Chapter 13: Ethics, Governance, Regulation and Sustainability

1. Introduction

Information technology is no longer merely an instrument for storing information or automating routine work. Digital systems allocate opportunities, influence behaviour, mediate public discourse, determine access to services, and shape economic and political power. Artificial intelligence, biometric identification, cloud computing, social platforms, Internet of Things devices, and large-scale data analytics can generate substantial social value. They can also reproduce discrimination, enable intrusive surveillance, weaken privacy, intensify inequality, consume significant energy, and create dependencies that are difficult for individuals or institutions to escape.

For this reason, technical excellence is insufficient as a criterion for evaluating information systems. A system may be accurate, efficient, and profitable while still being unjust, unsafe, unlawful, or environmentally unsustainable. Ethics asks what ought to be done; governance establishes who has authority, how decisions are made, and how conduct is supervised; regulation defines legally enforceable requirements; and sustainability examines whether technological development can support present and future human and ecological needs.

At doctoral level, these issues require critical analysis rather than the mechanical application of checklists. Ethical and governance questions are often characterised by conflicting values, incomplete information, uncertain consequences, and unequal distributions of benefits and risks. Responsible information technology therefore requires interdisciplinary reasoning involving computer science, law, philosophy, public policy, management, social science, environmental studies, and affected communities.

2. Learning Objectives

After completing this chapter, the reader should be able to:

1. Explain the relationship between professional ethics, governance, regulation, and sustainability.

2. Apply ethical theories to decisions involving data, algorithms, surveillance, and digital platforms.

3. Evaluate algorithmic fairness, transparency, accountability, privacy, and human oversight.

4. Analyse intellectual-property, cybersecurity, data-protection, and regulatory-compliance issues.

5. Design governance processes for responsible data and artificial-intelligence use.

6. Assess the environmental and social effects of information-technology systems.

7. Critically evaluate competing stakeholder interests and propose defensible solutions.

8. Explain emerging challenges involving generative AI, autonomous systems, digital sovereignty, and climate impacts.

3. Meaning and Concept

3.1 Professional ethics

Professional ethics consists of principles and standards governing conduct within a profession. Information-technology professionals have duties to clients, employers, users, colleagues, the public, and future generations. These duties include competence, honesty, confidentiality, avoidance of conflicts of interest, respect for human dignity, protection of safety, and disclosure of significant risks. Ethical responsibility extends beyond following instructions: a professional may be required to challenge an unsafe or discriminatory requirement.

Ethics differs from personal preference. It involves reasoned justification that can be examined by others. It also differs from law. Law establishes minimum enforceable standards, whereas ethical responsibility may require more than legal compliance. A data practice can be lawful but ethically objectionable if it relies on opaque consent, exploits vulnerable users, or imposes disproportionate risks.

3.2 Governance

Technology governance is the system of authority, decision rights, controls, policies, and accountability through which technology is directed and monitored. It includes board oversight, executive responsibility, technical standards, risk management, audit, documentation, procurement rules, incident response, and mechanisms for complaints and remedy. Governance transforms values into institutional practices.

Effective governance is not synonymous with bureaucracy. Its purpose is to ensure that important decisions are made by appropriate people, on the basis of relevant evidence, with consequences that can be traced and challenged. Good governance also recognises that developers and managers may not be able to anticipate all social effects; participation by affected stakeholders is therefore essential.

3.3 Regulation and compliance

Regulation consists of binding rules established by public authorities or recognised regulatory bodies. It may address privacy, consumer protection, competition, employment, safety, accessibility, intellectual property, cybersecurity, financial services, and environmental impacts. Compliance is the process of identifying applicable obligations, implementing controls, monitoring performance, and demonstrating conformity.

Compliance should not be treated as a substitute for ethics. Regulations may be fragmented across jurisdictions, may lag behind technical development, and may not address every form of harm. A mature organisation uses regulation as a baseline and supplements it with stronger internal standards where necessary.

3.4 Sustainability

Sustainability in information technology concerns the long-term environmental, economic, and social viability of digital systems. Environmental dimensions include energy consumption, greenhouse-gas emissions, water use, mineral extraction, electronic waste, and hardware life cycles. Social dimensions include labour conditions, accessibility, inclusion, digital rights, community effects, and the distribution of technological benefits. Economic sustainability concerns resilient business models, maintainability, affordability, and avoidance of technological lock-in.

4. Fundamental Principles

Several principles provide a foundation for responsible IT.

Respect for autonomy requires meaningful choice, informed consent, and freedom from manipulative or coercive digital practices. Consent is weak when users cannot understand the consequences or must accept unnecessary data collection to obtain an essential service.

Beneficence and non-maleficence require organisations to promote legitimate benefits and prevent, reduce, or remedy foreseeable harm. Impact assessment should consider not only intended users but also bystanders, workers, communities, and people represented in datasets.

Justice and fairness concern the distribution of benefits, burdens, opportunities, and risks. Fairness may require equal treatment, equitable outcomes, compensation for disadvantage, or special protection for vulnerable groups. These interpretations can conflict and must be made explicit.

Transparency and explainability mean that relevant information about purposes, data, decision logic, limitations, and responsible actors is available in an understandable form. Transparency is not achieved by publishing source code if users cannot understand or challenge the system’s effects.

Accountability requires identifiable responsibility, traceable decisions, effective oversight, and remedies for harm. Responsibility should not disappear into claims that “the algorithm decided.”

Privacy and confidentiality protect individuals’ control over personal information and limit inappropriate observation, disclosure, and inference. Privacy includes contextual integrity: information shared for one purpose should not automatically be repurposed for another.

Security and resilience require protection against unauthorised access, manipulation, disruption, and misuse. Security is an ethical obligation because failures can expose people to financial, physical, and psychological harm.

Sustainability and stewardship require consideration of life-cycle impacts, intergenerational justice, and responsible use of shared resources.

5. Major Components / Elements

5.1 Algorithmic fairness

Algorithms can discriminate through biased training data, inappropriate labels, proxy variables, unequal error rates, or deployment in contexts for which they were not designed. Fairness is not a single technical property. Statistical criteria such as demographic parity, equalised error rates, and calibration may be mutually incompatible under certain conditions. Consequently, fairness must be defined in relation to the decision, social context, affected groups, and acceptable risks.

Fairness assessment should examine the complete socio-technical system: problem formulation, data collection, feature selection, model development, human review, deployment, feedback loops, and outcomes. A technically fair model can still support an unjust policy if the underlying objective is inappropriate.

5.2 Accountability and responsibility

Accountability involves answerability, attribution, review, and remedy. Organisations should maintain responsibility maps identifying data owners, model developers, business decision-makers, operators, vendors, and independent reviewers. Documentation should record system purpose, assumptions, data provenance, performance, limitations, incidents, and changes over time.

5.3 Privacy and data governance

Data governance establishes rules for data ownership, quality, classification, access, retention, sharing, provenance, and destruction. Privacy governance adds requirements for lawful purpose, necessity, proportionality, notice, individual rights, and protection against re-identification. Important concepts include data minimisation, purpose limitation, privacy by design, de-identification, encryption, access control, and privacy-impact assessment.

5.4 Intellectual property

Intellectual property includes copyright, patents, trademarks, trade secrets, database rights, and contractual rights. IT organisations must clarify ownership of software, datasets, model outputs, documentation, and employee or contractor contributions. Open-source licensing requires compliance with conditions such as attribution, redistribution, or disclosure of derivative source code, depending on the licence.

Generative AI creates difficult questions concerning training data, authorship, originality, confidentiality, and infringement. Organisations should establish rules for acceptable input data, verification of outputs, attribution, and protection of proprietary information.

5.5 Surveillance and digital power

Surveillance includes systematic observation, recording, analysis, or prediction of people’s behaviour. It may support safety, fraud detection, public health, or service delivery, but it can chill expression, reinforce power asymmetries, and normalise continuous monitoring. Ethical surveillance requires a legitimate and specific purpose, necessity, proportionality, limited retention, strict access control, independent oversight, and avenues for challenge.

5.6 Environmental and social responsibility

Digital services require data centres, networks, devices, minerals, transport, and human labour. Impacts should be assessed across the life cycle rather than only during operation. Social responsibility includes fair labour practices in data labelling and electronics manufacturing, accessibility for people with disabilities, inclusion of marginalised populations, and mitigation of the digital divide.

6. Process / Framework / Methodology

A practical responsible-technology process may be organised into ten stages.

First, define the purpose and public interest. State the problem, intended benefits, affected parties, and reasons the technology is necessary. Reject vague objectives such as “collect data for future value.”

Second, identify stakeholders and power relationships. Include direct users, non-users affected by decisions, employees, communities, regulators, suppliers, and vulnerable groups. Record who benefits, who bears risk, and who can influence decisions.

Third, classify risks and rights. Consider privacy, discrimination, safety, security, intellectual property, competition, labour, accessibility, environmental, and reputational risks. Determine whether the system affects fundamental rights or essential services.

Fourth, establish governance ownership. Assign an accountable executive, technical owner, privacy and security roles, independent review, escalation paths, and decision rights.

Fifth, assess data and model quality. Examine provenance, consent or legal basis, representativeness, missingness, measurement error, labelling practices, historical bias, and potential proxy discrimination.

Sixth, conduct impact assessments. A data-protection impact assessment, algorithmic impact assessment, human-rights assessment, or environmental life-cycle assessment should analyse alternatives, affected groups, mitigations, and residual risk.

Seventh, design controls. Controls may include minimisation, encryption, access restrictions, human review, model cards, audit logs, red-teaming, content safeguards, accessibility features, energy optimisation, and procurement requirements.

Eighth, test before deployment. Test accuracy, robustness, fairness, security, usability, accessibility, privacy leakage, and environmental performance. Testing should use realistic conditions and disaggregated results.

Ninth, deploy with monitoring and remedy. Monitor drift, disparate impacts, complaints, incidents, energy use, and unintended effects. Provide accessible appeal, correction, compensation, and system suspension mechanisms.

Tenth, review, retire, and learn. Governance continues throughout the life cycle. Systems should be modified or withdrawn when risks exceed benefits, objectives change, data become inappropriate, or safer alternatives emerge.

7. Important Theories and Models

Deontological ethics evaluates whether conduct follows duties and rules. It supports prohibitions against deception, coercion, discrimination, and misuse of personal data even where doing so might generate aggregate benefits.

Consequentialism evaluates actions by their outcomes. It encourages comparison of benefits, harms, probabilities, and alternatives. Its weakness is that aggregate gains can obscure unfair burdens placed on minorities.

Virtue ethics focuses on the character of decision-makers and organisations. Qualities such as honesty, courage, humility, justice, and prudence are relevant when rules do not fully determine the answer.

Justice theories examine fair distribution, equal respect, and procedures for legitimate decision-making. Rawlsian reasoning asks whether rules would be accepted without knowing one’s social position; capabilities approaches ask whether people have real opportunities to achieve valued forms of life.

Rights-based approaches prioritise rights such as privacy, freedom of expression, equality, due process, and bodily integrity. They are especially relevant where technology affects essential services or vulnerable people.

Stakeholder theory holds that organisations owe consideration to all materially affected stakeholders, not solely shareholders or immediate customers.

Responsible innovation integrates anticipation, reflection, inclusion, and responsiveness. It asks what futures a technology may create, whose values are embedded, who participates in design, and how the system can be redirected when harms arise.

A useful governance model combines three lines of responsibility: operational teams own everyday controls; risk, legal, privacy, and compliance functions provide challenge and specialist oversight; and internal audit or an independent body evaluates the effectiveness of governance.

8. Practical Applications

In recruitment, an automated screening system should be evaluated for disparate rejection rates, proxy discrimination, accessibility, explainability, and human appeal. Employers should avoid using irrelevant social-media information and should retain evidence supporting decisions.

In healthcare, AI tools should be validated across populations, integrated with professional judgement, and accompanied by disclosure of uncertainty. Patients require meaningful information about automated assistance and routes for correction.

In financial services, credit models must meet consumer-protection and anti-discrimination obligations. Explainability should be sufficient to allow a person to understand adverse factors and challenge inaccurate data.

In education, learning analytics should not permanently label students or convert behavioural prediction into deterministic judgments. Data collection should be proportionate, and students should receive support rather than merely surveillance.

In public administration, facial recognition and predictive policing require exceptional scrutiny because errors can affect liberty and democratic participation. Necessity, proportionality, independent authorisation, and public accountability are essential.

In corporate IT, sustainability can be advanced through energy-efficient architectures, hardware refurbishment, responsible procurement, repairability, renewable-energy sourcing, and measurement of supplier labour conditions.

9. Examples

A retailer that uses loyalty-card data to infer pregnancy or illness may technically possess the data necessary for prediction, but the inference can violate contextual expectations and expose customers to embarrassment or discrimination. Purpose limitation and privacy review should precede such use.

A city that introduces smart cameras to manage traffic may improve congestion management while creating a database capable of tracking individuals. Aggregated traffic measurement, strict retention limits, technical masking, and independent oversight may achieve the public objective with less intrusion.

A software company that releases an open-source machine-learning library gains innovation and transparency benefits but may also enable harmful applications. Governance may require documentation of limitations, safety testing, vulnerability disclosure, and restrictions on high-risk integrations.

10. Technology and Digital Applications

Relevant technologies include privacy-enhancing computation, differential privacy, federated learning, secure multiparty computation, homomorphic encryption, access-management systems, immutable audit logs, model monitoring, explainability tools, data-lineage platforms, and carbon-aware cloud scheduling.

Privacy-enhancing technologies reduce exposure while enabling selected forms of analysis. Differential privacy adds controlled statistical noise so that information about an individual is difficult to infer. Federated learning keeps training data at local sites, although model updates may still require protection. Explainability tools can identify influential features or provide example-based explanations, but they do not automatically establish causal understanding or fairness.

Governance platforms can link datasets, models, policies, approvals, and incidents. Automated compliance tools can detect configuration violations, but they cannot determine whether the organisation’s purpose is ethically justified. Technical controls therefore require institutional judgement and human accountability.

11. Strategic / Managerial Importance

Ethics and governance are strategic because they influence trust, licence to operate, resilience, innovation, and long-term value. Poor governance can lead to regulatory sanctions, litigation, security incidents, loss of customers, employee attrition, and damage to democratic institutions. Conversely, responsible practices can improve data quality, decision reliability, procurement eligibility, stakeholder trust, and market differentiation.

Boards and senior managers should treat high-impact technology as an enterprise-risk issue. They should demand clear ownership, independent challenge, documented risk appetite, investment in privacy and security, and reporting that includes non-financial indicators. Ethical culture matters: employees must be able to raise concerns without retaliation, and performance incentives should not reward unsafe deployment or concealment of failures.

Strategic governance also reduces innovation risk. Early identification of rights, environmental, and regulatory concerns enables redesign before expensive deployment. The objective is not to eliminate all risk, which is impossible, but to make risk visible, justified, proportionate, and governable.

12. Detailed Case Study

Illustrative Case: MetroAssist, an automated public-benefits system

Background. A fictional regional government, Metrovia, introduces MetroAssist to prioritise applications for housing and income assistance. The system uses historical application records, household information, employment data, and fraud indicators. Officials expect faster processing and reduced fraud.

Problem. After deployment, applications from certain neighbourhoods experience higher rejection and review rates. The model uses postal district and employment-history variables that act as proxies for ethnicity, disability, and socioeconomic disadvantage. Applicants receive generic rejection notices and cannot determine which information was inaccurate. Data were retained indefinitely, and the vendor’s contract did not provide sufficient audit access.

Analysis. The system has a legitimate administrative objective, but its design creates several risks. Historical decisions embed past inequalities; proxy variables produce disparate impacts; opacity prevents meaningful appeal; and vendor dependence weakens accountability. The government also failed to assess whether automated prioritisation was appropriate for an essential service. Efficiency benefits therefore cannot be evaluated separately from rights and distributional effects.

Strategy / Solution. Metrovia suspends automatic rejection and limits the system to triage. It commissions an independent impact assessment, disaggregates error and referral rates, and consults affected communities and disability organisations. Postal district is removed unless a demonstrable public-interest justification exists. Applicants receive understandable reasons, access to their data, human review, and correction procedures. A multidisciplinary oversight committee approves future model changes. The vendor must provide documentation, audit access, security controls, deletion schedules, and cooperation with investigations. The government publishes aggregate performance reports and introduces periodic renewal rather than indefinite authorisation.

Outcome. Processing times improve moderately rather than dramatically, but unjustified rejection declines and successful appeals increase. Public confidence improves after the government publishes limitations and remedies. Some fraud-detection benefits are retained through targeted human investigation rather than indiscriminate automated exclusion.

Learning Points. First, a legitimate objective does not justify every technical method. Second, fairness must be evaluated in context and across the whole decision process. Third, human oversight is meaningful only when reviewers have authority, information, and time. Fourth, procurement contracts are governance instruments. Finally, transparency, appeal, and remedy are essential features rather than post-deployment public-relations measures.

13. Advantages / Benefits

Responsible governance can produce greater public trust, improved decision quality, stronger privacy and security, reduced discrimination, clearer accountability, regulatory resilience, and better organisational reputation. Sustainability practices can reduce energy and material costs while supporting resilience. Inclusive design expands access and identifies needs that homogeneous development teams may overlook. Clear intellectual-property management reduces disputes and enables safe collaboration. Impact assessments can also reveal unnecessary data collection, inefficient processes, and safer alternatives.

14. Limitations / Challenges

Ethical governance faces substantial challenges. Values are contested, and fairness criteria may conflict. Organisations may lack reliable demographic data needed to measure disparate impacts, while collecting such data can itself create privacy risks. Supply chains and cloud services make responsibility difficult to trace. Regulation differs across jurisdictions and changes rapidly. Audits may become superficial compliance exercises, and explainability methods may create an appearance of understanding without revealing causal mechanisms.

There are also economic and operational costs. Stronger review can delay deployment, reduce short-term efficiency, or limit profitable data uses. Small organisations may lack specialist expertise. Sustainability metrics are difficult to compare, and claims about carbon neutrality or ethical AI may be exaggerated. Finally, governance cannot eliminate malicious use, structural inequality, or political misuse; it can only reduce and manage these risks.

15. Ethical and Governance Considerations

Ethical governance should begin with affected people rather than with technology. Participation must be meaningful, especially where communities have historically been monitored or excluded. Organisations should distinguish consent from coercion, anonymity from pseudonymity, and explanation from justification. They should avoid using vulnerability as a source of commercial advantage.

Accountability requires remedy. Individuals should be able to contest consequential decisions, correct inaccurate information, obtain human reconsideration where appropriate, and receive compensation or restoration when harm occurs. Governance bodies must have independence from the teams whose projects they review. Conflicts of interest should be declared and managed.

Organisations should also consider collective and group harms. A model may not identify a specific person yet still stigmatise a community. Indigenous data governance, community sovereignty, and culturally appropriate control may require standards beyond individual consent. International data transfers and cross-border AI services should address jurisdiction, rights, security, and unequal bargaining power.

16. Current and Emerging Trends

Generative AI is intensifying concerns about inaccurate outputs, synthetic media, copyright, confidential-data leakage, labour displacement, and concentration of computational power. Governance is moving toward model documentation, risk-tiered controls, provenance mechanisms, red-teaming, human oversight, and restrictions on high-impact uses.

Regulatory approaches increasingly use risk classification rather than treating all AI applications identically. High-impact systems may require impact assessments, data governance, monitoring, transparency, and incident reporting. Privacy regulation is also expanding attention from collection to inference, automated decision-making, and secondary use.

Sustainability is becoming more central as large models and data centres increase electricity and water demand. Organisations are exploring smaller models, efficient hardware, workload scheduling, model distillation, renewable energy, heat reuse, and life-cycle reporting. Digital sovereignty and supply-chain resilience are gaining importance as states and organisations seek control over critical infrastructure, data, chips, and cloud services.

Other developments include algorithmic auditing professions, data trusts, digital identity systems, quantum-related security planning, neurotechnology governance, autonomous agents, and stronger requirements for accessibility and repairability.

17. Best Practices

1. Establish board-level oversight for high-impact digital systems.

2. Maintain an inventory of datasets, models, vendors, purposes, and responsible owners.

3. Use risk-tiered governance so scrutiny is proportionate to potential harm.

4. Apply privacy, security, accessibility, human-rights, and environmental assessment before deployment.

5. Minimise data collection and define retention and deletion rules.

6. Test systems across relevant populations and monitor outcomes after deployment.

7. Document assumptions, limitations, provenance, changes, incidents, and decisions.

8. Provide understandable notices, appeal channels, human review, and effective remedies.

9. Include contractual audit, security, transparency, and termination rights for suppliers.

10. Protect whistle-blowers and reward responsible challenge.

11. Measure energy, emissions, water, hardware life cycle, and labour impacts.

12. Review whether a non-automated or less intrusive alternative would meet the objective.

13. Conduct periodic independent audits and publish meaningful summaries.

14. Retire systems when their risks, costs, or social consequences exceed their value.

18. Future Scope

Future research should develop context-sensitive fairness methods, causal approaches to discrimination, accountable autonomous systems, privacy-preserving analytics, and reliable sustainability metrics. Scholars and practitioners must investigate how governance can operate across international supply chains and platforms whose decisions are distributed among developers, users, vendors, and public authorities.

Further work is required on collective rights, environmental justice, AI labour markets, machine-generated intellectual property, and governance of general-purpose models. Interdisciplinary education will be essential. Technical professionals need legal and social understanding, while policymakers need sufficient technical literacy to regulate effectively without freezing beneficial innovation. The future of IT governance will depend on institutions capable of learning from failure, incorporating public participation, and revising rules as technologies and social conditions change.

19. Chapter Summary

Ethics, governance, regulation, and sustainability are interconnected foundations of responsible information technology. Ethical principles identify duties and values; governance assigns authority and accountability; regulation establishes enforceable obligations; and sustainability examines long-term environmental and social consequences. Algorithmic fairness, privacy, intellectual property, surveillance, security, accessibility, and life-cycle impacts must be considered throughout the technology life cycle. No single theory or technical tool resolves every conflict. Responsible practice requires stakeholder participation, impact assessment, proportionate controls, independent oversight, transparency, remedy, and continuous monitoring. Strategic organisations treat these concerns as sources of resilience and legitimate innovation rather than as obstacles to technical progress.

20. Key Terms

1. Accountability: The obligation to explain decisions, accept responsibility, and provide remedy.

2. Algorithmic fairness: The extent to which an algorithm avoids unjustified or discriminatory differences in treatment or outcomes.

3. Artificial-intelligence governance: Policies and controls directing the development, deployment, and monitoring of AI.

4. Data governance: Institutional rules for data ownership, quality, access, use, retention, and protection.

5. Data minimisation: Collecting and retaining only data necessary for a legitimate purpose.

6. Digital divide: Unequal access to digital technologies, skills, infrastructure, or benefits.

7. Explainability: The capacity to communicate how a system produces or supports a decision.

8. Intellectual property: Legal rights protecting creations, inventions, brands, software, and confidential knowledge.

9. Impact assessment: A systematic evaluation of possible effects, risks, affected groups, and mitigations.

10. Meaningful consent: Agreement based on adequate understanding, genuine choice, and freedom from undue pressure.

11. Privacy by design: Incorporating privacy protections into system architecture and processes from the outset.

12. Proportionality: The requirement that an intervention’s benefits justify its intrusion and risks.

13. Responsible innovation: Innovation that anticipates impacts, reflects on values, includes stakeholders, and responds to concerns.

14. Sustainability: The capacity to meet present needs without undermining future environmental, social, or economic wellbeing.

15. Surveillance: Systematic observation, recording, analysis, or prediction of people or activities.

16. Transparency: Availability of relevant information about purposes, processes, data, limitations, and responsibility.

17. Vendor lock-in: Dependence on a supplier that makes switching systems or providers difficult or costly.

18. Privacy-enhancing technology: A technology designed to enable useful processing while reducing exposure of personal information.

21. Review Questions

Short Answer Questions

1. Distinguish between ethics, law, and governance in information technology.

2. Why is algorithmic fairness a socio-technical rather than purely technical issue?

3. Explain the principle of data minimisation.

4. What is the relationship between transparency and accountability?

5. Identify three environmental impacts associated with digital systems.

Long Answer Questions

1. Critically evaluate the use of deontological, consequentialist, and virtue-ethics theories in governing artificial intelligence.

2. Explain a complete life-cycle framework for responsible data and AI governance.

3. Discuss how surveillance technologies can produce both public benefits and threats to autonomy and democracy.

4. Analyse the role of intellectual-property governance in software, open-source projects, and generative AI.

5. Evaluate why sustainability should be treated as a strategic IT-governance concern rather than only an environmental initiative.

Analytical / Application Questions

1. A university proposes an AI system to identify students at risk of dropping out using attendance, learning-platform activity, and financial data. Design an ethical and governance assessment, including stakeholders, risks, controls, and appeal mechanisms.

2. A financial institution discovers that its credit model has equal overall accuracy across demographic groups but substantially higher false-rejection rates for one group. Analyse whether the model is fair and recommend actions.

3. A cloud provider offers a cheaper service powered by data centres in a region with weak labour protections and high water stress. Develop a procurement recommendation that integrates cost, resilience, ethics, regulation, and sustainability.

22. Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes governance from regulation?

A. Governance concerns only software development, while regulation concerns only hardware.

B. Governance establishes organisational authority and controls, while regulation provides legally enforceable external requirements.

C. Governance is voluntary personal behaviour, while regulation is a technical testing method.

D. Governance applies only after an incident, while regulation applies only before deployment.

Correct Answer: B. Governance establishes organisational authority and controls, while regulation provides legally enforceable external requirements.

Question 2

Why can a technically accurate algorithm still be ethically unacceptable?

A. Accuracy always prevents transparency.

B. Technical accuracy may coexist with discriminatory objectives or unequal burdens.

C. Accurate algorithms cannot be audited.

D. Accuracy eliminates the need for human oversight.

Correct Answer: B. Technical accuracy may coexist with discriminatory objectives or unequal burdens.

Question 3

Which practice best reflects data minimisation?

A. Collecting all potentially useful data indefinitely.

B. Sharing personal data with vendors without purpose restrictions.

C. Collecting and retaining only data necessary for a defined legitimate purpose.

D. Replacing security controls with user consent.

Correct Answer: C. Collecting and retaining only data necessary for a defined legitimate purpose.

Question 4

What is the primary purpose of an algorithmic impact assessment?

A. To guarantee that a model will never produce an error.

B. To evaluate potential effects, affected groups, risks, and mitigation measures.

C. To replace all legal and ethical review.

D. To maximise the volume of data used for training.

Correct Answer: B. To evaluate potential effects, affected groups, risks, and mitigation measures.

Question 5

Which situation most clearly illustrates a privacy problem involving contextual integrity?

A. Encrypting a database at rest.

B. Using information supplied for medical care to make unrelated commercial inferences without appropriate justification.

C. Deleting obsolete records according to policy.

D. Allowing a patient to correct inaccurate information.

Correct Answer: B. Using information supplied for medical care to make unrelated commercial inferences without appropriate justification.

Question 6

What is a central limitation of explainability tools?

A. They always reveal causal relationships.

B. They can provide understandable features or examples without proving that a decision is fair or causally justified.

C. They prevent all model changes.

D. They eliminate the need for documentation.

Correct Answer: B. They can provide understandable features or examples without proving that a decision is fair or causally justified.

Question 7

Which governance response is most appropriate for a high-impact automated benefits system?

A. Allow automatic rejection with no appeal to improve efficiency.

B. Remove all human involvement because humans may be biased.

C. Provide impact assessment, human review, understandable reasons, correction, and appeal mechanisms.

D. Keep the vendor’s model entirely unaudited as a trade secret.

Correct Answer: C. Provide impact assessment, human review, understandable reasons, correction, and appeal mechanisms.

Question 8

Why should sustainability assessment use a life-cycle perspective?

A. Operational electricity is the only environmental impact that matters.

B. Life-cycle analysis captures impacts from extraction, manufacturing, operation, and disposal.

C. Life-cycle assessment applies only to paper products.

D. It guarantees that every digital service is carbon neutral.

Correct Answer: B. Life-cycle analysis captures impacts from extraction, manufacturing, operation, and disposal.

Question 9

Which action best supports accountability in an AI procurement contract?

A. Prohibiting all documentation by the supplier.

B. Requiring audit access, incident reporting, performance documentation, and clear responsibility provisions.

C. Allowing indefinite retention of all customer data.

D. Assigning responsibility solely to the algorithm.

Correct Answer: B. Requiring audit access, incident reporting, performance documentation, and clear responsibility provisions.

Question 10

A model has equal accuracy across groups but a much higher false-rejection rate for one group. What is the most appropriate conclusion?

A. The model is automatically fair because overall accuracy is equal.

B. The model requires further fairness analysis because equal accuracy can conceal unequal error burdens.

C. Fairness cannot be assessed using outcomes.

D. The affected group should be excluded from evaluation.

Correct Answer: B. The model requires further fairness analysis because equal accuracy can conceal unequal error burdens.