Ethics & Law Layer

Framework layer defining norms, rights, and regulations for responsible conduct in metaverse environments through compliance mechanisms, ical AI governance, and legal frameworks.

Semantic Classification

Content

Compositional Relationships (Components)

SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:hasPart ai:ComplianceFramework))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:hasPart ai:EthicalAIGuidelines))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:hasPart ai:LegalRegulationSchema))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:hasPart ai:RightsManagementSystem))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:hasPart ai:PolicyEngine))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:hasPart ai:AuditLogging))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:hasPart ai:IdentityManagement))

Dependency Relationships

SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:requires ai:PolicyEngine))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:requires ai:IdentityManagement))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:requires ai:AuditLogging))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:requires ai:TrustFramework))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:requires ai:RegulatoryStandards))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:requires ai:EthicsPrinciples))

Capability Relationships

SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:enables ai:ResponsibleAI))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:enables ai:LegalCompliance))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:enables ai:EthicalGovernance))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:enables ai:RightsProtection))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:enables ai:Accountability))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:enables ai:Transparency))

Implementation Relationships

SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:implements ai:EUAIAct))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:implements ai:GDPR))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:implements ai:OECDAIPrinciples))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:implements ai:ISOIECFortyTwoZeroZeroOne))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:implements ai:NISTAIRMF))

Reduction Relationships

SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:reducesTo ai:ComplianceFramework))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:reducesTo ai:PolicyEngine))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:reducesTo ai:RightsManagementSystem))
SubClassOf(ai:EthicsLawLayer
  ObjectSomeValuesFrom(ai:reducesTo ai:AuditLogging))

About

The Ethics & Law Layer concept emerges from the recognition that ethical commitments and legal obligations cannot remain external to the systems they govern; they must be embedded as first-class architectural components that shape system behaviour at runtime rather than constraining it only through post-hoc audit. In early AI governance discourse, the dominant model was sequential: design a system, evaluate it against ethical criteria, adjust if needed, then deploy. This model proved inadequate because it treated ethics as a filter applied at deployment boundaries rather than as a continuous constraint woven through system operation. The layered architectural approach — treating ethics and law as an explicit middleware stratum — emerged from software engineering practice (particularly in enterprise compliance systems and security architectures) and was formalised in AI governance literature as the imperative to operationalise principles became urgent with large-scale AI deployment in high-risk domains.

In the context of the MSF (Metaverse Standards Forum) taxonomy from which this concept originates, the Ethics & Law Layer specifically addresses the governance challenges of persistent virtual environments: spaces where millions of users interact through avatars, economic transactions occur under novel property regimes, identity is fluid or pseudonymous, and the platform operator exercises quasi-governmental control over inhabitants. These environments expose the limits of pre-existing legal frameworks — territorial jurisdiction breaks down when users from 50 countries interact in a single virtual space; intellectual property law struggles with user-generated content that is simultaneously a creative work, an economic asset, and a software object; and personal data protection becomes complex when behavioural and biometric signals (gaze tracking, body movement, emotional response) are continuously harvested to drive experience personalisation. The Ethics & Law Layer provides the governance infrastructure to address these challenges through a combination of technical enforcement mechanisms (the Policy Engine that evaluates proposed actions), rights management systems (that assign, track, and enforce Rights Protection claims over virtual assets and personal data), and audit infrastructure (the Audit Logging system that creates the evidence trail needed for accountability).

The layer’s relationship to broader AI Governance and Ethics is one of instantiation: it takes abstract governance requirements — “AI systems should be transparent,” “individuals should be able to contest automated decisions,” “personal data should be processed only for specified purposes” — and transforms them into concrete system behaviours: transparency-by-design components that log model explanations alongside decisions; human escalation pathways that activate when algorithmic confidence falls below threshold; data minimisation controls that prevent collection of attributes beyond defined scope. This transformation is both technical and organisational: technical because it requires software components that enforce policies at runtime; organisational because it requires governance structures that maintain the policy set, conduct reviews when regulations change, and ensure human oversight for decisions that exceed automated authority. The Compliance Framework that the layer contains is not a static document but a living operational artefact that must be updated as the regulatory environment evolves — a challenging requirement given the pace of AI regulation in the 2024–2026 period, when the EU AI Act, South Korea’s Basic Act on AI, the Council of Europe’s AI Convention, and numerous national AI strategies all entered force within a twenty-four-month window.

Components / Architecture

The Ethics & Law Layer is composed of six principal sub-components that work in concert to provide comprehensive normative governance:

Policy Engine

• The central enforcement component; evaluates proposed system actions against a multi-source rule-set derived from ethical guidelines, regulatory requirements, and organisational policies

• Implements both hard constraints (rules that cannot be overridden — the EU AI Act’s prohibited AI practices under Article 5) and soft constraints (guidelines that trigger human review when breached)

• Integrates policy-as-code approaches (e.g., Open Policy Agent, Rego language) enabling declarative specification of governance rules that can be version-controlled and tested

• Interfaces with external regulatory APIs to receive real-time updates when regulatory guidance changes

• Escalation logic routes decisions that exceed automated authority to human reviewers with appropriate context

  Legal Regulation Schema

• Structured ontological representation of applicable legal obligations mapped to system contexts

• Covers: EU AI Act risk tiers and obligations; GDPR data protection requirements; sector-specific instruments (FCA AI guidance, MHRA AI medical device requirements, NHS AIDE framework)

• Maintains jurisdiction mappings for cross-border deployments — EU, UK post-Brexit, US (state and federal), APAC regional requirements

• Versioned to track regulatory change; schema updates trigger policy engine rule reviews

  Rights Management System

• Tracks and enforces rights claims across: data subject rights (GDPR Articles 15-22); intellectual property rights over user-generated content; digital property rights in virtual environments; identity rights and pseudonymity preferences

• Implements automated rights fulfilment workflows (access request processing, deletion workflows, portability exports)

• Maintains consent ledger recording lawful basis for each data processing activity with timestamps and audit trails

• For metaverse contexts: manages avatar identity rights, virtual asset ownership claims, and cross-platform portability of user-created content

  Audit Logging Infrastructure

• Immutable, timestamped records of all system decisions with full provenance: inputs, model version, policy rules applied, confidence scores, human reviewer actions

• Supports post-hoc accountability analysis, regulatory inspection, and incident investigation

• Integrates with Blockchain-based tamper-evident logging for high-assurance contexts requiring multi-party audit trust

• Retention policies aligned to regulatory requirements (GDPR data minimisation vs. EU AI Act post-market monitoring obligations — a tension requiring jurisdiction-specific configuration)

  Identity Management

• Authenticates and authorises agents (humans, AI systems, automated processes) interacting with system components

• Maps actions to accountable principals enabling the “who did what, when” attribution required for legal accountability

• Manages identity in complex contexts: pseudonymous virtual world identities; AI agent identities in multi-agent systems; cross-jurisdictional identity federation

• Integrates with Trust Framework credential infrastructure for verifiable identity claims

  Ethical AI Guidelines Module

• Operationalises ethical principles as system constraints: translates abstract requirements (fairness, non-maleficence, autonomy-preservation) into measurable metrics that the policy engine can evaluate

• Integrates algorithmic fairness libraries (disparate impact testing, counterfactual fairness evaluation) as runtime monitoring components

• Produces Algorithmic Impact Assessment artefacts documenting ethical review outcomes for high-risk decisions

• Interfaces with Explainable AI components to ensure explanations are generated and accessible to affected individuals

  Use Cases / Major Families

  AI System Deployment Governance The Ethics & Law Layer is deployed as the governance stratum in AI system stacks for high-risk applications under the EU AI Act — covering employment screening, credit scoring, biometric identification, critical infrastructure control, and law enforcement applications. For these systems, the layer implements the EU AI Act’s Annex IV technical documentation requirements, manages the conformity assessment evidence file, enforces human oversight obligations (human-in-the-loop for high-stakes decisions), and executes the post-market monitoring plan that tracks system performance against documented accuracy claims in deployment. The layer’s policy engine prohibits actions categorised as absolutely banned under EU AI Act Article 5 — social scoring by public authorities, emotion recognition in workplaces and schools, real-time remote biometric identification in public spaces for law enforcement (except under limited judicial authorisation exceptions) — and these prohibitions are hard-coded as non-overridable rules since February 2025 when Article 5 became applicable.

  Metaverse and Virtual World Governance In persistent virtual environments, the Ethics & Law Layer addresses the novel governance challenges that arise when a platform operator exercises quasi-governmental power over a large user population in a jurisdiction-ambiguous space. The layer implements: content moderation rules (using a hybrid human-AI approach that respects the platform’s content standards while preserving user expression rights); virtual asset governance (tracking ownership, enforcing transaction rules, managing cross-platform portability of user-created assets); avatar identity governance (preventing impersonation, managing pseudonymity, enforcing age verification); and data protection for the continuous behavioural streams (gaze, gesture, movement, biometrics) that immersive platforms generate. The MSF Taxonomy 2025, which defines this concept, places the Ethics & Law Layer as the stratum that encapsulates all of this governance functionality within the broader middleware stack, ensuring that application-layer components cannot bypass normative constraints.

  Agentic AI System Governance As AI agents acquire capabilities to take real-world actions (sending emails, executing code, making purchases, interacting with APIs), the Ethics & Law Layer becomes a critical runtime guardian that evaluates proposed actions before execution. An agent tasked with managing a company’s supplier relationships must not execute actions that violate sanctions laws (refusing payments to sanctioned entities), breach contractual obligations (respecting exclusivity clauses), or violate privacy (accessing supplier employee data without lawful basis). The policy engine in the layer evaluates each proposed agent action against these constraints, blocking prohibited actions, escalating ambiguous situations to human oversight, and logging all decisions for accountability. This use case is particularly important because agentic AI actions can have irreversible real-world consequences that human review after the fact cannot remedy.

  Public Sector AI Deployment Government agencies deploying AI in public administration — benefit allocation, planning decisions, law enforcement risk assessment, immigration decisions — face the most stringent ethical and legal constraints, as these decisions directly affect fundamental rights and are subject to judicial review, human rights law, and constitutional principles of procedural fairness. The Ethics & Law Layer for public sector AI must implement algorithmic impact assessment as a mandatory pre-deployment step (required by the EU AI Act for high-risk AI in public administration), maintain appeal and human review pathways for all automated decisions affecting individuals (required by GDPR Article 22 and UK GDPR equivalents), and provide transparent explanations that meet the standard of “meaningful information” required for individual rights enforcement.

  Cross-Jurisdictional Platform Compliance Multinational platforms operating across EU, UK, US, and APAC markets must satisfy overlapping and sometimes conflicting regulatory requirements through a unified governance layer with jurisdiction-specific configuration. The Ethics & Law Layer achieves this through modular legal regulation schemas (one per jurisdiction), a conflict-resolution mechanism for overlapping obligations, and logging of which jurisdiction’s requirements applied to each decision. Post-Brexit, UK platforms must maintain parallel compliance with UK GDPR (largely aligned with EU GDPR) and the UK AI regulatory approach (currently sector-regulator-led rather than an AI-specific act) while preparing for the anticipated UK AI Governance Bill expected in 2026–2027.

  Academic Context

  The concept of embedding ethical and legal constraints as architectural layers within computing systems has deep roots in computer science, tracing to work on policy-based networking (1990s), access control systems, and trusted computing platforms. In AI governance, the architectural embedding approach was advocated early by Floridi and colleagues in the AI4People framework (2018), which argued that ethical AI requires not just guidelines and principles but technical mechanisms that operationalise those principles within systems. Dignum’s work on responsible AI (2019) explicitly frames ethics as a design constraint embedded in system architecture rather than an external post-hoc filter. The EU Ethics Guidelines for Trustworthy AI (HLEG, 2019), while primarily a principles document, included an annex on “Technical and Non-Technical Methods for Trustworthy AI” that prefigured the architectural approach by describing how each of the seven trustworthiness requirements maps to specific technical implementations.

  The field of AI governance architecture — treating governance not as a process surrounding AI systems but as a structural component within them — has matured significantly in 2022–2026. Work by Wieringa et al. on “Responsible AI under the Law” (2022) examined how legal obligations translate into engineering requirements, providing a methodology for mapping regulatory texts to system-level controls. The NIST AI Risk Management Framework (2023) operationalised this mapping through its GOVERN/MAP/MEASURE/MANAGE functions, which correspond closely to the sub-components of the Ethics & Law Layer. The alignment of ISO IEC 42001:2023 (AI Management Systems standard) with the EU AI Act’s technical documentation requirements created a standards ecosystem that effectively specifies the contents of the Ethics & Law Layer for AI providers seeking regulatory compliance.

  Research on policy-as-code — encoding governance requirements as machine-executable rules — has become a significant sub-field connecting software engineering with AI governance. Open Policy Agent (CNCF project) and its Rego policy language provide the technical substrate for policy engine implementation, enabling version-controlled, testable governance rules that can be continuously evaluated against proposed system actions. Academic work on formal policy languages for AI governance (Robaldo et al., 2020; Governatori et al., 2021) addresses the challenge of translating natural-language regulatory text into unambiguous formal rules — a problem that remains partially unsolved given the inherent ambiguity of legal language. LLM-based regulatory interpretation tools (emerging 2024–2026) are being applied to this problem, with promising results in structured regulatory domains (EU AI Act Annex III risk categorisation; GDPR lawful basis assessment) but remaining challenges in novel fact patterns where legal interpretation is genuinely uncertain.

  Research on metaverse ethics specifically has grown substantially since 2022. Ethical challenges unique to persistent virtual environments include: the problem of avatar autonomy versus platform governance (should platforms have the right to restrict avatar behaviour in ways that would be unacceptable if applied to persons?); digital property rights in environments where the platform operator can unilaterally alter or delete virtual assets; consent and data protection for behavioural streams far richer than anything conventional digital platforms capture; and the governance of AI-driven virtual characters (NPCs) who interact with users in potentially manipulative ways. Springer Nature’s journal AI and Ethics published work in 2024 examining these challenges specifically, while the Tanfonline Ethics in the Metaverse paper (2025) proposed “responsible innovation as a pathway for policy and industry” — a model in which platform developers, regulators, and civil society co-create governance frameworks iteratively rather than waiting for settled law.

  Current Landscape (2026)

  The regulatory environment that the Ethics & Law Layer must satisfy became dramatically more demanding in 2024–2026. The EU AI Act entered into force on 1 August 2024 and reached its first major milestone — banning prohibited AI practices under Article 5 — on 2 February 2025. These prohibitions (social scoring, emotion recognition in workplaces and schools, real-time biometric identification in public spaces, exploitation of vulnerable groups’ psychological characteristics) are now hard legal constraints that policy engines in the Ethics & Law Layer must implement as non-overridable rules for any system serving EU markets. The high-risk AI provisions (Annex III systems including employment, credit, education, law enforcement, immigration, and critical infrastructure AI) were originally scheduled for August 2026 but were deferred to December 2027 under the Digital Omnibus provisional agreement of May 2026 — a concession to industry readiness concerns. This deferral does not reduce the ultimate obligations; it provides additional preparation time, making the Ethics & Law Layer’s implementation even more strategically important as organisations use the window to build robust governance infrastructure before enforcement begins.

  The Council of Europe’s Framework Convention on Artificial Intelligence — the first legally binding international treaty specifically addressing AI and human rights — entered into force in September 2024 and had been ratified by 11 nations (including the UK, EU member states, and the US) by June 2026. The Convention establishes international baseline obligations around human rights protection, non-discrimination, transparency, and accountability for AI systems, supplementing the EU AI Act for Convention signatories and providing a governance framework for non-EU jurisdictions seeking to align with European standards without adopting the EU’s specific regulatory architecture. The Ethics & Law Layer in international deployments must track Convention obligations alongside EU AI Act and national law requirements.

  In the UK, the Data (Use and Access) Act 2026 received Royal Assent on 19 June 2026, modernising the UK’s data protection framework with specific provisions affecting AI applications — including changes to automated decision-making rules, data access for AI training, and requirements for transparency about AI-generated content. The UK’s approach to AI regulation remains sector-regulator-led rather than AI-act-style: the FCA governs AI in financial services, the MHRA governs AI in medical devices, the ICO governs AI in data-intensive contexts, and OFCOM governs AI in broadcasting and online safety. The Ethics & Law Layer for UK deployments must therefore interface with this distributed regulatory landscape through a multi-regulator compliance schema rather than a unified AI-specific framework. The anticipated UK AI Governance Bill (expected 2026–2027) may create a more unified framework, but as of June 2026 the sector-regulator approach remains operative.

  Industry adoption of Ethics & Law Layer architectures (under various naming conventions — “AI governance middleware,” “responsible AI platform,” “ethics layer,” “AI compliance stack”) has accelerated significantly. Gartner reported in 2025 that 67% of large enterprises were actively investing in AI governance tooling, up from 34% in 2023. However, fewer than 25% had board-approved, structured AI governance policies in place — indicating that investment in technical governance components (the tooling layer) was outpacing investment in the organisational governance structures (the policy and accountability layer) that must configure and oversee those components. This gap is a key challenge: a policy engine with no policy inputs, or an audit logging system with no audit review process, provides compliance theatre rather than genuine governance.

  UK Context

  The UK has developed significant expertise in ethics-and-law-layer governance through a combination of regulatory innovation, academic research, and public sector AI deployment experience. The Information Commissioner’s Office (ICO) has published detailed guidance on AI and data protection — specifically the “Explaining decisions made with AI” guidance (co-produced with the Alan Turing Institute) — that defines the transparency and explainability requirements that Ethics & Law Layer implementations must satisfy for UK AI deployments processing personal data. The ICO’s AI and data protection guidance directly informs the configuration of the Ethical AI Guidelines module within the layer, specifying what counts as “meaningful explanation” for automated decisions affecting individuals.

  The Financial Conduct Authority (FCA) has issued AI guidance that creates sector-specific Ethics & Law Layer requirements for financial services AI, including model risk management obligations, fairness testing requirements for credit and insurance AI, and transparency requirements for algorithmic trading systems. The FCA’s February 2024 Discussion Paper on AI (DP24/1) signalled a move toward more specific AI rules in financial services — an anticipated development that financial sector Ethics & Law Layer implementations must anticipate. The Prudential Regulation Authority’s SS1/23 “Model Risk Management Principles for Banks” (2023, updated 2024) specifically addresses machine learning model risk, requiring banks to maintain model inventories, conduct adversarial testing, and provide explainability — requirements directly implemented within the Ethics & Law Layer’s Audit Logging and Ethical AI Guidelines components.

  Northern English universities have made significant contributions to Ethics & Law Layer research and implementation. The University of Manchester’s Centre for Digital Trust and Society researches the governance of AI in public services, including the technical architectures that enable compliant deployment of AI in healthcare, local government, and benefits administration — contexts where the Ethics & Law Layer must satisfy both the ICO’s data protection requirements and the emerging AI governance expectations of sector regulators. Manchester City Council’s work on AI in public services has piloted Ethics & Law Layer approaches in adult social care referral systems, using algorithmic impact assessment and human oversight requirements that prefigure the EU AI Act’s high-risk AI obligations. Leeds City Council has implemented algorithmic transparency registers — public lists of AI systems in use, their decision domains, and the human oversight mechanisms in place — which represent an early form of the audit and transparency infrastructure that the Ethics & Law Layer formalises. Newcastle University’s Digital Institute has researched the legal frameworks for AI in the public sector, with particular attention to the intersection of administrative law (natural justice, procedural fairness, right to reasons) with automated decision-making systems — work that directly informs the appeal pathway and human escalation components of the Ethics & Law Layer.

  Sheffield’s AMRC (Advanced Manufacturing Research Centre) works on Ethics & Law Layer implementations for industrial AI in manufacturing contexts, where the layer must satisfy both health and safety law (ensuring AI-assisted manufacturing decisions do not endanger workers) and product liability law (ensuring AI-assisted quality control decisions meet the standard required for CE/UKCA marking). The UKRI Trustworthy Autonomous Systems Hub, led by the University of Nottingham (2020–2025), produced comprehensive research on the technical and governance requirements for trustworthy autonomous systems across five domains — safety, reliability, explainability, responsibility, and security — that maps directly to the sub-components of the Ethics & Law Layer.

  Future Directions (2026–2030)

  Automated regulatory change management — As the regulatory environment continues to evolve rapidly (new instruments, updated guidance, sector-specific requirements), Ethics & Law Layer implementations will require automated regulatory monitoring and policy update capabilities. LLM-based regulatory interpretation tools — systems that read new regulatory texts and propose policy engine rule updates — are in early development as of 2026, with promising results for structured regulatory domains. Achieving reliable automated regulatory parsing would dramatically reduce the compliance engineering burden and enable near-real-time policy updates in response to regulatory change. The challenge is that legal language often requires contextual interpretation and judgment that current LLMs do not reliably provide; human review of automated rule proposals will remain necessary for the foreseeable future.

  Federated ethics governance for multi-stakeholder AI systems — As AI systems increasingly operate in multi-organisation contexts (supply chains, healthcare networks, financial market infrastructure), the Ethics & Law Layer must evolve from a single-organisation governance stratum to a federated governance architecture where multiple organisations each contribute governance components that operate coherently as an integrated system. This requires standardised policy exchange protocols, mutual recognition frameworks for governance artefacts (conformity assessments, audit logs, impact assessments), and dispute resolution mechanisms for conflicting governance requirements. The EU AI Act’s provisions for multi-operator AI supply chains provide early regulatory scaffolding for this challenge, but the technical standards for federated ethics governance remain to be developed.

  Ethics & Law Layer for agentic AI at scale — As agentic AI systems acquire broader autonomous capabilities, the Ethics & Law Layer must scale to evaluate thousands of proposed actions per minute in complex multi-agent environments. Current policy engine approaches are designed for relatively infrequent high-stakes decisions; agentic AI may require continuous, low-latency governance evaluation for every micro-action an agent considers. Research into efficient policy evaluation architectures — policy caching, incremental policy evaluation, risk-stratified evaluation that applies full compliance checking only to high-stakes actions — is an active area of engineering research that will shape the next generation of Ethics & Law Layer implementations.

  International harmonisation of ethics layer standards — The Council of Europe AI Convention, the Seoul AI Safety Summit commitments, and the G7 Hiroshima AI Process are creating international coordination frameworks that will progressively harmonise the normative requirements that Ethics & Law Layer implementations must satisfy across jurisdictions. This harmonisation will reduce the compliance burden for international deployments and enable mutual recognition of governance artefacts, but it requires technical standards for Ethics & Law Layer interoperability — standardised audit log formats, common impact assessment schemas, and policy exchange protocols — that are currently being developed by ISO/IEC JTC 1/SC 42 and the IEEE Standards Association.

  Research & Literature

  1. Floridi, L., Cowls, J., Beltrametti, M., et al. (2018). AI4People — An Ethical Framework for a Good AI Society. Minds and Machines, 28(4), 689–707. https://doi.org/10.1007/s11023-018-9482-5
  2. Dignum, V. (2019). Responsible Artificial Intelligence: How to Develop and Use AI in a Responsible Way. Springer.
  3. European Commission High-Level Expert Group on AI (2019). Ethics Guidelines for Trustworthy AI. European Commission.
  4. OECD (2024). OECD Principles on Artificial Intelligence (updated). OECD Policy Paper.
  5. European Parliament and Council (2024). Regulation (EU) 2024/1689 on Artificial Intelligence (EU AI Act). OJ L 2024/1689.
  6. Council of Europe (2024). Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225).
  7. ISO/IEC (2023). ISO/IEC 42001:2023 — Artificial Intelligence Management System Standard.
  8. NIST (2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0). NIST AI 100-1.
  9. Wieringa, M., et al. (2022). Responsible AI under the Law. AI & Society, 37, 1171–1183. https://doi.org/10.1007/s00146-021-01297-2
  10. Robaldo, L., et al. (2020). Formalising GDPR Provisions in Reified I/O Logic. Artificial Intelligence and Law, 28, 359–407.
  11. Governatori, G., et al. (2021). Thirty Years of Artificial Intelligence and Law: The Second Decade. Artificial Intelligence and Law, 30, 7–47.
  12. ICO and Alan Turing Institute (2023). Explaining Decisions Made with AI (Part 1–3). Information Commissioner’s Office.
  13. Financial Conduct Authority (2024). DP24/1: Artificial Intelligence and Machine Learning (Discussion Paper). FCA.
  14. Prudential Regulation Authority (2023). SS1/23 Model Risk Management Principles for Banks. Bank of England.
  15. NIST (2024). Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (NIST AI 600-1). NIST.
  16. Jobin, A., Ienca, M., and Vayena, E. (2019). The Global Landscape of AI Ethics Guidelines. Nature Machine Intelligence, 1(9), 389–399. https://doi.org/10.1038/s42256-019-0088-2
  17. Mittelstadt, B.D. (2019). Principles Alone Cannot Guarantee Ethical AI. Nature Machine Intelligence, 1(11), 501–507.
  18. Wachter, S., Mittelstadt, B., and Floridi, L. (2017). Why a Right to Explanation of Automated Decision-Making Does Not Exist in the GDPR. International Data Privacy Law, 7(2), 76–99.
  19. Metcalf, J., Moss, E., and Boyd, D. (2019). Owning Ethics: Corporate Logics, Silicon Valley, and the Institutionalization of Ethics. Social Research, 86(2), 449–476.
  20. Doshi-Velez, F., and Kim, B. (2017). Towards a Rigorous Science of Interpretable Machine Learning. arXiv:1702.08608.
  21. Raji, I.D., et al. (2020). Closing the AI Accountability Gap: Defining an End-to-End Framework for Internal Algorithmic Auditing. ACM FAccT 2020.
  22. Kroll, J.A., et al. (2017). Accountable Algorithms. University of Pennsylvania Law Review, 165(3), 633–705.
  23. Bietti, E. (2020). From Ethics Washing to Ethics Bashing: A View on Tech Ethics from within Moral Philosophy. ACM FAccT 2020.
  24. Rahwan, I. (2018). Society-in-the-Loop: Programming the Algorithmic Social Contract. Ethics and Information Technology, 20(1), 5–14.
  25. Mökander, J., Morley, J., Taddeo, M., and Floridi, L. (2021). Ethics-Based Auditing of Automated Decision-Making Systems. AI and Society, 36, 1409–1437.
  26. Chowdhury, R., and Mulani, N. (2018). Trustworthy AI: A Practitioner’s Guide. Deloitte Insights.
  27. Morley, J., et al. (2021). From What to How: An Initial Review of Publicly Available AI Ethics Tools, Methods and Research to Translate Principles into Practices. Science and Engineering Ethics, 26, 2141–2168.
  28. AI21 Labs (2025). 9 Key AI Governance Frameworks in 2025. AI21 Knowledge Base. https://www.ai21.com/knowledge/ai-governance-frameworks/

Provenance