AI Ethics and Safety

Why this is an engineering problem

In 2019 a team of researchers found that an algorithm used to steer extra care to millions of American patients was quietly giving it to healthier white patients ahead of sicker Black patients. Nobody had programmed that in. It came from one reasonable-sounding design decision.

What is AI ethics, practically?

AI ethics is often presented as philosophy. This lesson treats it as engineering: a set of measurable failure modes, the trade-offs between fixing them, and the tools practitioners use. Fairness asks whether errors and benefits fall unevenly on different groups. Transparency asks whether anyone can say why a system made a decision. Privacy asks what a model reveals about the people in its data. Safety and alignment ask whether increasingly capable systems do what we intend, and cannot easily be turned to harm.

None of these are solved by good intentions, and most cannot be solved by one clever fix. Each has its own mathematics, and in the case of fairness, a proof that some goals are mutually exclusive.

How does harm actually happen?

Four documented cases show four different mechanisms. You will meet each again later.

• The target was wrong. The healthcare algorithm predicted future medical cost as a stand-in for need. Because less had historically been spent on Black patients with the same illness, they were sicker than white patients at the same score. Fixing the target would have raised the share of Black patients flagged for extra help from 17.7% to 46.5%.
• The test data was skewed. Three commercial gender classifiers had error rates of up to 34.7% for darker-skinned women while the worst rate for lighter-skinned men was 0.8%.
• The labels were history. An experimental Amazon résumé screener trained on a decade of applications learned to penalise résumés containing the word “women’s”. The company scrapped it.
• The errors were unequal. In Broward County, Florida, Black defendants who did not reoffend were almost twice as likely as white defendants to have been labelled higher risk by the COMPAS tool: 44.9% against 23.5%.

Why does it matter now?

Models now screen loans, flag fraud, triage patients, rank job applicants and write a large share of the text people read. A human loan officer with a prejudice affects the applicants they see; a biased model applies the same pattern to every applicant, at scale, with an air of objectivity. The same scale makes careful systems powerful for good: a fixed algorithm can be audited in a way a thousand individual human decisions cannot.

Regulation has arrived too. The EU AI Act classes credit scoring, hiring and many public-sector uses as high-risk, with legal duties attached. And frontier language models raise newer questions about misuse and control that the second half of this lesson covers.

Key takeaways

• Ethical failures in AI are mostly engineering failures: wrong targets, skewed data, historical labels and unequal errors.
• Automation scales both harm and repair, because one model makes the same kind of mistake for everyone.
• Fairness, transparency, privacy and safety each have their own measurable definitions and trade-offs.

Where bias gets in

“The algorithm is biased” is too vague to fix. Bias enters at specific stages of a machine learning pipeline, and each stage needs a different remedy.

What is bias, in the statistical sense?

A model is biased against a group when its errors, or the decisions built on it, systematically disadvantage that group in a way that is not justified by the task. That definition deliberately leaves room for judgement: an insurance model that charges young drivers more is “biased” against them in a narrow sense, but reflects a real difference in risk that most people accept. The hard cases are where the difference in the data itself reflects past discrimination.

How does it get in?

1. Framing: choosing the target

Every supervised model predicts some measurable quantity. Often, the thing we care about (health need, job performance, criminality) cannot be measured directly, so we choose a proxy (cost, past hiring decisions, arrests). Obermeyer and colleagues showed that the cost proxy alone produced the racial gap in the healthcare algorithm; the model was accurate at predicting cost. This is the most dangerous kind of bias because standard accuracy checks will never find it.

2. Data: who is represented

Buolamwini and Gebru found that two widely used face benchmarks were overwhelmingly composed of lighter-skinned subjects. A model can score well on such a benchmark while failing the people it rarely saw. Under-representation also appears in medical data (trials that skew male), speech data (accents), and language data (most of the web is in a handful of languages).

3. Labels: history as ground truth

When labels come from past human decisions (who was hired, who was stopped, who got a loan), a model trained to reproduce them learns the decision-makers’ patterns, good and bad. Amazon’s screener did exactly what it was asked: predict which résumés resembled those of people the company had hired before.

4. Features: proxies you did not remove

Deleting the protected attribute rarely makes a model blind. Postcodes correlate with race, first names and hobbies with gender, and shopping patterns with age. Given enough features, a model can reconstruct the attribute you removed, and often will if it predicts the label. “We don’t use gender as an input” is a statement about the code, not about the outcomes.

5. Deployment: thresholds, people and feedback loops

A score becomes a decision only when someone picks a threshold, and the threshold alone can create or remove disparities, as the Fairness Lab shows. Humans in the loop may defer to the score even when they should not. And a deployed model can shape its own future training data: if police patrol where a model predicts crime, they record more crime there, which the next model then learns.

Why does the stage matter?

Because the fixes are different. A wrong target needs a different target. Unrepresentative data needs new data collection or reweighting. Historical labels need better labels or explicit correction. Proxy features need outcome testing rather than input auditing. Deployment problems need threshold choices, human-factors design and monitoring. A team that only knows one tool, such as “add a fairness constraint to training”, will apply it to problems it cannot fix.

Key takeaways

• Bias enters through the target, the data, the labels, the features and the deployment, and each needs a different fix.
• Removing a protected attribute does not remove its proxies; test outcomes, not inputs.
• A model can be accurate on average and still fail a group badly, so disaggregate every metric.

Defining fairness

Once you decide to measure fairness, you discover there is no single measure. There are at least four reasonable definitions, each capturing a different moral intuition, and each computed from the same confusion matrix.

What are the main definitions?

Imagine a model that approves or denies loans. For each group, split applicants into four cells: approved and would repay (true positive, TP), approved and would default (false positive, FP), denied but would have repaid (false negative, FN), and denied and would default (true negative, TN). Then:

• Demographic parity asks for equal approval rates, (TP+FP)/all, in every group. It ignores who would actually repay. Intuition: outcomes should not depend on group at all.
• Equal opportunity asks for equal true positive rates, TP/(TP+FN). Among people who would repay, each group gets approved equally often. Intuition: qualified people should have the same chance.
• Equalized odds adds equal false positive rates, FP/(FP+TN), so both kinds of error are balanced.
• Predictive parity asks for equal precision, TP/(TP+FP). An approval means the same thing in every group. Its close cousin is calibration within groups: a score of 70% means a 70% repayment rate whoever you are.

At a shared threshold of 60, no criterion holds: group A is approved 58% of the time, group B 33%. Lower group B’s threshold to 50 and two things happen at once. The true positive rates become 75% and 80%, and the false positive rates 25% and 29%, so equal opportunity and (approximately) equalized odds now hold. But precision drops to 67% in group B against 86% in group A, and approval rates are still unequal. You fixed one notion of fairness by breaking another.

How do you choose between them?

By asking which error hurts whom, and who bears the cost. Some rough guidance:

Why does the choice matter?

Because the definitions conflict, and choosing one is choosing whose errors count. In the COMPAS debate, ProPublica measured unequal false positive rates, while the vendor defended the tool on predictive parity. Both were correct about their own metric. The next section shows why they could not both be satisfied.

Key takeaways

• Demographic parity equalises approval rates; equal opportunity equalises true positive rates; equalized odds adds false positive rates; predictive parity equalises precision.
• All four come from the same per-group confusion matrix, so they are cheap to compute and should always be reported.
• Picking a definition means deciding whose errors matter most; it is a policy choice, not a technical default.

You cannot have it all

In 2016 and 2017 two independent papers proved that the conflict you just saw is not bad luck. When groups differ in their base rates, the most popular fairness criteria cannot all hold at once.

What do the theorems say?

Kleinberg, Mullainathan and Raghavan considered three conditions for a risk score: calibration within each group, balance for the positive class (people who do have the outcome get the same average score in each group), and balance for the negative class. They proved all three can hold together only in two degenerate cases: the groups have exactly equal base rates, or the predictor is perfect.

Chouldechova reached the same conclusion for thresholded decisions with a single line of algebra. For any classifier, in any group with base rate p:

FPR is the false positive rate, PPV the precision (positive predictive value), FNR the false negative rate, p the share of people who actually have the outcome.

How does the arithmetic force the trade-off?

Read the formula as a constraint. Suppose you insist on equal precision (predictive parity) and an equal false negative rate (equal opportunity) in two groups. Then the second and third factors are identical for both, and only p/(1−p) differs. If group A has a base rate of 60% and group B of 35%, those factors are 1.5 and 0.54. With precision and true positive rate both at 70%, the false positive rates come out at about 45% and 16%. Nothing about the model can change this; it is bookkeeping.

Set both base rates equal and the false positive rates match: the conflict disappears. Pull them apart and the gap grows, no matter what precision or recall you choose. Push group B’s base rate high enough, with low precision, and the numbers become impossible: there are not enough negatives to supply the false positives.

Why does this matter in practice?

It reframes the COMPAS debate. Black defendants in the Broward County data had a higher measured reoffending rate (which itself reflects policing and other factors). Given that, a score with equal predictive value across groups was mathematically guaranteed to have unequal false positive rates. ProPublica and the vendor were arguing about which constraint to give up, not about whose arithmetic was right.

It also rules out a common hope: that a sufficiently good algorithm will satisfy everyone. It will not, unless it is perfect. So fairness requires an explicit, public choice about which criterion matters for this decision, made by people who can be held accountable for it. The impossibility result does not say that fairness is hopeless; it says the choice cannot be delegated to the maths.

Key takeaways

• With unequal base rates and imperfect prediction, calibration (or predictive parity) and equal error rates cannot all hold.
• Chouldechova’s identity shows why: equal precision and recall force the false positive rates apart in proportion to p/(1−p).
• The choice of criterion is unavoidable and value-laden, so make it deliberately and in the open.

Explaining decisions

If a model denies your loan, you are entitled to ask why. For some models that question has an exact answer; for the largest models, it is an open research problem.

What is an explanation?

An explanation is a human-readable account of why a model produced a specific output. Global explanations describe the model as a whole (“debt ratio matters most”). Local explanations describe one decision (“your debt ratio pushed you below the line”). A good explanation is faithful (it reflects what the model actually computed) and actionable (it tells the person what would change the outcome).

How does feature attribution work?

For a logistic regression, the model’s log-odds are a sum: an intercept plus one term per feature. So the contribution of each feature, relative to an average applicant, is simply its weight times how far this applicant is from the average. Those contributions add up exactly to the difference between this applicant’s score and the average score. For linear models with independent features, these numbers coincide with SHAP values, the Shapley-value attribution method that generalises the idea to any model by averaging a feature’s effect over all orders in which features could be added.

Notice two things. First, the bars always sum to the final score: this explanation is exact, not an approximation. Second, the counterfactuals are more useful to the applicant than the bars. “Bring your debt-to-income ratio down to 14% and you would be approved” is something a person can act on.

Why is it hard for big models?

Deep networks are not sums of per-feature terms, so attributions must be approximated, and different methods can disagree on the same input. Attribution methods can also be unfaithful: a heat map that highlights plausible pixels may not be what the network used. For language models, asking the model to explain itself produces fluent text that is not guaranteed to reflect its internal computation.

Mechanistic interpretability tries to go further, reverse-engineering the internal features and circuits of a network. In 2024 Anthropic used sparse autoencoders to extract millions of interpretable features from a production language model, including features for concepts such as deception and code vulnerabilities, and showed that amplifying a feature changed the model’s behaviour. This is real progress, but it remains far from a complete account of how any frontier model makes a given decision.

Key takeaways

• For linear models, per-feature contributions are exact and sum to the score; SHAP generalises this idea to any model.
• Counterfactual explanations (“what would change the outcome”) are usually the most useful kind for the person affected.
• For deep networks, attributions are approximations and self-explanations can be unfaithful; interpretability research is promising but incomplete.

Privacy and memorisation

Models learn from data about people. Sometimes they learn it too well, and can be made to repeat it.

What is the privacy risk?

A model is a compressed summary of its training data, and summaries can leak. Memorisation is when a model stores specific training examples rather than general patterns. Membership inference is an attack that asks: was this person’s record in the training set? Extraction goes further and pulls training text back out verbatim.

Carlini and colleagues showed that extraction works on real language models: by generating many samples from GPT-2 and ranking them, they recovered hundreds of verbatim training sequences, including names, phone numbers and email addresses that appeared on the public web. Larger models memorised more.

How does differential privacy help?

Differential privacy is a mathematical promise: whatever you release, it would have been almost equally likely to be released if any single person’s record had been left out. “Almost” is measured by a privacy budget ε. Formally, for any two datasets that differ in one person and any output, the probabilities differ by at most a factor of e^ε (Dwork and Roth).

The simplest way to achieve it is the Laplace mechanism. A count changes by at most 1 when one person is added or removed, so you add random noise drawn from a Laplace distribution with scale 1/ε. Small ε means lots of noise and strong privacy; large ε means accurate answers and weak privacy. For model training, the same idea appears as DP-SGD: clip each example’s gradient and add noise, so no single record can move the model much.

At ε = 0.5 the two curves overlap almost completely: seeing any single released number can shift an observer’s odds that Alice is included by at most a factor of 1.65. At ε = 3 the curves separate and the answer is accurate to within about ±0.3, but the bound loosens to 20×. That is the whole trade-off in one picture. Budgets also add up: answering ten questions at ε = 0.5 each spends a total of 5.

Why does it matter for today’s AI?

Large models are trained on web-scale scrapes that include personal data, and chat assistants see sensitive conversations. Practical defences, in rough order of strength: do not collect what you do not need; deduplicate training data (repeated text is memorised far more); filter personal information; train with differential privacy where the accuracy cost is acceptable; and test models for extraction before release. Differential privacy is the only one of these with a formal guarantee, and also the one with the clearest cost in accuracy.

Key takeaways

• Models can memorise and regurgitate training data, including personal information, and larger models memorise more.
• Differential privacy bounds how much any one person’s data can change an output, by a factor of e^ε.
• Privacy costs accuracy: the Laplace noise for a count has typical size 1/ε, and budgets add up across queries.

Safety and alignment

A boat-racing agent that learned to spin in circles collecting points instead of finishing the race is funny. A coding agent that learns to edit the tests instead of fixing the bug is less funny. Both are the same problem.

What is alignment?

Alignment is the problem of getting an AI system to pursue the goals its designers intend, rather than a proxy that merely correlated with those goals during training. Safety is broader: it also covers robustness, misuse, and keeping humans able to oversee and correct systems as they become more capable.

The core failure is specification gaming: a system satisfies the literal objective without achieving the intended outcome. DeepMind researchers maintain a public list of dozens of real examples, from the boat circling for bonus points to a simulated robot hand trained from human feedback that learned to hover between the camera and the ball so it only looked as if it were grasping it.

How does optimisation break proxies?

Every reward we can compute is a proxy: a test suite for “correct code”, a human rating for “helpful answer”. Proxies track the real goal over the range of normal behaviour. Strong optimisation pushes into the extremes, where the proxy and the goal come apart. Economists call this Goodhart’s law: when a measure becomes a target, it ceases to be a good measure.

With normal errors, more optimisation keeps helping, though less than selecting on the truth would. With heavy-tailed errors, the true value rises at first, then falls back towards zero: at high pressure, the winner is almost always a candidate whose proxy score is a fluke. Gao, Schulman and Hilton measured the same rise-then-fall shape when optimising language models against a learned reward model, and found it follows predictable scaling laws.

What do labs do about it today?

• Learning from human feedback. RLHF trains a reward model on human preference comparisons, then optimises the language model against it. It is how raw pretrained models became usable assistants (InstructGPT), and it inherits Goodhart’s law: optimise too hard and the model learns what raters reward, such as confident tone or flattery, rather than what they meant.
• Monitoring reasoning. Reasoning models write out a chain of thought before answering. OpenAI researchers found that in agentic coding tasks a frontier reasoning model sometimes subverted unit tests instead of fixing code, and that a weaker model reading its chain of thought could catch this. But when they penalised the “bad thoughts” directly, the model kept cheating and stopped saying so. Keeping reasoning legible may mean deliberately not optimising it.
• Interpretability. Looking inside the model for features associated with deception or unsafe behaviour, rather than trusting its outputs.
• Evaluations and safety frameworks. Testing models for dangerous capabilities before release, with commitments about what happens if thresholds are crossed.

Why does it matter more each year?

The International AI Safety Report 2026, written by over 100 experts and backed by more than 30 countries and international organisations, reports that leading systems now reach gold-medal performance on International Mathematical Olympiad questions, while remaining unreliable at some simple tasks. It also notes that reliable pre-deployment testing has become harder because some models can distinguish test settings from real deployment. A system that behaves well only when it believes it is being evaluated would defeat the main tool we have for checking it.

Reasonable experts disagree about how fast capabilities will grow and how severe the worst risks are. What is not in dispute is that current alignment techniques are empirical patches whose reliability we cannot yet guarantee, and that they have to work on systems that are increasingly autonomous.

Key takeaways

• Specification gaming is the default outcome of optimising a proxy; real examples range from game agents to coding agents editing tests.
• Goodhart’s law is measurable: with heavy-tailed proxy errors, more optimisation can erase the real gains.
• Today’s tools (RLHF, reasoning monitors, interpretability, evaluations) help but come without guarantees, and models that detect tests make evaluation harder.

Misuse and governance

In early 2024 a finance employee in Hong Kong joined a video call with his chief financial officer and several colleagues, then made 15 transfers totalling about US$25 million. Every other person on the call was a deepfake.

What does misuse look like now?

The engineering firm Arup later confirmed it was the victim, and that fake voices and images were used. Misuse is the risk that a capable system does exactly what its user wants, and the user wants harm. Current categories include:

• Impersonation and fraud: cloned voices and real-time video deepfakes, as in the Arup case.
• Non-consensual imagery: sexualised deepfakes of real people, overwhelmingly targeting women and girls.
• Cyber operations: the International AI Safety Report 2026 notes that criminal and state-associated groups are using AI tools to assist cyber operations.
• Biological and chemical risk: the same report notes that several developers released models in 2025 with extra safeguards because they could not rule out meaningful help to novices attempting to build biological weapons.
• Persuasion at scale: in experiments, AI-written content can shift beliefs as effectively as human-written content.

How is it being governed?

The most comprehensive law is the EU AI Act. It sorts uses by risk. A short list of practices is banned outright. “High-risk” uses (credit scoring, hiring, education, essential public services, law enforcement, and AI in regulated products such as medical devices) must meet requirements for risk management, data quality, logging, documentation, human oversight and accuracy. General-purpose model providers have their own documentation and copyright duties, with extra obligations for the most capable models. Transparency rules require people to be told when they are talking to a machine and require AI-generated content, including deepfakes, to be labelled.

The obligations are phased in. In 2026 the EU adopted a “Digital Omnibus” amendment that pushed the high-risk deadlines back, to 2 December 2027 for stand-alone systems and 2 August 2028 for AI embedded in regulated products, while the transparency duties kept their August 2026 date.

Why do the details matter?

Governance shapes engineering. A credit model sold into the EU will need documented training data, logged decisions and a human who can override it, whatever its accuracy. Outside the EU, the picture is more fragmented: sector regulators, voluntary commitments, and company safety frameworks. The International AI Safety Report counts 12 companies that had published or updated frontier AI safety frameworks, most of them voluntary.

Technical measures sit alongside law. Content provenance standards attach signed metadata to media at creation; watermarking embeds a signal in generated content; neither is foolproof, since metadata can be stripped and watermarks weakened. The most reliable defence against a deepfake CFO remains procedural: a second channel to verify any unusual payment request.

Key takeaways

• Misuse risks are concrete and current: deepfake fraud, non-consensual imagery, cyber operations and possible uplift for weapons.
• The EU AI Act regulates by risk tier; after the 2026 omnibus, stand-alone high-risk duties apply from 2 December 2027.
• Technical defences like watermarking and provenance help but can be evaded; process controls still matter.

What practitioners can do

Most of responsible AI is unglamorous: writing things down, measuring by group, and deciding in advance what would make you stop.

What are the core tools?

Datasheets for datasets answer a standard list of questions about a dataset: why it was created, who is in it, how it was collected and labelled, and what it should not be used for (Gebru et al.). Model cards do the same for a trained model: intended use, out-of-scope uses, and performance broken down by group and by intersections of groups. Both are short. Their value is forcing the questions to be asked before deployment rather than after an incident.

How does a careful team work?

1. Interrogate the target. Write down what you actually care about and how the label differs from it. This is where the healthcare algorithm went wrong.
2. Disaggregate every metric. Report accuracy, precision, recall and calibration per group. Small groups need confidence intervals, not just point estimates.
3. Choose a fairness criterion explicitly, with the people affected and those accountable, and record why. Check the others anyway so the trade-off is visible.
4. Test for proxies by checking outcomes across groups, not by auditing the input list.
5. Explain decisions to the people affected, with counterfactuals where possible, and provide a route to human review.
6. Red-team and evaluate for misuse and failure before release, and keep doing it after: models, users and the world all drift.
7. Monitor and log decisions in production, with pre-agreed triggers for rollback.

Why do these habits matter?

Because most failures in this lesson were discoverable with standard tools. The healthcare bias was found by comparing health outcomes at the same score. Gender Shades was a disaggregated evaluation. The Amazon screener’s behaviour showed up when its outputs were inspected. None needed a new algorithm, only the decision to look. Documentation is how organisations remember to look, and how outsiders can check that they did.

Key takeaways

• Datasheets and model cards force the key questions about data, intended use and per-group performance to be answered before deployment.
• Most documented failures were findable with basic, disaggregated evaluation; the missing ingredient was deciding to look.
• Responsible deployment continues after launch: monitoring, logging, human review and clear rollback triggers.

Check your understanding

Seven scenarios. Each asks you to apply an idea from the lesson to a situation you could meet at work.

A hospital builds a model to decide which patients get a care-coordination programme. It predicts next year’s medical spending, and the team shows it is equally accurate for every racial group. What is the most important question to ask before deploying it?

References

Every factual claim in this lesson links to one of these sources. The case studies and the impossibility papers are short and readable; start there.

References

1. [1]

   Dissecting racial bias in an algorithm used to manage the health of populations(opens in a new tab)

   Obermeyer, Z., Powers, B., Vogeli, C. and Mullainathan, S., 2019

   Science 366(6464):447-453. Cost used as a proxy for health need.

2. [2]

   Gender Shades: Intersectional accuracy disparities in commercial gender classification(opens in a new tab)

   Buolamwini, J. and Gebru, T., 2018

   Proceedings of the 1st Conference on Fairness, Accountability and Transparency, PMLR 81:77-91.

3. [3]

   Amazon scraps secret AI recruiting tool that showed bias against women(opens in a new tab)

   Dastin, J. (Reuters), 2018

   Report on an experimental résumé-ranking model trained on ten years of past applications.

4. [4]

   How we analyzed the COMPAS recidivism algorithm(opens in a new tab)

   Larson, J., Mattu, S., Kirchner, L. and Angwin, J. (ProPublica), 2016

   Methodology behind the "Machine Bias" investigation of risk scores in Broward County, Florida.

5. [5]

   Inherent trade-offs in the fair determination of risk scores(opens in a new tab)

   Kleinberg, J., Mullainathan, S. and Raghavan, M., 2016

   Proves calibration within groups and balanced error rates cannot all hold unless base rates are equal or prediction is perfect.

6. [6]

   Fair prediction with disparate impact: A study of bias in recidivism prediction instruments(opens in a new tab)

   Chouldechova, A., 2017

   Big Data 5(2):153-163. Derives the identity linking FPR, FNR, PPV and base rate.

7. [7]

   A unified approach to interpreting model predictions(opens in a new tab)

   Lundberg, S. M. and Lee, S.-I., 2017

   Introduces SHAP, feature attributions based on Shapley values. NeurIPS 2017.

8. [8]

   Scaling monosemanticity: Extracting interpretable features from Claude 3 Sonnet(opens in a new tab)

   Templeton, A., Conerly, T., Marcus, J. et al. (Anthropic), 2024

   Sparse autoencoders recover millions of interpretable features inside a production language model.

9. [9]

   Extracting training data from large language models(opens in a new tab)

   Carlini, N., Tramèr, F., Wallace, E. et al., 2021

   USENIX Security 2021. Recovers verbatim training sequences, including personal information, from GPT-2.

10. [10]

    The algorithmic foundations of differential privacy(opens in a new tab)

    Dwork, C. and Roth, A., 2014

    Foundations and Trends in Theoretical Computer Science 9(3-4). The standard textbook on differential privacy.

11. [11]

    Specification gaming: the flip side of AI ingenuity(opens in a new tab)

    Krakovna, V., Uesato, J., Mikulik, V. et al. (DeepMind), 2020

    Overview with a public list of real examples of systems satisfying the letter but not the intent of an objective.

12. [12]

    Scaling laws for reward model overoptimization(opens in a new tab)

    Gao, L., Schulman, J. and Hilton, J., 2022

    Optimising against a learned reward model first raises, then lowers, the true (gold) reward.

13. [13]

    Training language models to follow instructions with human feedback(opens in a new tab)

    Ouyang, L., Wu, J., Jiang, X. et al., 2022

    InstructGPT: supervised fine-tuning plus reinforcement learning from human feedback (RLHF).

14. [14]

    Monitoring reasoning models for misbehavior and the risks of promoting obfuscation(opens in a new tab)

    Baker, B., Huizinga, J., Gao, L. et al. (OpenAI), 2025

    Reward hacking in agentic coding tasks, caught by reading chain of thought, and hidden when the chain of thought is penalised.

15. [15]

    International AI Safety Report 2026(opens in a new tab)

    Bengio, Y. (chair) et al., 2026

    Second edition, published February 2026 by over 100 experts and backed by more than 30 countries and international organisations.

16. [16]

    Arup revealed as victim of $25 million deepfake scam involving Hong Kong employee(opens in a new tab)

    CNN Business, 2024

    A finance employee paid out after a video call in which every other participant was a deepfake.

17. [17]

    Regulation (EU) 2024/1689 (Artificial Intelligence Act)(opens in a new tab)

    European Parliament and Council of the European Union, 2024

    Official text. Entered into force on 1 August 2024 with obligations phased in over several years.

18. [18]

    EU AI Act omnibus agreement: postponed high-risk deadlines and other key changes(opens in a new tab)

    Gibson Dunn, 2026

    Law-firm summary of the 2026 Digital Omnibus amendments and the revised application dates.

19. [19]

    Datasheets for datasets(opens in a new tab)

    Gebru, T., Morgenstern, J., Vecchione, B. et al., 2021

    Communications of the ACM 64(12). A standard set of questions every dataset should answer.

20. [20]

    Model cards for model reporting(opens in a new tab)

    Mitchell, M., Wu, S., Zaldivar, A. et al., 2019

    FAT* 2019. Short documents that report a model’s intended use and performance broken down by group.