Code of Ethics for AI Assurance

1. Purpose and scope

This code sets the ethical standards proposed for Glare•9’s AI governance, product development, advisory and assurance work. It applies to directors, employees and contractors working on our behalf. Engagement terms should make relevant responsibilities clear to delivery partners.

Our aim is to help organisations make responsible decisions about AI and digital systems, recognising the people affected by those decisions. Commercial interests must not distort findings, conceal material risks or turn incomplete evidence into an unsupported claim.

The code complements applicable law, professional obligations and agreed assessment criteria. It does not confer accreditation, provide legal advice or guarantee compliance or freedom from harm. Each assessment must state its scope, criteria and limitations.

2. Our ethical commitments

• People and public interest: consider foreseeable impacts on people, communities and the environment, including accessibility, exclusion and the needs of vulnerable groups. Seek relevant stakeholder perspectives in proportion to the risk.
• Human rights and fairness: examine discriminatory outcomes, privacy risks and barriers to meaningful human oversight. Legal compliance alone does not settle every ethical question.
• Integrity and objectivity: report findings honestly, disclose relevant interests and resist pressure to change conclusions without evidence. Do not accept bribes, misleading instructions or fees conditional on a favourable conclusion.
• Transparency: distinguish observed facts, assumptions and professional judgement. Explain methods, uncertainty, exclusions and the role of automated tools in terms the intended audience can understand.
• Safety and competence: work within demonstrated expertise, use proportionate methods and seek specialist support where needed. Escalate serious risks rather than allowing delivery pressure to override them.
• Confidentiality: use information only for authorised purposes, minimise collection and restrict access. Do not put confidential client material into AI tools without appropriate authorisation and safeguards.
• Accountability and remedy: assign responsible people, preserve the reasoning behind significant decisions, welcome challenge and correct material errors.

3. Directors and accountability

Directors are responsible for approving this code, assigning its owner and ensuring sufficient resources, competence and oversight to implement it. Delegating delivery does not remove their responsibility for oversight.

UK directors’ general duties include acting within powers, promoting the company’s success, exercising independent judgement and reasonable care, skill and diligence, avoiding conflicts, not accepting prohibited third-party benefits and declaring relevant interests in proposed transactions. This is a summary, not an exhaustive statement of duties; the applicable law governs. See the government guidance on directors’ general duties.

• Directors: approve material ethical exceptions within lawful boundaries, review significant incidents and ensure corrective actions are completed. Record conflicts and recuse themselves from affected decisions.
• Code owner: a director designated on adoption maintains the code, decision register, training arrangements and review schedule. The owner coordinates concerns but must not investigate their own conduct.
• Engagement lead: documents scope, stakeholder risks, competence, conflicts, evidence and escalation decisions for each engagement.
• Reviewer: challenges significant findings and conclusions with sufficient competence and separation from the work being reviewed. Unresolved disagreements must be recorded and escalated.

Where no suitable unconflicted internal reviewer is available, directors must arrange external review or decline the affected assurance work. A person named in a complaint must not control its investigation or appeal.

4. Independence and conflicts of interest

Before accepting work, disclose relevant financial interests, relationships, gifts, referral arrangements and prior involvement in the system or controls being assessed. Reassess these interests when the scope, personnel or commercial relationship changes.

Glare•9 develops products and provides advice as well as assurance. Assessing our own product, implementation or recommendations creates a risk of reviewing our own work. Separate personnel alone may not resolve a company-level financial or commercial conflict.

• Identify and record the conflict, its significance, proposed safeguards and the approval decision before work begins.
• Do not describe a review of Glare•9’s own work as independent assurance. Clearly identify it as an internal or advisory assessment.
• For an independent conclusion on our own work, arrange a suitably independent external provider and disclose our involvement.
• Decline or withdraw from an engagement when a material threat to impartiality cannot be resolved. Client consent alone does not establish independence.
• Keep fees independent of outcomes. Refuse gifts or benefits that could reasonably compromise judgement and record attempted undue influence.

5. Working with other ethical frameworks

This code is designed to work alongside clients’ codes, sector requirements and assessment frameworks. Methods and documentation can be adapted to the organisation’s context and risk. Honesty, human rights, evidence integrity and freedom from improper influence remain core requirements.

At the start of an engagement, create a requirements map recording the relevant client commitments, applicable law, assessment criteria, corresponding controls and evidence. Agree how differences will be resolved. Apply compatible stronger protections; where obligations genuinely conflict, pause the affected activity, record the issue and obtain appropriate specialist advice. Decline work that requires unlawful or unethical conduct.

OECD principles in practice

The proposed controls draw on the OECD’s five values-based AI principles. This mapping describes our intended implementation, rather than OECD approval or certification. Read the OECD AI Principles.

• Inclusive growth, sustainable development and well-being: record expected benefits, affected groups, accessibility barriers and proportionate consideration of environmental impacts.
• Human rights and democratic values, including fairness and privacy: assess rights and discrimination risks, data safeguards and opportunities for human intervention and challenge.
• Transparency and explainability: document assessment methods, system boundaries, explanations and material limitations.
• Robustness, security and safety: examine foreseeable failure and misuse, test relevant controls and define escalation or withdrawal conditions.
• Accountability: assign owners, retain decision evidence, review risks over the lifecycle and track corrective actions.

6. Operational ethics framework

The following proposed workflow translates the code into engagement controls. The depth of review should reflect the potential harm, scale, affected groups and uncertainty. Higher risk requires stronger evidence and review; it must not mean weaker standards.

Before accepting work

• Lead: record purpose, system and version, intended users, affected people, jurisdictions, assessment criteria and exclusions.
• Lead and code owner: complete a competence and conflict check; define whether the work is advisory, internal review or independent assurance.
• Lead: agree permissions, confidentiality, authorised tool use, evidence access, retention and deletion arrangements, and a named client decision owner.
• Acceptance gate: do not start an assessment with unresolved material conflicts, inadequate expertise or no lawful access to necessary evidence. Record the acceptance or refusal decision.

Assess risks and plan the review

• Lead: create an impact and risk register covering rights, fairness, privacy, safety, security, accessibility, human oversight and foreseeable misuse.
• Record severity, likelihood, uncertainty, affected groups, existing controls, evidence gaps and the person responsible for each action. Seek affected stakeholder input where appropriate and document participation gaps.
• Map the client’s ethical requirements to the agreed assessment criteria. Set review frequency and triggers such as material system changes, incidents or new evidence.

Collect and evaluate evidence

• Assessors: record evidence source, date, system version, method, relevant criterion and limitations. Preserve traceability without retaining unnecessary personal data.
• Distinguish a documented policy from evidence that its controls operate in practice. Record missing, contradictory or unverifiable evidence explicitly.
• For AI-assisted analysis, record the tool and version where available, the task and relevant settings. Verify material outputs against source evidence; a named person remains responsible for conclusions.
• Stop condition: pause the affected work where there is credible serious harm, suspected evidence manipulation, a material confidentiality breach or unresolved improper pressure. Escalate promptly to the code owner and an unconflicted director.

Review and issue findings

• Reviewer: challenge material findings, evidence sufficiency, independence claims and the treatment of uncertainty before the report is issued.
• Lead: allow factual corrections supported by evidence. Client preference or commercial pressure must not suppress a material finding.
• Release gate: record reviewer sign-off and unresolved limitations. Where evidence is insufficient, qualify the conclusion or state that no conclusion can be reached on the affected criteria.
• Reports must identify scope, criteria, date, system version, methods, findings, limitations and permitted use. Do not imply wider certification, approval or assurance than the work supports.

Follow through and learn

• Client action owner: agree corrective actions, priorities and target dates. Record who accepts any residual risk; Glare•9’s report does not transfer the client’s operational responsibility.
• Lead: track agreed follow-up and verify closure within the engagement scope. Do not describe an action as resolved solely because a plan exists.
• Code owner: retain relevant records under agreed retention rules, restrict access and capture lessons. Material new evidence must trigger consideration of reassessment or report correction.

7. Resolving ethical dilemmas

Pause the affected decision, identify the people and interests involved, check the relevant duties and evidence, and consider practicable alternatives. Consult an unconflicted reviewer or specialist when the answer is uncertain. Record the decision, reasons, approver, safeguards and review trigger before proceeding.

• A client asks to remove an adverse finding: check factual accuracy, retain supported findings and record pressure. Escalate if a truthful report cannot be issued.
• A requested assessment covers our own product: disclose our involvement, label our review accurately and seek an external provider for an independent conclusion.
• An AI tool produces a confident judgement without sources: treat the output as unverified, investigate the underlying evidence and withhold the unsupported conclusion.
• A client policy overlooks harm to a vulnerable group: document the gap, examine the impact with suitable expertise and agree stronger protections or decline the affected work.

8. Concerns, complaints and remedy

To comment on this draft or raise an ethics concern, email hello@glare9.com with “Ethics concern” in the subject. Include the relevant engagement or decision and enough information to explain the issue. Request a secure channel before sending sensitive evidence. Our Privacy Notice explains how contact information is handled.

Under the proposed procedure, the code owner records and triages each concern, identifies an unconflicted investigator and communicates the review process and expected timing. Urgent safety, security or rights concerns require immediate consideration of protective action. Information is shared only as needed for a fair investigation or lawful disclosure; absolute confidentiality cannot be promised.

The person affected must have a fair opportunity to respond. Findings, reasons and actions are recorded, and the complainant receives an appropriate outcome explanation. A request to reconsider must go to a reviewer uninvolved in the original decision; external review is required where suitable internal separation is unavailable.

Proposed remedies include correcting or withdrawing reports, notifying affected recipients, repeating an assessment, training, changing controls and restricting or ending an engagement. Personnel matters follow applicable contracts and fair procedures. Good-faith reporting must not lead to retaliation. This route does not restrict access to regulators, statutory reporting channels or other lawful remedies.

9. Adoption and review

Before adoption, directors must approve the final text, designate a code owner, establish unconflicted review and complaint arrangements, agree retention rules and confirm the resources needed to operate the controls. Relevant personnel must receive induction and acknowledge their responsibilities.

After adoption, review the code at least annually and following material incidents, changes in services or relevant requirements. Directors should review significant conflicts, complaints, report corrections and overdue actions. Publish the approved version, adoption date, owner role and next review date, with a summary of material changes. Version 0.1 remains a draft until that approval is recorded.

10. References

This is an original Glare•9 draft. The references below support review and comparison; listing them does not imply endorsement, membership, accreditation or certification.

• OECD AI Principles — principles for trustworthy AI.
• OECD Due Diligence Guidance for Responsible AI — practical implementation reference.
• UK government guidance on directors’ general duties — company oversight responsibilities.
• Companies Act 2006, Part 10, Chapter 2 — statutory general duties.
• ForHumanity Code of Ethics — comparative reference for professional assurance ethics.