The seven questions
- Who benefits, and who bears the risk?
- What is the worst plausible failure and how would we detect it in production?
- Can affected users get an explanation and a review?
- What data are we using, and did we have the right to use it?
- What did we test for bias, and what did we find?
- Who is the accountable owner, by name?
- What happens if we shut it down tomorrow?
The rule
If you cannot answer these in writing, do not ship. This is not academic. This is what an OSFI examiner or the OPC will ask.