Case 5: Responsible AI, Audited — Innovare AI Analysis

As you read — hold this question

When a firm publishes its AI ethics principles, is it building guardrails — or building a defence against being regulated?

$1.4B

EY invested US$1.4 billion in its EY.ai platform. It also paid a US$100M SEC penalty in 2022 — the largest ever against an audit firm — for auditors cheating on ethics exams.

The module's set case is EY's “responsible AI transformation,” taught with IBM's governance framing. This case teaches the examinable governance content — and audits the case the way the course teaches you to audit everything.

The set case & governance

The textbook versionQuiz: EY case + 4 risks + NIST/EU

EY, IBM's four risks, NIST and the EU AI Act

EY case: EY.ai (US$1.4B), the EYQ assistant, AI-powered audits and talent management, governed by AI Principles and an Ethics Review Board. The five reflection questions: client privacy/security; preventing algorithmic bias; transparency to build trust; the role of top managers; balancing efficiency with ethics.

AI governance (IBM video) = guardrails for responsible AI. Four risks: bias (latent in human data), privacy/copyright (data seeps into outputs), lack of transparency (black-box vs glass-box), model deterioration (needs continuous monitoring). Regimes: NIST AI RMF (Govern/Map/Measure/Manage) and the EU AI Act (penalties for non-compliance).

Carry this

Four AI-governance risks: bias, privacy/copyright, transparency, model drift. Two regimes: NIST (guidance), EU AI Act (law with teeth).

Audit the case

The rest of the story

What the glossy version leaves out

The course's EY narrative cites a single EY URL and lists four principles; EY actually publishes nine Responsible AI principles. “EY Helix” is EY's audit-analytics platform and pre-dates the AI branding. And the reputational context the case omits: the US$100M SEC fine (2022) for ethics-exam cheating, with PCAOB audit-deficiency rates around 37% (2023) improving to 28% (2024).

The incentive

A Big Four firm selling “AI transformation” advisory has a commercial interest in a triumphant responsible-AI story. Read the case as marketing with a real governance core — not as neutral evidence.

Ethics-washing vs enforcement

The other side

Guardrails you write yourself vs rules that fine you

Voluntary “AI principles” and internal ethics boards can become ethics-washing — the appearance of governance without external accountability. The counterweight is enforceable regimes. Note the live update the deck can't have: under the EU's 2026 Digital Omnibus, the AI Act's high-risk obligations were postponed to December 2027 — so any claim they bite in August 2026 is now out of date.

The other side

Self-written principles are a start, not a safeguard. The question for any “responsible AI” claim is: who audits it, and what happens if it's breached?

Quick recall — without looking back

Test yourself on this case

Question 1 of 3

Name IBM's four AI-governance risks and the two governance regimes.

Risks: bias, privacy/copyright, lack of transparency, model deterioration. Regimes: NIST AI RMF (Govern/Map/Measure/Manage) and the EU AI Act (penalties).

Question 2 of 3

What does auditing the EY case reveal?

It cites one URL and lists four principles (EY publishes nine); “Helix” is a pre-existing audit-analytics tool; and it omits EY's $100M SEC fine (2022) for ethics-exam cheating. It's marketing with a governance core.

Question 3 of 3

What 2026 change affects the EU AI Act timeline?

The Digital Omnibus postponed the high-risk (Annex III) obligations from Aug 2026 to December 2027 — any teaching that they apply in Aug 2026 is stale.

Module 10

← Case 4: The Leader's Six Capabilities

Case 6: The Consensus Machine →

Module 10 Videos

Module 10 · Long Form

Sources

Module content: BUSN9049 Module 10 — EY case; IBM “Importance of AI Governance” video; NIST/EU AI Act (deck + Go Further). Flinders University, 2026.
EY reality: EY.ai launch (US$1.4B, 2023); EY Responsible AI Principles (nine); SEC US$100M penalty (2022); PCAOB inspection spotlights (2023–24).
Regimes: NIST AI RMF 1.0 (2023); EU AI Act & 2026 Digital Omnibus (high-risk deferral to Dec 2027).