Microsoft Responsible AI Standard, v2

• Authority: Private-sector companies
• Collections: Corporate policies and commitments
• Most recent activity: Enacted
• Most recent activity date: 2024-06-01

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unfair discrimination and misrepresentation
• Unequal performance across groups
• Overreliance and unsafe use
• Loss of human agency and autonomy
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• AI system security vulnerabilities
• False or misleading information
• Fraud, scams, and targeted manipulation

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 10-12 subdomains, with strong focus on AI system safety and reliability (7.3, 7.4), human-computer interaction (5.1, 5.2), fairness and discrimination (1.1, 1.3), privacy and security (2.1, 2.2), transparency and misinformation risks (3.1), and governance structures (6.5). Coverage is concentrated in technical safety, fairness, transparency, and operational governance domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Information
• Scientific Research & Development Services

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Finance & Insurance
• Real Estate, Rental & Leasing
• Educational Services
• Health Care & Social Assistance

All other sectors had no coverage in this document.

Sectors Summary

This is an internal corporate policy that governs Microsoft's AI development activities. As an AI technology company, Microsoft primarily operates in the Information sector (software, cloud services, AI platforms) and Scientific Research and Development Services. The document does not regulate external sectors but rather establishes standards for Microsoft's own AI systems across all its business operations.

Legislative Status

Other

Legislative Status Summary

This is an internal corporate policy document establishing Microsoft's own responsible AI standards for its product development teams. It uses mandatory language ('must', 'required') but enforcement is internal to Microsoft rather than through external legal mechanisms.

Actors

Proposer

• Entity Types: AI_Developer
• Entities: Microsoft; Office of Responsible AI
• Summary: Microsoft developed this internal standard through a multi-year effort involving research, policy, and engineering teams. The document is authored by Microsoft for its own AI development operations.

Target

• Entity Types: AI_Developer
• Entities: Microsoft AI system development teams; Microsoft product development teams
• Summary: The standard applies to Microsoft's own AI systems and product development teams. All requirements are directed at internal Microsoft teams developing AI systems.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Office of Responsible AI; reviewers identified in Impact Assessment
• Summary: The Office of Responsible AI is the primary enforcement body, with authority to review Sensitive Uses, receive escalations, and make decisions on how to proceed when criteria cannot be met.

Monitor

• Entity Types: AI_Governance_Actor, AI_Developer
• Entities: Office of Responsible AI; system owners; developers; customer support
• Summary: Monitoring is conducted through multiple channels including the Office of Responsible AI for oversight, and system owners/developers for ongoing system health monitoring and evaluation.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers all stages of the AI lifecycle, with particularly strong emphasis on planning/design (Impact Assessments, requirements definition), verification/validation (extensive evaluation requirements), deployment (release criteria, documentation), and operation/monitoring (ongoing evaluation, feedback mechanisms). Data collection and model building are addressed through data governance and model definition requirements.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems

Technical Scope Summary

The document uses the term 'AI systems' throughout and defines requirements that apply to 'All AI systems.' It references models as components of AI systems but does not explicitly distinguish between frontier AI, general purpose AI, task-specific AI, foundation models, or generative vs predictive AI. No compute thresholds or open-weight model distinctions are mentioned.