Toward a responsible and ethical authorization to operate: A case study in AI consulting

The US federal government mandates all technologies receive an Authorization to Operate (ATO). The ATO serves as a testament to the technology's security compliance. This process underscores a fundamental belief: technologies must conform to established security norms. Yet, the security-centric view does not include ethical and responsible AI. Unlike security parameters, ethical and responsible AI lacks a standardized framework for evaluation. This leaves a critical gap in AI governance. This paper presents our consulting experiences in addressing such a gap and introduces a pioneering ATO assessment instrument. The instrument integrates ethical and responsible AI principles into assessment decision-making. We delve into the instrument's design, shedding light on unique attributes and features. Furthermore, we discuss emergent best practices related to this ATO instrument. These include potential decision pitfalls of interest to practitioners and policymakers alike. Looking ahead, we envision an evolved version of this ethical and responsible ATO. This future iteration incorporates continuous monitoring capabilities and novel ethical measures. Finally, we offer insights for the AI community to evaluate their AI decision-making.