Evidencing Responsible AI Principles

by Louise McCormack
November 6, 2026

Responsible AI principles are easy to agree with and hard to prove. Daon’s approach moves beyond policy commitments by linking its ISO 42001 certification to traceable evidence across the full AI lifecycle, using the Trustworthy AI Maturity Model to document how risks were identified, what controls were applied, and whether they are still working in production.

Whether grouped under five, six, or seven headings, there are consistently agreed principles for Trustworthy Artificial Intelligence, including fairness, transparency, human oversight, accountability, and privacy. Most organisations developing AI would agree with these principles in theory, but the challenge that we all face is how to implement them in our organisations and how to evidence that in a structured way that can be monitored.

A commitment to human oversight means implementing it in a traceable way, from AI system design through development and operation. Organisations need to track what risks were identified, what controls were consequently put in place, how they were tested, and what evidence we can provide to show they are still working. The same is required of each of the other principles of Trustworthy AI.

Evidencing Trustworthy AI throughout the AI lifecycle is the challenge we took on at Daon, with the first step being the implementation and certification of ISO 42001 AI Management Systems (AIMS). Whilst this was a great start for our organisation, we believe that in order to ensure ongoing commitment to safe development, organisations like ourselves must go further. The first thing we did was link our Responsible AI policies, risks, and controls to evidence from across the AI lifecycle. A significant part of that approach is the Trustworthy AI Maturity Model, or TAIMM. TAIMM asks structured questions at three stages: System Design, System Development, and System Operation. Ultimately, lifecycle governance is central to ethical AI. A system can be responsibly designed and rigorously tested, but that will not tell us how it will behave, or how it will be governed, once it is being used.

xDeTECH, our technology for detecting indicators of replayed, synthetic and cloned audio, provides a practical example. Its responsible AI evidence isn’t a statement that the product has been designed ethically. It exists in decisions and controls that can be examined: whether audio is suitable for analysis, how models and datasets are evaluated, how changes are controlled, what the output means, and, importantly, what the system is not designed to decide. A testament to this product’s ethical build is being shortlisted for the AI Ireland Awards 2026 for Best Use of Responsible AI & Ethics.

Some practical changes for AI development include adding Ethics By Design and stakeholder assessments early in the design process. The separate TAIMM design stage questionnaire required our teams to answer questions around the suitability of the AI. That included detailed questions around oversight, transparency, bias, and project level needs like the designing of monitoring systems and traceability throughout the lifecycle. Additional detailed questions on data consideration ensured that validation, diversity, harm prevention, and transparency needs for data were engaged with from the design stage. Risk management, tool requirements, and the IT environment were also covered at this stage.

The development stage reviews also covered detailed data and model documentation and development requirements, including specific assessment questions on versioning, algorithmic design, and parameter weights.

The operational stage reviews focused on assessing the processes for system testing including human oversight, clarity of instructions for users and developers, and the level of risk mitigation and transparency provided to them. Detailed assessments of the test datasets ensured that all required testing was completed, including checks on quality, representativeness, and bias mitigation. Model explanation and explainable AI assessments were also covered in this stage along with a detailed assessment of the automated monitoring process.

Identified risks then feed into our ISO/IEC 42001 (AIMS) framework which provides the wider management processes through which risks, controls, responsibilities and continual improvement are governed. Responsible AI principles tell us what we are trying to achieve. Evidence tells us whether those principles survived contact with the real system. As we move further into the AI era, continuing the due diligence built into our software development risk and security processes is not enough. We must extend it to integrate responsible AI development and, critically, to evidence it.