When I raise AI ethics with a room of data practitioners, I can watch a specific expression cross their faces — the one that says this is the philosophy part, the bit before we get back to the real work. And I understand it, because "AI ethics" has been claimed by two groups who make it easy to tune out: the abstract philosophers debating far-future scenarios, and the compliance departments turning it into a checklist you sign and file. Both make it feel like something that happens around the work rather than in it.

I want to reclaim it as an engineering concern, because when you point Copilot at your organisation's data, ethics stops being abstract and becomes a set of very concrete decisions with names and consequences. Responsible AI isn't a box you tick after the fact. It's a property of how you build, and it's decided in the same ordinary choices you're already making.

The ethics you're already doing (badly, if you're not looking)

Here's the reframe. You don't add ethics to an AI deployment. You already have ethics — embedded in choices you're making anyway — and the only question is whether you're making them deliberately or by accident. Four of them, concretely:

  • Over-trust is an ethical choice. I've argued all year that Copilot fails quietly, with a plausible wrong answer rather than an error. The decision about how much to let those answers reach real decisions unchecked — whether you put a human gate in front of consequential outputs or let the confident narrative flow straight to a decision-maker — is your AI ethics in practice. It's not a seminar topic; it's a design decision about where verification lives. Get it wrong and you're not being unethical in the abstract; you're shipping wrong answers to people who'll act on them.
  • What you feed the AI is a privacy decision. Turning Copilot loose across your Fabric estate means it can work over whatever data lives there — including data you may never have classified with an AI assistant in mind. Deciding what the AI can and can't touch is a real, concrete privacy-and-consent choice, and "we never thought about it" is itself an answer, just a bad one.
  • Bias rides in on the data. An AI drawing conclusions from your historical data will faithfully reproduce whatever bias that history contains — in who got approved, who got flagged, who got served. That's not a flaw you can prompt away; it's a property of the data, and noticing it is your job, not the model's.
  • Transparency is a choice you make for other people. When an AI-generated summary reaches someone, telling them it's AI-generated — so they apply the right scepticism — is a small act with real ethical weight. Omitting it isn't neutral; it's letting people trust something more than they would if they knew what it was.

None of these is philosophy. Each is a decision sitting inside your normal build process, being made either on purpose or by default. Responsible AI is just making them on purpose.

The EU AI Act is a floor, not the point

I should address the regulation, because it's the reason "AI ethics" is on a lot of agendas at all in 2025. The EU AI Act is now in force and phasing in its obligations, and for anyone operating in or into Europe it turns some of this from good practice into legal requirement — risk classification, transparency duties, human oversight for higher-risk uses.

Take it seriously. But don't mistake it for the finish line. Regulation is a floor — the minimum a society will tolerate — and floors are set for the worst actors, not the good ones. If your AI ethics consists entirely of "we did what the Act requires," you've optimised for not being punished, which is a much lower bar than being trustworthy. The Act tells you what you must not do. It has very little to say about whether the thing you built actually serves the people it touches. That second question is the one that matters, and it's yours to answer regardless of what any regulation compels.

Compliance answers "will we get in trouble?" Ethics answers "should we do this, and are we doing it in a way we'd defend to the person on the other end?" The Act covers the first. Only you cover the second.

So — should you worry about it?

Not worry, exactly. Worry is paralysing and it's not what I'm arguing for. But you should own it, and own it as an engineering responsibility rather than delegating it to a compliance form or a future philosophy discussion. Because the alternative isn't "no ethics" — there's no such thing. The alternative is ethics made by accident: over-trust because nobody decided where the human gate goes, privacy exposure because nobody decided what the AI could see, bias reproduced because nobody looked, opacity because nobody thought to say "this was AI-generated."

The practitioners who handle this well aren't the ones with the longest policy or the most philosophical vocabulary. They're the ones who treat each of those four decisions as part of building the thing — made deliberately, documented plainly, defensible to the person on the receiving end. That's responsible AI. Not a checkbox, not a seminar, not a future problem. Just the ordinary decisions of your build, made on purpose, by someone willing to own how they land. You're already making them. The only question is whether you're looking while you do.