15. Privacy, Security, Bias, Copyright, and Research Integrity

Responsible AI use requires attention to what is entered into a system, how outputs are used, who is affected, and who remains accountable. NIST’s AI Risk Management Framework describes trustworthy AI characteristics including validity and reliability, safety, security, accountability, transparency, explainability, privacy enhancement, and management of harmful bias (NIST, 2023, 2024).

15.1 Data minimisation

Only provide the minimum information necessary. Remove names, contact details, student IDs, participant identifiers, confidential financial information, health data, unpublished intellectual property, passwords, and credentials unless a formally approved workflow permits their use. De-identification may be reversible when combined with other information, so it is not automatically sufficient.

15.2 Bias and fairness

AI systems may reflect patterns and exclusions in their training data or design. Examine whether the output stereotypes groups, ignores local context, treats one cultural norm as universal, or applies inconsistent standards. For consequential decisions, use representative validation data, document performance across relevant groups, and provide a route for challenge or appeal.

15.3 Copyright and ownership

Terms for AI-generated content vary by provider and jurisdiction. A user should not assume that generated output is copyrightable, exclusive, free of third-party rights, or automatically suitable for commercial use. Respect source licences, permissions, confidentiality agreements, and institutional intellectual-property policies. When using a tool to transform copyrighted material, check the applicable terms and law.

15.4 Academic integrity

Do not use AI to fabricate data, invent participant quotations, falsify references, misrepresent authorship, or conceal prohibited assistance. Preserve research records and disclose tool use when required. If AI contributes to analysis, explain its role and how outputs were checked. The researcher remains accountable for the design, evidence, interpretation, and conclusions.

15.5 Security and prompt injection

Documents, webpages, emails, and code may contain instructions designed to manipulate an AI system. Treat retrieved content as data to inspect, not as authority to change permissions or reveal secrets. Do not let an agent follow embedded instructions to export files, reveal credentials, or take unrelated actions. Use restricted permissions, audit logs, and human approval.

15.6 Deepfakes and deception

Synthetic images, audio, and video can mislead audiences or harm real people. Obtain consent when using a person’s likeness or voice, disclose synthetic media where appropriate, and never manufacture evidence or impersonate another person to deceive. Consider the potential harm if content is taken out of context.