The learner turns fairness, safety, transparency and accountability principles into a measurement card with a threshold, owner and response to breach

A professional principle names what we seek to protect; a control states an action that can be tested. Saying 'we value fairness' does not tell the test team which error to measure or who acts if a gap appears. Start with the decision, affected people and mechanism of harm. For an application triage aid, the harm may be missed urgent cases rather than merely a different order. Define the measure as urgent cases wrongly ranked low divided by all genuinely urgent cases in a specified period. Keep this separate from aggregate error, and explain how ground truth is reviewed so the denominator is not guessed. Fairness requires comparison groups that are appropriate and data that can be used lawfully and ethically. Do not collect sensitive attributes merely because a chart would be convenient; examine rights, purpose and minimization. If the data cannot reveal a potentially affected group, record that limit rather than claiming equal outcomes. Equal rates are not enough if both rates are unacceptably harmful. The first duty may be to reduce harm overall and then examine distribution. Nor should a three-case difference be treated like a stable gap across thousands of cases without uncertainty analysis and repeat measurement. Safety and reliability need different evidence. Pre-release testing probes ambiguous cases, context changes and missing data. Post-release monitoring detects changes in inputs or actual outcomes compared with the earlier test. For a service-answering generator, test unsupported claims against cases with checkable truth and consider harm if a user relies on them. Severe potential harm may require a human verification gate before an answer is sent, even when average performance is high. Define a stop or manual fallback plan: 'we will retrain the model' does not contain an ongoing incident. Transparency is neither a duty to publish every line of code nor a reason to expose details that enable misuse. Ask what an affected person needs to know: are they

interacting with AI, does it advise or decide, what inputs matter within lawful disclosure limits, and how can they request review or correct an error? Test the notice with the intended audience instead of relying on a long technical announcement. Internal reviewers need different documentation: model version, evaluation data and limits, and decision path. These two audiences should not be conflated. Accountability connects a measure to a decision. A useful metric card has a risk name, numerator and denominator, data source and period, alert level, monitoring owner, containment authority and response when the alert fires. For example, if urgent misses exceed 5% in an adequate weekly sample, operations promptly reviews every low-priority case and suspends the ranking's effect until the product owner decides from a documented investigation. Five percent here is a fictional teaching threshold, not a universal rule; real thresholds require severity, review capacity and accepted performance evidence. Avoid choosing one threshold while hiding a trade-off. A model change may reduce missed urgent cases yet increase false escalations, overloading officers until service time worsens again. Show both measures and select a trade-off appropriate to service purpose and resources while preserving appeal. Record what can be tested now and what requires later monitoring. If social impact cannot be captured by one percentage, add a defined qualitative case review rather than a list of principles without evidence. In a practice question asking for the best control, connect a named principle to the harm in the facts, evidence and a decision. A plausible wrong answer measures something real but irrelevant: usage volume cannot demonstrate fairness, and publishing a general policy cannot test whether officers can override the tool. Check the denominator and time window before accepting a percentage, then ask who stops the effect when the threshold is crossed. Do not turn voluntary NIST AI RMF guidance or OECD principles into legal duties in every jurisdiction; scope each claim to its source.