When Italy’s data-protection authority temporarily blocked access to ChatGPT in 2023, it raised questions about age checks, inaccurate information about people, transparency, and the legal basis for using personal data. Accountability asks who must answer for such choices—and whether they can demonstrate that they meet their obligations. section 3.15
In data protection, accountability means an organization must take responsibility for compliance and be able to demonstrate it. It is one of the core principles of the European Union’s data-protection regulation, the GDPR. Meeting legal requirements is a baseline, however, not a complete response to the risks of AI. section 3.15 section 3.18
For an organization building or deploying AI, accountability reaches beyond a statement of intent:
- Make data use transparent and establish a lawful basis for processing personal data. section 3.15
- Set standards for training data, model management, and oversight as data moves toward decisions. section 3.18
- Address risks such as bias and data quality, even where existing compliance rules do not settle them. section 3.18
Who answers for AI-assisted advice?
A financial advisor can face legal consequences for misrepresenting an investment. A chatbot may also give mistaken advice, but its provider is generally not held accountable for that particular mistake; the person relying on the answer may bear the consequences. Professional responsibility therefore does not disappear when someone uses AI. section 5.8
Human oversight matters, but it is not enough on its own. Accountability also depends on institutions governing how systems are built and used, and on external pressure for transparency and auditability. The practical question is not just whether an AI system appears useful, but whether people and organizations can answer for its effects. section 10.25 section 3.18 section 11.6
