or ship as if it will be quoted back to you. - When something goes wrong, say so early, fix it and tell the people affected. - Report near misses too, such as the agent that almost sent the wrong file. - Keep enough of your work (prompt, sources, output) to explain how you got the result. - Share what works with your colleagues. #### Evidence - A Canadian tribunal held an airline responsible for all the information on its website, including its chatbot’s answers, and found negligent misrepresentation. [34] - A US federal court fined lawyers and their firm for filing, and then defending, court opinions invented by an AI chatbot. [35] - A consulting firm repaid part of a government fee after a report with invented references and a made-up court quote was published. [36][37] - The OECD AI Principles hold AI actors accountable for the proper functioning of AI systems, according to their roles. [3] - Singapore’s framework for agentic AI keeps the deploying organization and its supervisors accountable for agents’ actions, including autonomous ones. [2] Full page: https://responsibleai.founderz.com/toolkit/principles/accountability ## Sources 1. Regulation (EU) 2024/1689 (Artificial Intelligence Act). European Union, Official Journal, June 13, 2024. https://eur-lex.europa.eu/eli/reg/2024/1689/oj 2. Model AI Governance Framework for Agentic AI. Infocomm Media Development Authority, Singapore, Version 1.5, May 20, 2026 (first published January 22, 2026). https://www.imda.gov.sg/resources/press-releases-factsheets-and-speeches/updated-model-ai-governance-framework-for-agentic-ai 3. Recommendation of the Council on Artificial Intelligence (OECD AI Principles). OECD, Adopted May 22, 2019; revised May 3, 2024. https://legalinstruments.oecd.org/en/instruments/OECD-LEGAL-0449 4. Automation bias: a systematic review of frequency, effect mediators, and mitigators. Journal of the American Medical Informatics Association, 2012 (online June 2011). https://pmc.ncbi.nlm.nih.gov/articles/PMC3240751/ 5. Consult Evaluation: DWP’s Pathways to Work consultation. UK Incubator for AI (i.AI), Dated August 27, 2025; published October 30, 2025. https://assets.publishing.service.gov.uk/media/68f63fe01c9076042263f0bd/evaluation-report.pdf 6. Data, privacy, and security for Microsoft Copilot. Microsoft, Updated August 18, 2026. https://learn.microsoft.com/en-us/microsoft-365/copilot/microsoft-365-copilot-privacy 7. Secure and governed data foundation for Microsoft Copilot: foundational deployment guidance. Microsoft, May 6, 2026; updated August 18, 2026. https://learn.microsoft.com/en-us/microsoft-365/copilot/secure-govern-copilot-foundational-deployment-guidance 8. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1). US National Institute of Standards and Technology, July 26, 2024. https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence 9. AI at Work Is Here. Now Comes the Hard Part (2024 Work Trend Index). Microsoft and LinkedIn, May 8, 2024. https://www.microsoft.com/en-us/worklab/work-trend-index/ai-at-work-is-here-now-comes-the-hard-part 10. Regulation (EU) 2016/679 (General Data Protection Regulation). European Union, Official Journal, April 27, 2016. https://eur-lex.europa.eu/eli/reg/2016/679/oj 11. How do we ensure anonymisation is effective? UK Information Commissioner’s Office, Current guidance. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/how-do-we-ensure-anonymisation-is-effective/ 12. Pseudonymisation. UK Information Commissioner’s Office, Current guidance. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/ 13. OWASP Top 10 for LLM Applications, 2026 edition. OWASP Gen AI Security Project, August 3, 2026. https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/ 14. Prompt injection is not SQL injection (it may be worse). UK National Cyber Security Centre, December 8, 2025. https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection 15. The lethal trifecta for AI agents. Simon Willison, June 16, 2025. https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ 16. Least privilege (glossary entry). NIST Computer Security Resource Center, Definition from NIST SP 800-53 Rev. 5. https://csrc.nist.gov/glossary/term/least_privilege 17. The Impact of Generative AI on Critical Thinking: Self-Reported Reductions in Cognitive Effort and Confidence Effects From a Survey of Knowledge Workers. Carnegie Mellon University and Microsoft Research (CHI 2025), April 25, 2025. https://www.microsoft.com/en-us/research/publication/the-impact-of-generative-ai-on-critical-thinking-self-reported-reductions-in-cognitive-effort-and-confidence-effects-from-a-survey-of-knowledge-workers/ 18. Endoscopist deskilling risk after exposure to artificial intelligence in colonoscopy: a multicentre, observational study. The Lancet Gastroenterology & Hepatology, August 12, 2025. https://www.thelancet.com/journals/langas/article/PIIS2468-1253(25)00133-5/fulltext 19. Safety Alert for Operators 13002: Manual Flight Operations. US Federal Aviation Administration, January 4, 2013. https://www.faa.gov/sites/faa.gov/files/other_visit/aviation_industry/airline_operators/airline_safety/SAFO13002.pdf 20. Regulation (EU) 2026/1744 (AI Omnibus). European Union, Official Journal, Adopted July 8, 2026; in force July 27, 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:L_202601744 21. Microsoft 365 Copilot Experiment: Cross-Government Findings Report. UK Government Digital Service, June 2, 2025. https://www.gov.uk/government/publications/microsoft-365-copilot-experiment-cross-government-findings-report/microsoft-365-copilot-experiment-cross-government-findings-report-html 22. Microsoft 365 Copilot pilot: DBT evaluation report. UK Department for Business and Trade, August 28, 2025. https://www.gov.uk/government/publications/microsoft-365-copilot-pilot-dbt-evaluation-report 23. Towards Understanding Sycophancy in Language Models. Anthropic researchers, presented at ICLR 2024, October 20, 2023; ICLR 2024. https://arxiv.org/abs/2310.13548 24. Sycophancy in GPT-4o: what happened and what we’re doing about it. OpenAI, April 29, 2025. https://openai.com/index/sycophancy-in-gpt-4o/ 25. Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity. METR, July 10, 2025. https://metr.org/blog/2025-07-10-early-2025-ai-experienced-os-dev-study/ 26. We are Changing our Developer Productivity Experiment Design. METR, February 24, 2026. https://metr.org/blog/2026-02-24-uplift-update/ 27. Confirmation bias: A ubiquitous phenomenon in many guises. Review of General Psychology, 2(2), 1998. https://doi.org/10.1037/1089-2680.2.2.175 28. Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools. Journal of Empirical Legal Studies (Stanford RegLab and HAI researchers), April 23, 2025. https://doi.org/10.1111/jels.12413 29. AI Hallucination Cases database. Damien Charlotin, Updated continuously (2,077 cases on September 23, 2026). https://www.damiencharlotin.com/hallucinations/ 30. Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (I-120324-PSA). FBI Internet Crime Complaint Center, December 3, 2024. https://www.ic3.gov/PSA/2024/PSA241203 31. Suplantación del CEO utilizando la técnica de inteligencia artificial deepvoice. INCIBE, Spain’s national cybersecurity institute, January 9, 2024. https://www.incibe.es/linea-de-ayuda-en-ciberseguridad/casos-reales/suplantacion-del-ceo-utilizando-la-tecnica-de-inteligencia-artificial-deepvoice 32. AI-Generated “Workslop” Is Destroying Productivity. Harvard Business Review (Stanford Social Media Lab and BetterUp researchers), September 22, 2025. https://hbr.org/2025/09/ai-generated-workslop-is-destroying-productivity 33. Code of Practice on transparency of AI-generated content. European Commission, Final version June 10, 2026; judged adequate July 8, 2026. https://digital-strategy.ec.europa.eu/en/policies/code-practice-ai-generated-content 34. Moffatt v. Air Canada, 2024 BCCRT 149. Civil Resolution Tribunal of British Columbia, February 14, 2024. https://canlii.ca/t/k2spq 35. Mata v. Avianca, Inc.: opinion and order on sanctions. US District Court, Southern District of New York, June 22, 2023. https://storage.courtlistener.com/recap/gov.uscourts.nysd.575368/gov.uscourts.nysd.575368.54.0.pdf 36. Deloitte refunds Aussie gov after AI fabrications slip into $440K welfare report. The Register, October 6, 2025. https://www.theregister.com/software/2025/10/06/deloitte-refunds-australian-government-over-ai-in-report/722000 37. Deloitte refunds over $60K for report with AI errors, Australian government says. CFO Dive, October 21, 2025. https://www.cfodive.com/news/deloitte-refunds-60k-report-ai-errors-australian-government-accounting/803321/ ## How to cite Founderz (2026). What responsible use of AI means in 2026. The RUAI Standard, 2026 edition. Developed by Founderz in collaboration with Microsoft. https://responsibleai.founderz.com/toolkit/home ## License Text licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Names, logos and images are not covered.