Artificial Intelligence and Emerging Technologies

Introduction and Context

Artificial intelligence (AI) is the capacity of computer systems to perform tasks commonly associated with human intelligence, including prediction, classification, language processing, pattern recognition, planning and decision support. Emerging technologies such as generative AI, biometric identification, cloud computing, blockchain and the Internet of Things (IoT) increasingly operate together. Their combination creates substantial benefits, but also new questions about privacy, fairness, responsibility, security and legal compliance.

Cyber law traditionally focused on identifiable human actors, defined systems and relatively stable evidence. AI complicates this model. A decision may be produced by a statistical model trained by one organisation, deployed by another, hosted by a cloud provider and used by a public authority. A harmful output may result from data, software design, user instructions or inadequate monitoring. Legal compliance therefore requires governance across the entire technology lifecycle rather than reliance on a single consent notice or policy document.

This chapter examines the principal ethical and compliance issues at certificate level. It does not assume that one global AI law exists. Rules differ by jurisdiction and continue to develop. Organisations must therefore identify applicable legislation, regulatory guidance, contractual obligations and sector-specific standards.

Learning Objectives

By the end of this chapter, a learner should be able to:

1. Explain the ethical and legal risks of AI and related technologies.
2. Describe bias, explainability, human oversight and accountability.
3. Distinguish automated decision-making from decision support.
4. Apply governance controls to generative AI, biometric systems, cloud services, blockchain and IoT.
5. Analyse an AI deployment using risk-based compliance principles.
6. Recommend practical safeguards for responsible adoption.

1. Core Concepts and Important Terminology

An algorithm is a defined procedure for processing inputs to produce an output. A model is a computational representation learned from data or specified by rules. Training data are used to develop a model; validation data help tune it; and test data are used to evaluate performance on previously unseen examples. Inference is the production of an output from a trained model.

AI should not be understood as inherently autonomous or objective. It reflects the purposes, data, assumptions and choices of its designers and users. A model can be technically accurate while still being unlawful or unfair if it uses irrelevant personal data, produces discriminatory effects or is used without a proper legal basis.

Personal data generally means information relating to an identified or identifiable person. Biometric data, location records, online identifiers and inferred characteristics may fall within this concept depending on applicable law. Sensitive or special-category data receive additional protection in many legal systems.

Profiling involves automated processing to evaluate or predict aspects of a person, such as behaviour, reliability, preferences or risk. Automated decision-making occurs when a decision is made by automated means with little or no meaningful human involvement. The legal significance often depends on whether the decision has legal or similarly significant effects.

Explainability concerns whether relevant people can understand how an AI system reached an output. Transparency is broader: it includes information about the system’s purpose, data, limitations, operators and consequences. Accountability means that an organisation can demonstrate responsible conduct and answer for the system’s effects. Human oversight means more than placing a person nominally in the process; the person must have competence, authority, time and access to information sufficient to intervene.

2. Ethical Foundations for AI Governance

2.1 Beneficence, non-maleficence and autonomy

Beneficence requires technology to produce legitimate social or organisational benefits. Non-maleficence requires prevention or reduction of foreseeable harm. Autonomy requires respect for people’s ability to make informed choices rather than manipulating or invisibly constraining them. These principles are especially important in health, employment, education, insurance, policing and credit.

2.2 Justice and fairness

Fairness asks whether benefits, burdens and errors are distributed acceptably. It has several meanings:

• Individual fairness: similar individuals should receive similar treatment.
• Group fairness: error rates or outcomes across groups should meet an appropriate standard.
• Procedural fairness: affected people should receive notice, reasons and an opportunity to challenge a decision.
• Impact fairness: the wider social consequences should not reinforce structural disadvantage.

These meanings can conflict. For example, equal selection rates and equal error rates may not both be achievable when groups have different base rates. Fairness is therefore a governance and policy judgment, not merely a technical metric.

2.3 Proportionality and necessity

A responsible organisation should ask whether AI is necessary for the stated purpose, whether a less intrusive method could achieve the same result, and whether the expected benefits justify the risks. This is closely related to privacy, data minimisation and purpose limitation. Collecting every available data point “because it may be useful later” is poor compliance practice.

3. Bias, Discrimination and Model Reliability

AI bias may arise from historical discrimination, under-representation, inaccurate labels, proxy variables, sampling methods, measurement choices, deployment context or feedback loops. A facial recognition system, for example, may perform differently across demographic groups because its training images or operational conditions are unbalanced. A recruitment model trained on historical hiring decisions may reproduce the organisation’s previous preferences.

Bias controls should operate throughout the lifecycle:

1. Define a legitimate purpose and affected groups.
2. Assess data quality, provenance, representativeness and lawful collection.
3. Test performance across relevant groups and use cases.
4. Examine false positives and false negatives, not only overall accuracy.
5. Document limitations and obtain expert review.
6. Monitor outcomes after deployment and provide a route for correction.

A confusion matrix records predictions against actual outcomes. Its principal terms are:

Accuracy is the proportion of all predictions that are correct. Precision is the proportion of predicted positives that are actually positive. Recall, also called sensitivity, is the proportion of actual positives that are identified. These measures answer different questions and must be selected according to context. In a security screening system, a false negative may be more serious than a false positive; in a benefits system, false positives may wrongly deny assistance.

Technical testing does not settle the legal question. A model may have comparable statistical performance across groups yet be unlawful because the purpose is prohibited, the data were obtained improperly or affected individuals were denied procedural rights.

4. Explainability, Transparency and Human Oversight

Some models, particularly complex neural networks, are difficult to interpret directly. Explainability techniques may identify influential features, provide examples, generate local explanations or describe global model behaviour. An explanation should be accurate, understandable and relevant to the decision. A superficial statement such as “the algorithm identified a risk” is not a meaningful reason.

The level of explanation should be proportionate to the impact. A product recommendation may require limited information, while an automated refusal of credit, employment or public services may require a clear account of the decisive factors, data used and method for challenging the result.

Human oversight should be designed, not assumed. Effective oversight includes:

• authority to pause, reject or reverse an output;
• training in system capabilities and limitations;
• access to source information and confidence indicators;
• protection from inappropriate automation bias;
• escalation procedures for unusual or high-risk cases; and
• records showing who reviewed and approved the decision.

A human who merely clicks “approve” on every automated recommendation does not provide meaningful oversight. Conversely, requiring human review of millions of low-risk transactions may be impractical. Governance should match the severity, scale and reversibility of possible harm.

5. Accountability and the AI Lifecycle

Accountability is supported by clear allocation of responsibilities. A useful lifecycle is:

Design → Data preparation → Testing → Procurement → Deployment → Monitoring → Incident response → Retirement

At each stage, an organisation should identify the responsible owner, foreseeable risks, controls, evidence and approval requirements. Relevant records can include a system description, data inventory, impact assessment, test results, model version, change history, user training, complaints and incidents.

Contracts should address data rights, confidentiality, security controls, subcontractors, audit access, incident notification, service availability, deletion or return of data, intellectual-property claims and assistance with legal requests. Procuring an AI service does not transfer all accountability to the vendor. The deploying organisation remains responsible for understanding how the service is used and for protecting affected people.

A risk assessment should consider likelihood and impact. A simple qualitative matrix can classify risks as low, medium or high, but it should not conceal uncertainty or give false mathematical precision. High-impact uses generally require stronger controls, independent review, documented justification and continuous monitoring.

6. Automated Decision-Making and Legal Compliance

Automated decisions can affect access to employment, credit, education, insurance, housing, healthcare or public benefits. Compliance questions commonly include:

• Is there a lawful basis for processing the relevant data?
• Was the person informed about the purpose and logic in an understandable way?
• Is the decision legally permitted to be fully automated?
• Is meaningful human review available where required?
• Can the person obtain reasons, correct inaccurate data and challenge the result?
• Are retention, security and cross-border transfer rules satisfied?
• Has an impact assessment been completed?

The answer depends on jurisdiction and sector. Some data-protection regimes restrict solely automated decisions with significant effects, subject to specified exceptions and safeguards. Equality, consumer-protection, employment, administrative and sectoral laws may apply simultaneously.

Organisations should avoid “function creep”: using a model approved for fraud detection later for employee discipline or marketing without reassessing purpose, legality and impact.

7. Generative AI

Generative AI produces text, images, audio, video, software code or other content from prompts. Important risks include fabricated information, disclosure of confidential data, copyright and database-rights disputes, impersonation, deepfakes, discriminatory content, prompt injection, insecure code and unclear responsibility for outputs.

A sound organisational policy should require:

• approved tools and accounts rather than unregulated consumer services;
• prohibition or restriction of confidential and personal data in prompts;
• human verification of factual, legal, medical and financial outputs;
• disclosure where synthetic content could mislead people;
• retention of prompts and outputs where necessary for audit;
• secure handling of generated code; and
• procedures for reporting harmful or erroneous output.

Generative systems are probabilistic. Fluency is not evidence of truth. Users should verify sources, dates, calculations, quotations and citations. Copyright compliance also requires attention to the law of the relevant jurisdiction, licence terms and the nature of both input and output material.

8. Biometric Systems

Biometric systems use physical or behavioural characteristics—such as fingerprints, facial features, iris patterns, voice or gait—for identification or verification. A biometric template is not simply a password: a person cannot easily replace their face or fingerprint after compromise. Biometric processing therefore creates heightened security and privacy risks.

Key controls include necessity and proportionality assessment, explicit purpose definition, informed notice, encryption, template protection, strict retention limits, liveness detection, alternative non-biometric access, demographic performance testing and independent review. Identification of a person among a large population is generally more intrusive than one-to-one verification for device access.

False matches can wrongly implicate an innocent person; false non-matches can deny legitimate access. Biometric deployment in public spaces may also chill lawful behaviour and raise constitutional or human-rights concerns. Organisations must examine local restrictions before deployment rather than assuming that technical feasibility establishes legal permission.

9. Cloud Services and Shared Responsibility

Cloud services provide computing, storage or software over a network. They can improve scalability and security, but create dependence on providers, complex data locations and multi-tenant environments. The shared-responsibility principle means the provider secures the infrastructure it controls, while the customer remains responsible for correct configuration, identity management, data classification and lawful use. The exact division varies by service model and contract.

Compliance measures include:

• classifying information before migration;
• applying least-privilege access and multi-factor authentication;
• encrypting data in transit and at rest;
• reviewing provider certifications without treating them as complete proof of compliance;
• knowing storage and processing locations;
• testing backup restoration and exit arrangements;
• logging access and administrative actions; and
• assessing subcontractors and cross-border transfers.

A cloud outage or provider lock-in can become a legal and operational risk. Business continuity plans should identify alternative processes and recovery priorities.

10. Blockchain

Blockchain is a distributed ledger in which transactions are recorded through a consensus process and linked using cryptographic techniques. Its value may include shared records, traceability and resistance to unauthorised alteration. It does not guarantee that an input was truthful, that a smart contract is legally valid or that personal-data processing is compliant.

The tension between immutability and data-protection rights is significant. Publishing identifiable personal data on a widely replicated ledger may conflict with minimisation, correction or erasure requirements. Preferable designs may store personal data off-chain and place only a non-identifying reference or cryptographic commitment on-chain, subject to careful assessment because hashes can sometimes be linked or attacked.

Smart contracts are software instructions that execute when conditions are met. They may contain coding errors, produce unexpected outcomes or fail to reflect legal doctrines such as mistake, fraud or equitable relief. Governance should specify who can upgrade code, resolve disputes and respond to compromised keys.

11. Internet of Things Risks

IoT connects sensors, appliances, vehicles, industrial equipment and other devices. Risks arise from weak default passwords, unpatched firmware, insecure application programming interfaces, excessive data collection, physical safety consequences and long device lifecycles.

Good practice includes unique credentials, secure boot, signed updates, network segmentation, vulnerability disclosure procedures, device inventories, encryption, minimal data collection and a defined end-of-support policy. Manufacturers and operators should distinguish cyber incidents from safety incidents, because manipulation of an industrial controller or medical device may cause physical injury.

IoT data can reveal habits, movement, health conditions or occupancy. Privacy notices must explain what is collected, why, with whom it is shared and how long it is retained. Consent may be inadequate where users have no realistic alternative, so necessity, contractual, statutory or other lawful bases must be analysed carefully.

12. Regulatory Approaches and Standards

Emerging governance commonly combines several approaches:

• Rights-based regulation: protects privacy, dignity, equality and due process.
• Risk-based regulation: imposes stronger duties on systems capable of greater harm.
• Sectoral regulation: applies specialised rules to finance, health, employment, education or policing.
• Organisational governance: requires policies, impact assessments, records and accountability.
• Technical standards: provide controls for risk management, security, testing and documentation.

The European Union’s AI Act illustrates a risk-based legislative approach, including prohibited practices, high-risk obligations and transparency duties for certain systems. Data-protection law, equality law and consumer law remain relevant alongside it. Other jurisdictions use executive guidance, voluntary frameworks, agency enforcement or sectoral rules. International standards such as the NIST AI Risk Management Framework and ISO/IEC 42001 can support governance but do not automatically create legal compliance.

Organisations should maintain a legal register identifying jurisdictions, regulators, processing locations, applicable rights, reporting duties and review dates. They should monitor legislative change because an apparently lawful deployment can become non-compliant after a new rule or interpretation.

Applied Case: Illustrative Automated Benefits Screening System

Background

A public agency introduces a machine-learning tool to identify potentially fraudulent welfare claims. The system compares application details with historical records and sends high-risk cases for investigation.

Problem

After deployment, advocacy groups report that applicants from certain neighbourhoods are investigated more frequently. The agency discovers that historical investigations were concentrated in those areas. The vendor cannot provide a clear explanation of the model’s ranking, and staff routinely accept its recommendations without independent review.

Analysis

The system may reproduce historical enforcement bias. Location may operate as a proxy for protected characteristics. A high investigation rate is not proof of higher fraud. The agency must assess lawful purpose, data accuracy, proportionality, equality effects, explainability and procedural safeguards. It must distinguish a screening alert from a final adverse decision.

Approach and solution

The agency pauses automatic adverse action, conducts an impact assessment, removes unjustified proxy features, tests error rates across relevant groups and commissions an independent audit. Every flagged applicant receives human review, notice of the concern and an opportunity to correct inaccurate data. Staff receive training on automation bias. The agency documents model versions, reasons for decisions and complaint outcomes, and establishes periodic monitoring.

Outcome and learning points

The system may remain useful as a limited investigative aid, but it cannot replace lawful investigation or individualized judgment. The case demonstrates that procurement, testing, transparency, human oversight and remedy must operate together. Accuracy alone is not sufficient evidence of a fair or lawful system.

Challenges and Best Practices

Emerging technology governance faces uncertainty about responsibility, rapidly changing models, limited technical expertise, vendor secrecy, international data flows and resource constraints. Small organisations may not be able to build specialist teams, but they can still apply proportionate controls.

Recommended practice is to:

1. establish executive responsibility and a cross-functional governance team;
2. maintain an inventory of AI, cloud, biometric, blockchain and IoT uses;
3. classify systems by impact and sensitivity;
4. conduct privacy, equality, security and human-rights assessments;
5. document data sources, assumptions, limitations and model changes;
6. test before deployment and monitor after deployment;
7. provide meaningful human review and accessible remedies;
8. protect confidential information and minimise data;
9. manage suppliers through contracts and audits; and
10. retire systems that cannot be explained, secured or justified.

Contemporary Developments

Current developments include multimodal generative models, AI agents capable of using tools, synthetic media, confidential computing, federated learning, digital identity systems and increasingly automated cyber defence. These developments may reduce data exposure or improve efficiency, but they also expand attack surfaces and complicate attribution. The rise of powerful general-purpose models has increased attention to model evaluation, content provenance, systemic risk and supply-chain responsibility.

The central compliance lesson remains stable: organisations should not treat novelty as an exemption from established duties. Privacy, security, equality, transparency, consumer protection, professional responsibility and due process continue to apply, even when the technology is new.

Chapter Summary

AI and emerging technologies create benefits but also risks involving bias, privacy, security, explainability, accountability and human rights. Fairness has multiple meanings and requires both technical testing and legal judgment. Meaningful human oversight requires authority, competence and the ability to intervene. Automated decisions should be assessed for lawful basis, significant effects, transparency, challenge rights and proportionality.

Generative AI requires verification, confidentiality controls and management of synthetic content and intellectual-property risks. Biometric systems demand necessity, strong security and attention to irreversible harm. Cloud compliance follows a shared-responsibility model. Blockchain’s immutability may conflict with data-protection rights, while IoT introduces device, privacy and physical-safety risks. Risk-based regulation, impact assessments, documentation, monitoring and effective remedies provide a practical foundation for responsible deployment.

Key Terms

Algorithm: A defined procedure for processing inputs into outputs.

Artificial intelligence: Computational systems performing tasks associated with human intelligence.

Automated decision-making: Making a decision by automated means with little or no meaningful human involvement.

Accountability: The duty to take responsibility and demonstrate compliance.

Bias: A systematic distortion that may produce inaccurate or unfair outcomes.

Biometric data: Data relating to physical or behavioural characteristics used for identification or verification.

Blockchain: A distributed ledger that records linked transactions through a consensus process.

Cloud computing: Network-based provision of computing, storage or software services.

Explainability: The degree to which an AI output and its basis can be understood.

Generative AI: AI that creates new text, images, audio, video, code or other content.

Human oversight: Competent human supervision with authority to intervene.

Inference: Producing an output from a trained model.

Internet of Things: Networked physical devices that collect, exchange or act on data.

Model: A computational representation used to produce predictions or outputs.

Profiling: Automated processing used to evaluate or predict characteristics or behaviour.

Purpose limitation: Using data only for specified and legitimate purposes.

Risk-based regulation: Applying duties according to the likelihood and severity of harm.

Smart contract: Software that executes specified instructions, often on a blockchain.

Transparency: Provision of understandable information about a system, its use and effects.

Review Questions

5 Short Answer Questions

1. What is the difference between explainability and transparency?
2. Identify two sources of bias in AI training data.
3. Why are biometric templates difficult to treat like passwords?
4. What does the shared-responsibility principle mean in cloud computing?
5. State two risks associated with generative AI.

5 Long Answer Questions

1. Explain how fairness can be assessed through individual, group, procedural and impact perspectives.
2. Discuss the requirements for meaningful human oversight of an automated decision system.
3. Compare the legal and ethical risks of blockchain and IoT deployments.
4. Explain how an organisation should govern a generative AI service.
5. Analyse why accuracy alone cannot establish that an AI system is lawful or ethical.

3 Analytical / Application Questions

1. A bank uses an AI model to reject loan applications. Applicants receive only a risk score and cannot request review. Identify the principal governance and legal concerns and recommend controls.
2. A factory connects safety sensors to a cloud platform operated in another country. Prepare a risk checklist covering privacy, security, continuity, contracts and physical safety.
3. A retailer proposes facial recognition at store entrances to identify suspected shoplifters. Evaluate necessity, proportionality, bias, security, transparency and alternatives before recommending whether deployment should proceed.

Multiple Choice Questions with Answers

Question 1

Which statement best describes meaningful human oversight?

A. A person approves every output without reviewing it

B. A person has competence, information and authority to intervene

C. A vendor promises that the model is accurate

D. A system produces an explanation automatically

Correct Answer: B. A person has competence, information and authority to intervene

Question 2

A false positive occurs when a system:

A. Correctly identifies a positive case

B. Correctly identifies a negative case

C. Classifies a negative case as positive

D. Fails to record a prediction

Correct Answer: C. Classifies a negative case as positive

Question 3

Why can historical recruitment data create unfair AI outcomes?

A. Historical data are always too small

B. The data may reproduce previous discriminatory practices

C. Models cannot process employment data

D. Recruitment decisions never contain patterns

Correct Answer: B. The data may reproduce previous discriminatory practices

Question 4

Which is a significant risk of generative AI?

A. It always produces verifiable sources

B. It cannot create code

C. It may produce fluent but false information

D. It eliminates confidentiality concerns

Correct Answer: C. It may produce fluent but false information

Question 5

What is a major concern when personal data are placed directly on a blockchain?

A. The data become easier to edit

B. Replication and immutability may conflict with privacy rights

C. Consensus removes all legal obligations

D. The data cannot be copied

Correct Answer: B. Replication and immutability may conflict with privacy rights

Question 6

Under the cloud shared-responsibility principle, the customer generally remains responsible for:

A. The provider’s physical building security only

B. All global internet infrastructure

C. Correct configuration, access control and lawful use

D. Writing the provider’s operating system

Correct Answer: C. Correct configuration, access control and lawful use

Question 7

Which control is especially important for IoT devices?

A. Permanent default passwords

B. Unsigned firmware updates

C. Network segmentation and secure updates

D. Collecting all possible data

Correct Answer: C. Network segmentation and secure updates

Question 8

Why is overall accuracy insufficient to assess AI fairness?

A. Accuracy is never measurable

B. It may conceal different error rates or impacts across groups

C. Accuracy applies only to blockchain

D. It proves discriminatory intent

Correct Answer: B. It may conceal different error rates or impacts across groups

Question 9

A biometric identification system searches for a person among a large population. Compared with one-to-one verification, it is generally:

A. Less intrusive in every context

B. More intrusive and deserving of careful proportionality assessment

C. Not a form of personal-data processing

D. Impossible to secure

Correct Answer: B. More intrusive and deserving of careful proportionality assessment

Question 10

What is the first governance response when an AI system causes unexplained high-risk decisions?

A. Expand its use immediately

B. Delete all audit records

C. Pause harmful automated action and investigate the system

D. Assume the vendor is solely responsible

Correct Answer: C. Pause harmful automated action and investigate the system