Ethical AI Governance - Detailed Explanation

Ethical AI Governance = System to ensure AI is lawful, robust, fair, transparent, accountable, human-centric throughout lifecycle - design, training, deployment, monitoring.

It is no longer soft ethics - since EU AI Act Regulation 2024/1689 entered force 1 Aug 2024 and EU Product Liability Directive 2024/2853, it is hard law with fines up to 7% global turnover.

1. Global Frameworks - 5 Pillars

OECD AI Principles 2019, updated 2024 - adopted by 46 countries:

1. Inclusive growth, sustainable development
2. Human-centric values & fairness - no discrimination
3. Transparency & explainability
4. Robustness, security, safety
5. Accountability

EU AI Act 2024/1689 - Risk-based:

• Unacceptable Risk - 8 bans from Feb 2025: Social scoring, real-time remote biometric ID in public for law enforcement (except narrow), emotion recognition at workplace/education, manipulative AI.
• High-Risk - Annex III: Recruitment, credit scoring, law enforcement, medical devices, critical infrastructure. Must have - risk management system, data governance, technical documentation, human oversight, logs, conformity assessment, CE marking.
• Limited Risk: Chatbots, deepfakes - transparency duty Art 50 - must disclose AI generated.
• GPAI Models: Foundation models like GPT-4 must provide training data summary, copyright compliance.

India: No dedicated AI law. Patchwork:

• IT Act 2000, DPDP Act 2023 for privacy
• NITI Aayog Principles for Responsible AI 2021 - 7 principles: Safety, Equality, Inclusivity, Privacy, Transparency, Accountability, Human oversight
• MeitY Subcommittee guidelines - Transparency, Accountability, Safety, Privacy

Spain: No standalone AI law yet, but most advanced supervision in EU:

• AESIA - Spanish Agency for Supervision of AI created under Royal Decree - first AI agency in EU. On 18 Dec 2025 AESIA issued detailed guidance and templates for high-risk providers under AI Act.
• Anteproyecto de Ley para el Buen Uso y la Gobernanza de la IA approved in first reading - will transpose AI Act + create liability regime.
• Product Liability: Royal Legislative Decree 1/2007 applies to AI products, soon replaced by Directive 2024/2853 - claimant friendly - presumption of defect if AI output is opaque.

2. Ethical AI Governance Model for Enterprise / Bank

10 Pillars as per NIST AI RMF + EU:

1. Board Oversight: Board AI Committee, AI Risk Officer - ASIC v Bekier principle below
2. AI Inventory & Risk Classification: Map all AI per EU risk levels
3. Data Governance: Training data lawful, unbiased, representative - Google Spain case on data minimization
4. Model Validation: Bias testing, adversarial testing, performance metrics per subgroup
5. Human in Loop: No fully automated high-risk decision without human review - Art 14 AI Act
6. Transparency & Explainability: Explainable AI report for credit denial - SCHUFA case
7. Logging & Traceability: Retain prompts, outputs, overrides
8. Incident Response: Recall = patching, disabling, rollback of model
9. Third Party Management: AI Verify toolkit for vendors
10. Continuous Monitoring: Post-market monitoring Art 61 AI Act

Google's AI Principles and Microsoft Responsible AI Framework are benchmarks - clear accountability structures.

3. Case Laws - Most Important

A. Foundation Cases - Privacy & Explainability:

1. Google Spain SL and Mario Costeja González - CJEU C-131/12
Right to be forgotten. Established that AI search engine is data controller. Basis for AI data governance - if your AI trains on personal data without consent, liable under GDPR. Spain origin case.[2014]

2. SCHUFA Holding AG - CJEU C-634/21 - 7 Dec 2023
Credit scoring by AI - automated decision. CJEU held credit score by SCHUFA itself is automated decision under Art 22 GDPR if bank relies heavily on it. Requires meaningful human review and explanation. Direct impact on banks using AI for lending - cannot reject loan solely on AI score.

B. Spain-Specific AI Cases:

3. BOSCO Algorithm - Spanish Public Administration
Spanish government used BOSCO algorithm to determine eligibility for electricity social bonus. No transparency, no access to code. Courts forced disclosure. Pressure for explainability and access to technical information - future causation/defect arguments in AI harm. Principle: Public sector AI must be auditable.

4. CGT v. Foundever - Audiencia Nacional (Spain) 4 July 2025
Employer denied using algorithms in HR. Court voided practice, sanctioned breach of trade union information rights and ordered disclosure of algorithm parameters to worker representatives. Annex III point 4(a) AI Act - AI used for recruitment is high-risk. This is first Spanish enforcement of AI Act Art 5 workplace emotion recognition ban + Art 26 worker information.

5. Almendralejo Scandal - 2024 - 15 minors used AI nudification apps to generate sexual images of 20 schoolgirls via Telegram
Case study on corporate liability gaps. Spanish Prosecutor investigated AI app providers. AI Act Art 50 transparency duties fell short. Shows need for governance under DSA Regulation 2022/2065 directly applicable in Spain.

C. Global Ethical AI Failures:

6. ASIC v Bekier FCA 196 - Australia - Directors Duties & AI
Key takeaway: Reliance on AI does not provide defence to breach of duty of care under s180 Corporations Act. Board used AI for financial reporting, AI hallucinated. Court held directors must implement governance frameworks to guide use of AI, including formal AI-use policies, controls on confidentiality and data input. This is now global standard for directors in Spain too.[2026]

7. Northbound Processing v SA Diamond and Precious Metals Regulator - South Africa 2025
Lawyers relied on AI tool Legal Genius which generated fictitious case citations. Court sanctioned lawyers. Cautionary tale - AI governance requires verification - ABA Opinion 512 and Florida Bar Opinion 24-1 require verify every citation against primary sources.

8. FinTech Agent That Broke Law - Case Study Logiciel.io
Startup launched agent that auto-approved small loans based on internal credit scoring. Within weeks, regulators discovered it disproportionately rejected applicants from protected groups. Violated fair lending. Shows governance must include bias audit before deployment.

D. India Cases Relevant to AI Governance:

9. K.S. Puttaswamy v. Union of India (2017) - Right to Privacy
Supreme Court held privacy is fundamental right. Any AI processing personal data must pass necessity, proportionality, legality test. Basis for DPDP Act.

10. Shreya Singhal v. Union of India (2015)
Struck down Sec 66A IT Act for free speech. Limits on AI content moderation - AI cannot over-block.

11. Amway India Enterprises Pvt Ltd v. 1MG Technologies (2020) & Delhi HC on Facial Recognition (2023)
Delhi HC restrained indiscriminate use of facial recognition by police without safeguards. Principle of proportionality for AI surveillance.

4. Liability under New Regime

EU Product Liability Directive 2024/2853 - In force 8 Dec 2024, awaiting implementation in Spain:

• AI system is product. If AI defective, producer liable.
• Presumption of defect if defendant fails to disclose logs, or output is opaque and claimant shows likely defect.
• For AI, recall = patching, disabling, rolling back models.

Spanish Civil Code: Art 1902 - general fault liability applies even without human operator intent.

EU AI Act Fines:

• Up to €35M or 7% for unacceptable risk violations
• Up to €15M or 3% for high-risk obligations
• Up to €7.5M or 1% for providing false info to authorities

5. What You Must Implement Today

For a bank in Spain / EU:

1. Appoint AI Officer, register high-risk systems with EU database before Aug 2026
2. Conformity assessment per AESIA templates Dec 2025
3. Data governance - Document training data lineage
4. Human oversight - No auto-rejection of credit, HR without human sign-off
5. Transparency - Disclose AI use to customer per Art 50
6. Logs - Keep for 10 years per Art 19