Reference · 48 sources
Sources
Every fact in the standard comes from one of these sources, with what it establishes, what it doesn’t and where we cite it.
How we choose them
We prefer primary sources: the law itself, regulators, standards bodies, peer-reviewed research, court and tribunal decisions, and an organization’s own statement about its own actions. When we rely on a press report, we say so.
Corrections
The principles, practices and recommendations are ours, and the sources support the facts around them. Found an error or a better source? Write to responsibleuseofai@founderz.com.
Law
-
Regulation (EU) 2024/1689 (Artificial Intelligence Act)
European Union, Official Journal · June 13, 2024 · Law · European Union
The binding text of the EU AI Act, including the definitions of AI literacy and deep fake (Article 3), banned practices such as emotion recognition at work (Article 5), human oversight that guards against automation bias (Article 14) and transparency duties (Article 50).
Limits: Applies in stages and was amended in July 2026 (see the AI Omnibus). Which duties apply depends on the organization’s role and the system. The summaries on this site aren’t legal advice.
Checked September 2026 · Cited on: Human oversight of AI, Where the law fits, Transparency about the use of AI, Glossary
-
Regulation (EU) 2026/1744 (AI Omnibus)
European Union, Official Journal · Adopted July 8, 2026; in force July 27, 2026 · Law · European Union
Amends the AI Act: keeps the AI literacy duty of providers and deployers without a guaranteed level, moves high-risk dates to December 2, 2027 (Annex III), and August 2, 2028 (Annex I), gives generative systems already on the market until December 2, 2026, to mark synthetic content, and adds bans on non-consensual intimate deepfakes and child sexual abuse material from December 2, 2026.
Limits: An amending act. Read it with the consolidated text of the AI Act.
Checked September 2026 · Cited on: Adoption workshop, Where the law fits, Independent judgment and skills, Transparency about the use of AI, Glossary
-
Regulation (EU) 2016/679 (General Data Protection Regulation)
European Union, Official Journal · April 27, 2016 · Law · European Union
Defines personal data broadly (Article 4) and gives people rights around decisions based solely on automated processing that have legal or similarly significant effects on them (Article 22).
Limits: Other countries have their own data protection laws. The European Commission has proposed changes to Article 22, so check whether they have been adopted.
Checked September 2026 · Cited on: Where the law fits, Confidentiality of information shared with AI, You’re asked to rank job applicants with AI, Glossary
Official guidance, frameworks and standards
-
AI Act: regulatory framework for AI
European Commission · Updated August 3, 2026 · Official summary · European Union
The Commission’s summary of the AI Act. It lists AI tools for employment, management of workers and access to self-employment, such as résumé-sorting software, among high-risk uses, with obligations from December 2, 2027.
Limits: A summary, not the legal text.
Checked September 2026 · Cited on: Where the law fits, You’re asked to rank job applicants with AI
-
Code of Practice on transparency of AI-generated content
European Commission · Final version June 10, 2026; judged adequate July 8, 2026 · Voluntary code · European Union
A voluntary code for marking AI-generated content (providers) and labeling deepfakes and some text (deployers), which the Commission judged adequate for Article 50 of the AI Act.
Limits: Voluntary. Signing it isn’t conclusive evidence of compliance, and the legal duties apply either way.
Checked September 2026 · Cited on: Where the law fits, Transparency about the use of AI
-
Copyright and Artificial Intelligence, Part 2: Copyrightability
US Copyright Office · January 29, 2025 · Official report · United States
Concludes that copyright protects human authorship and that purely AI-generated material isn’t protected, while human contributions to AI-assisted works can be.
Limits: US only. It doesn’t settle ownership questions in other countries or disputes about training data.
Checked September 2026 · Cited on: Where the law fits
-
Recommendation of the Council on Artificial Intelligence (OECD AI Principles)
OECD · Adopted May 22, 2019; revised May 3, 2024 · Intergovernmental principles · OECD members and adherents
Calls for safeguards such as capacity for human agency and oversight (principle 1.2), accountability with traceability of datasets, processes and decisions (1.5), and systems that can be overridden, repaired or shut down safely (1.4).
Limits: Not legally binding.
Checked September 2026 · Cited on: Human oversight of AI, Where the law fits, A single source of truth for AI, Accountability for AI-assisted results, Glossary
-
Ethics Guidelines for Trustworthy AI
High-Level Expert Group on AI, set up by the European Commission · April 8, 2019 · Expert guidelines · European Union
Describes three kinds of human oversight: human-in-the-loop (intervention in every decision cycle, often neither possible nor desirable), human-on-the-loop (involvement in design and monitoring of operation) and human-in-command (oversight of overall activity, including whether, when and how to use the system).
Limits: Not binding, and not an official position of the Commission.
Checked September 2026 · Cited on: Human checkpoint map, Glossary
-
Model AI Governance Framework for Agentic AI
Infocomm Media Development Authority, Singapore · Version 1.5, May 20, 2026 (first published January 22, 2026) · Voluntary framework · Singapore
Keeps organizations and their human supervisors accountable for agents’ actions; asks for human approval at significant checkpoints such as deleting data, sending messages and payments; treats very low override rates and very fast reviews as possible signs of rubber-stamping; prefers approvals enforced by system controls over prompts.
Limits: Voluntary guidance, not law. Its case studies were supplied by the companies themselves.
Checked September 2026 · Cited on: Human oversight of AI, Where the law fits, Human checkpoint map, Limited permissions for AI agents, Agent permission card, Accountability for AI-assisted results, Glossary
-
US National Institute of Standards and Technology · AI RMF 1.0, January 2023 · Voluntary framework · United States, used internationally
A widely used voluntary framework for managing AI risks in organizations.
Limits: Voluntary. NIST says the framework is being revised.
Checked September 2026 · Cited on: Where the law fits
-
US National Institute of Standards and Technology · July 26, 2024 · Voluntary framework · United States, used internationally
Lists twelve risks of generative AI, including confabulation (confidently stated false content, sometimes with invented citations) and human-AI configuration, which covers automation bias and over-reliance.
Limits: Voluntary. It was issued under an executive order that has since been revoked, and the wider framework is under revision.
Checked September 2026 · Cited on: Where the law fits, A single source of truth for AI, Challenge and bias awareness, Verification levels, Verification proportionate to the stakes, Glossary
-
Least privilege (glossary entry)
NIST Computer Security Resource Center · Definition from NIST SP 800-53 Rev. 5 · Standard definition · United States, used internationally
Defines least privilege as giving each entity the minimum system resources and authorizations it needs to perform its function.
Limits: A glossary that compiles definitions from NIST publications.
Checked September 2026 · Cited on: Limited permissions for AI agents, Agent permission card, Glossary
-
ISO/IEC 42001: Artificial intelligence management system
ISO and IEC · 2023 · International standard · International
The international standard for AI management systems in organizations.
Limits: An organizational management-system standard. It sets requirements for organizations, not guidance for individuals.
Checked September 2026 · Cited on: Where the law fits
-
OWASP Top 10 for LLM Applications, 2026 edition
OWASP Gen AI Security Project · August 3, 2026 · Security guidance · International
Lists the main security risks of AI applications, including prompt injection (LLM01), which it says can’t yet be reliably prevented, and excessive agency (LLM03): more functions, permissions or autonomy than a task needs. Recommends least privilege and human confirmation of privileged, irreversible or externally visible actions.
Limits: Community guidance, not a formal standard.
Checked September 2026 · Cited on: Limited permissions for AI agents, Agent permission card, Glossary
-
Prompt injection is not SQL injection (it may be worse)
UK National Cyber Security Centre · December 8, 2025 · Official guidance · United Kingdom
Explains that AI models have no reliable boundary between data and instructions, so prompt injection may never be fully fixed, and advises fixed, non-AI limits on what systems can do, least privilege and logging.
Limits: Written for security professionals.
Checked September 2026 · Cited on: Limited permissions for AI agents, An email asks your agent to change a supplier’s bank details, Agent permission card, Glossary
-
AI and cyber security: what you need to know
UK National Cyber Security Centre · February 13, 2024 · Official guidance · United Kingdom
Guidance for managers and boards: AI can present falsehoods as fact and can be manipulated, and individual users shouldn’t carry the burden of using AI safely.
Limits: Written for leaders and boards.
Checked September 2026 · Cited on: Team AI charter
-
How do we ensure anonymisation is effective?
UK Information Commissioner’s Office · Current guidance · Regulator guidance · United Kingdom
Explains that whether data is anonymous depends on context and on the means reasonably likely to be used to identify people; removing names alone may not be enough.
Limits: UK guidance. Other countries’ legal tests differ.
Checked September 2026 · Cited on: Confidentiality of information shared with AI, You want AI to review a client contract, Glossary
-
UK Information Commissioner’s Office · Current guidance · Regulator guidance · United Kingdom
Explains that pseudonymization reduces risk but that pseudonymized data remains personal data.
Limits: UK guidance.
Checked September 2026 · Cited on: Confidentiality of information shared with AI, Glossary
-
Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud (I-120324-PSA)
FBI Internet Crime Complaint Center · December 3, 2024 · Public service announcement · United States
Warns that criminals use AI-generated voice, images and video to impersonate people, and advises hanging up and calling back on a number you look up yourself.
Limits: Aimed at US consumers.
Checked September 2026 · Cited on: Arup: deepfake fraud on a video call, An email asks your agent to change a supplier’s bank details, The finance director asks for an urgent transfer on a video call, Verification proportionate to the stakes
-
Suplantación del CEO utilizando la técnica de inteligencia artificial deepvoice
INCIBE, Spain’s national cybersecurity institute · January 9, 2024 · Official case note (in Spanish) · Spain
Describes a company that paid a fraudster after an AI-cloned voice of its chief executive called; advises confirming through a channel where you know who you’re talking to, never authorizing payments by phone and requiring more than one approver for large payments.
Limits: An anonymized helpline case.
Checked September 2026 · Cited on: Arup: deepfake fraud on a video call, The finance director asks for an urgent transfer on a video call, Verification proportionate to the stakes
-
Safety Alert for Operators 13002: Manual Flight Operations
US Federal Aviation Administration · January 4, 2013 · Safety advisory · United States
Encourages airlines to promote manual flying when appropriate, because continuous use of automation doesn’t reinforce manual flying skills.
Limits: Advisory, for US air carriers. We use it as an analogy.
Checked September 2026 · Cited on: Independent judgment and skills, Glossary
Research and evaluations
-
Carnegie Mellon University and Microsoft Research (CHI 2025) · April 25, 2025 · Peer-reviewed research · International survey
In a survey of 319 knowledge workers sharing 936 examples, higher confidence in generative AI was associated with less reported critical thinking, and higher self-confidence with more.
Limits: Self-reported and cross-sectional: it shows an association, not measured skill loss.
Checked September 2026 · Cited on: Independent judgment and skills, A junior colleague’s analysis looks perfect, but they can’t explain it
-
The Lancet Gastroenterology & Hepatology · August 12, 2025 · Peer-reviewed research · Poland
At four centers, the adenoma detection rate in colonoscopies done without AI fell from 28.4% to 22.4% after AI assistance was introduced.
Limits: Observational before-and-after design, described by the authors’ university as hypothesis-generating. A correction was published in September 2025.
Checked September 2026 · Cited on: Independent judgment and skills, Glossary
-
Automation bias: a systematic review of frequency, effect mediators, and mitigators
Journal of the American Medical Informatics Association · 2012 (online June 2011) · Peer-reviewed review · International
Defines automation bias as the tendency to over-rely on automation, leading to errors of commission (following wrong advice) and omission (missing problems not flagged), and finds that training, accountability and how advice is presented can reduce it.
Limits: Reviews clinical decision support from before generative AI.
Checked September 2026 · Cited on: Human oversight of AI, Human checkpoint map, Glossary
-
Complacency and Bias in Human Use of Automation: An Attentional Integration
Human Factors · June 2010 · Peer-reviewed research · International
Finds that automation bias affects experts and teams as well as novices when decision aids are imperfect.
Limits: Reviews research on automation from before generative AI.
Checked September 2026 · Cited on: Glossary
-
Confirmation bias: A ubiquitous phenomenon in many guises
Review of General Psychology, 2(2) · 1998 · Peer-reviewed review · International
A classic review of confirmation bias: the tendency to seek and interpret evidence in ways that favor existing beliefs.
Limits: A psychology review from before generative AI.
Checked September 2026 · Cited on: Challenge and bias awareness, Glossary
-
Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools
Journal of Empirical Legal Studies (Stanford RegLab and HAI researchers) · April 23, 2025 · Peer-reviewed research · United States
On 202 legal questions, leading AI legal research tools hallucinated on 17% to 33% of queries, and a general-purpose model on 43%.
Limits: A snapshot of tools tested in 2024. The tools have changed since.
Checked September 2026 · Cited on: Invented case law in court filings, Verification levels, Verification proportionate to the stakes
-
Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity
METR · July 10, 2025 · Research (preprint) · International
Sixteen experienced developers working on 246 tasks expected AI to make them 24% faster and felt 20% faster afterward, but tasks with AI took 19% longer.
Limits: Not peer reviewed, with early-2025 tools. METR has since marked the result as out of date.
Checked September 2026 · Cited on: METR: perceived and measured productivity with AI, Challenge and bias awareness
-
We are Changing our Developer Productivity Experiment Design
METR · February 24, 2026 · Research update · International
A follow-up with 57 developers and more than 800 tasks pointed toward speed-ups, but METR calls the results unreliable because many developers avoided tasks they didn’t want to do without AI; it thinks developers are probably faster now and is redesigning its study.
Limits: METR describes the evidence as weak.
Checked September 2026 · Cited on: METR: perceived and measured productivity with AI, Challenge and bias awareness
-
AI-Generated “Workslop” Is Destroying Productivity
Harvard Business Review (Stanford Social Media Lab and BetterUp researchers) · September 22, 2025 · Survey research · United States
Defines workslop. Of 1,150 full-time US employees, 40% received it in the past month, and each case took an average of 1 hour and 56 minutes to deal with.
Limits: Self-reported, US only and not peer reviewed. The survey method isn’t fully described, and BetterUp sells coaching services.
Checked September 2026 · Cited on: Workslop: the cost of unedited AI output, Quality of AI-assisted work, A six-page AI summary of a 30-minute meeting, Glossary
-
The lethal trifecta for AI agents
Simon Willison · June 16, 2025 · Practitioner analysis · International
Names the combination of access to private data, exposure to untrusted content and the ability to communicate externally as the condition for data theft through AI agents, and notes that no known technique reliably prevents it.
Limits: A practitioner’s framework, not peer reviewed.
Checked September 2026 · Cited on: Limited permissions for AI agents, Agent permission card, Glossary
-
AI Hallucination Cases database
Damien Charlotin · Updated continuously (2,077 cases on September 23, 2026) · Research database · Worldwide
Lists decisions in which a court or tribunal found, or implied, that a party relied on AI-invented content, mostly fake citations: 2,077 by September 23, 2026, 1,428 of them in the United States.
Limits: Maintained by one person. It leaves out cases where reliance was only alleged.
Checked September 2026 · Cited on: Invented case law in court filings, The report cites a study you can’t find, Verification proportionate to the stakes
-
Microsoft 365 Copilot Experiment: Cross-Government Findings Report
UK Government Digital Service · June 2, 2025 · Government evaluation · United Kingdom
20,000 civil servants used the assistant from October to December 2024 and reported an average saving of 26 minutes a day; 82% wouldn’t want to go back. The tool was weaker on complex or nuanced work, and human oversight was needed at all times.
Limits: Time savings are self-reported, from 7,115 survey responses, with no control group.
Checked September 2026 · Cited on: Independent judgment and skills, UK government: evaluating an AI assistant across departments
-
Microsoft 365 Copilot pilot: DBT evaluation report
UK Department for Business and Trade · August 28, 2025 · Government evaluation · United Kingdom
72% of users were satisfied. In observed tasks, report summaries were faster and better, while spreadsheet analysis was slower and less accurate. It found no evidence that time saved raised productivity.
Limits: A 32% response rate, small observed samples and no before-and-after baseline.
Checked September 2026 · Cited on: Independent judgment and skills, UK government: evaluating an AI assistant across departments, Quality of AI-assisted work
-
Consult Evaluation: DWP’s Pathways to Work consultation
UK Incubator for AI (i.AI) · Dated August 27, 2025; published October 30, 2025 · Government evaluation · United Kingdom
Policy teams edited and signed off the AI’s themes; 125 reviewers checked the tool’s sorting of 87,738 responses and left 73% unchanged; the tool agreed with reviewers (F1 0.816) more than reviewers agreed with each other (0.710); the median check took 19 seconds.
Limits: One consultation. It timed the checking, not the whole analysis.
Checked September 2026 · Cited on: Human oversight of AI, UK government: human review of AI-sorted consultation responses
Court, tribunal and government records
-
Moffatt v. Air Canada, 2024 BCCRT 149
Civil Resolution Tribunal of British Columbia · February 14, 2024 · Tribunal decision · British Columbia, Canada
Rejected the airline’s argument that its chatbot was responsible for its own answers, held the airline responsible for all the information on its website and found negligent misrepresentation, awarding C$812.02.
Limits: A small-claims decision in one province. No evidence was given about how the chatbot worked.
Checked September 2026 · Cited on: Air Canada: liability for a chatbot’s answers, Accountability for AI-assisted results, You spot a wrong figure in a report you sent last week
-
Mata v. Avianca, Inc.: opinion and order on sanctions
US District Court, Southern District of New York · June 22, 2023 · Court decision · United States
Found that lawyers acted in bad faith by filing, and then defending, court opinions invented by an AI chatbot; fined them and their firm US$5,000 and ordered letters to their client and to the judges falsely named.
Limits: One case. Its lessons are about professional duties more than the technology.
Checked September 2026 · Cited on: Invented case law in court filings, Accountability for AI-assisted results
-
LCQ9: Combating frauds involving deepfake
Government of the Hong Kong SAR (reply to the Legislative Council) · June 26, 2024 · Government statement · Hong Kong
Describes the case: a phishing email posing as the UK head office’s finance chief led to a group video call, and the employee transferred about HK$200 million to five bank accounts. Police believe the video was pre-recorded from public clips.
Limits: Doesn’t name the company.
Checked September 2026 · Cited on: Arup: deepfake fraud on a video call, The finance director asks for an urgent transfer on a video call
Organizations’ own statements and documentation
-
Data, privacy, and security for Microsoft Copilot
Microsoft · Updated August 18, 2026 · Product documentation · Commercial customers
States that Copilot only surfaces organizational data the user has at least view permission for; that prompts, responses and data accessed through Microsoft Graph aren’t used to train foundation models; and that generated responses aren’t guaranteed to be 100% factual, so users should use their judgment before sending output to others.
Limits: Applies to that product and its commercial terms only.
Checked September 2026 · Cited on: A single source of truth for AI, Confidentiality of information shared with AI, Single source of truth starter kit, Verification proportionate to the stakes, Glossary
-
Secure and governed data foundation for Microsoft Copilot: foundational deployment guidance
Microsoft · May 6, 2026; updated August 18, 2026 · Product documentation · Commercial customers
Because Copilot can use anything the user can open, recommends finding overshared, ownerless and inactive sites, running access reviews, restricting broad sharing links, and archiving inactive sites and deleting obsolete files so answers stay current.
Limits: Vendor guidance for administrators. Features depend on the license.
Checked September 2026 · Cited on: A single source of truth for AI, The assistant quoted last year’s price, Single source of truth starter kit
-
AI at Work Is Here. Now Comes the Hard Part (2024 Work Trend Index)
Microsoft and LinkedIn · May 8, 2024 · Survey research (vendor) · 31 markets
Of 31,000 people surveyed in 31 markets, 75% of knowledge workers used generative AI at work, and 78% of AI users brought their own AI tools.
Limits: Vendor research based on self-reported answers.
Checked September 2026 · Cited on: Confidentiality of information shared with AI, Glossary
-
Sycophancy in GPT-4o: what happened and what we’re doing about it
OpenAI · April 29, 2025 · Company statement · International
Reports rolling back a model update that had become excessively flattering, and says short-term user feedback had been weighted too heavily.
Limits: The company’s own account.
Checked September 2026 · Cited on: Challenge and bias awareness, Glossary
-
Cátedra ERIA · September 2024 · Press release (in Spanish) · Spain
The Universidad Autónoma de Madrid (UAM) set up the Chair on Employability and Responsibility in AI with Founderz and Microsoft. The announcement names Melchor Gómez and Pau Garcia-Milà as its directors, sets out its aims and four lines of work, and names the Toolkit for the Responsible Use of AI as one of its main areas of study and development.
Limits: The chair’s own announcement. It describes the plans made when the chair was set up.
Checked September 2026 · Cited on: About the RUAI Standard
News reports
-
Deloitte refunds Aussie gov after AI fabrications slip into $440K welfare report
The Register · October 6, 2025 · News report · Australia
Reports the invented references and made-up court quote in the report for the Department of Employment and Workplace Relations, the corrected version disclosing AI use, and Deloitte’s agreement to repay the final instalment of its fee.
Limits: A news report.
Checked September 2026 · Cited on: Deloitte Australia: a report with invented references, The report cites a study you can’t find, Accountability for AI-assisted results
-
Deloitte refunds over $60K for report with AI errors, Australian government says
CFO Dive · October 21, 2025 · News report · Australia
Reports the department’s statement that the refund was more than A$97,000.
Limits: A news report of a government statement.
Checked September 2026 · Cited on: Deloitte Australia: a report with invented references, Accountability for AI-assisted results
-
Deloitte’s AI mess just got worse, and HR should be paying close attention
Human Resources Director Australia · November 14, 2025 · News report · Australia
Reports correspondence released by the department showing it sought A$97,587.11, citing the report’s problems and Deloitte’s failure to follow its own policy on telling the client about AI use.
Limits: A news report of released correspondence.
Checked September 2026 · Cited on: Deloitte Australia: a report with invented references, Where the law fits
-
South China Morning Post · May 17, 2024 · News report · Hong Kong
Reports Arup’s confirmation that it was the company in the Hong Kong deepfake case, and police figures on the transfers.
Limits: A news report. Early reports described a live deepfake call, while the police account points to pre-recorded video.
Checked September 2026 · Cited on: Arup: deepfake fraud on a video call