SfSkills Domains Docs GitHub

Home / admin / ai-ethics-and-governance-requirements

ai-ethics-and-governance-requirements

Use this skill when defining AI governance policies, designing human oversight workflows, documenting bias mitigation strategies, or meeting regulatory transparency requirements for Salesforce AI features. Trigger keywords: responsible AI, AI bias, AI audit trail, AI transparency, human-in-the-loop, AI risk inventory, AI disclosure. NOT for the MLOps pipeline or Policy-as-Code engine architecture — use architect/ai-governance-architecture. NOT for Trust Layer technical configuration — use agentforce/einstein-trust-layer.

Open the skill folder on GitHub

AI Ethics and Governance Requirements

Use this skill when a Salesforce implementation needs governance structure around AI features — not just configuration, but the policies, human oversight rules, risk inventory, bias controls, and transparency disclosures that sit above Trust Layer settings. Activates when stakeholders ask how to make AI use responsible, auditable, and explainable rather than how to configure a specific platform feature.

Before Starting

Gather this context before working on anything in this domain:

Core Concepts

1. Salesforce Responsible AI Pillars

Salesforce's responsible AI framework rests on five published pillars:

  1. Accuracy — AI outputs must be grounded, traceable, and evaluated against ground truth.
  2. Safety — Harmful, toxic, or dangerous content must be prevented before it reaches users. The Einstein Trust Layer's toxicity scoring and prompt defense mechanisms are safety controls, but the policy decision on what constitutes "harmful" is a governance requirement.
  3. Honesty — AI-generated content must be disclosed as such. Salesforce requires that features surfacing generated text display a disclosure marker. Orgs must define where and how those markers appear.
  4. Empowerment — Users and customers must be able to override, reject, or escalate AI decisions. Human-in-the-loop gates are a governance design concern, not a platform default.
  5. Sustainability — AI resource consumption and environmental impact must be tracked as part of responsible use.

2. AI Risk Inventory

Before deploying any AI feature, governance requires a risk inventory: a structured list of each AI use case with its likelihood of harm, impact severity, affected user population, and assigned mitigation owner. Salesforce recommends classifying use cases on a 3x3 likelihood-impact grid. High-impact, customer-facing uses — such as denying a loan or surfacing a medical recommendation — require the most stringent human oversight.

The risk inventory is a living document. It must be reviewed each time a model is retrained, a new feature is enabled, or a regulation changes.

3. Bias Detection and Mitigation

Einstein models trained on historical Salesforce data can encode historical inequity. Salesforce Help documents a formal bias detection workflow for Einstein Prediction Builder and Einstein Discovery:

Governance policy must document which attributes are protected in the org's jurisdiction, who reviews the bias report, and what threshold triggers a model withdrawal.

4. Audit Trail Requirements

Salesforce audit capabilities relevant to AI governance:

Common Patterns

Pattern 1: Governance Policy Document Driven by Pillar Mapping

When to use: The org is deploying its first Agentforce agent or Einstein feature and legal/compliance needs a written policy before go-live approval.

How it works:

  1. Map every deployed AI feature to the five Salesforce responsible AI pillars.
  2. For each pillar, define the control (e.g., Accuracy → grounding source, review cadence; Honesty → disclosure copy and placement; Empowerment → override mechanism and escalation SLA).
  3. Assign a named owner and review date for each control.
  4. Publish the resulting policy document to stakeholders and gate go-live on sign-off.

Why not skip the policy: Orgs that configure Trust Layer without a written policy have no accountability chain when an AI decision is disputed. Regulators and auditors ask for documented controls, not screenshots of platform settings.

Pattern 2: Human Oversight Gate for High-Risk Decisions

When to use: AI is recommending or taking actions with significant downstream impact — price changes, case escalation, credit decisions, medical triage.

How it works:

  1. Classify the use case on the likelihood-impact grid. Flag anything with high impact.
  2. Design a Salesforce approval process or Flow-based review gate that intercepts the AI recommendation before it is applied.
  3. Log the reviewer identity, timestamp, the AI recommendation shown, and the final human decision — whether it accepted or overrode the AI.
  4. Set an SLA for review turnaround that does not create an approval bottleneck in the core business process.
  5. Report on override rates; a very high override rate signals the model needs retraining.

Decision Guidance

SituationRecommended ApproachReason
AI is customer-facing and output is visible to end usersRequire explicit AI-generated content disclosure marker per Salesforce Honesty pillarRegulatory requirement in EU AI Act and multiple US state laws; Salesforce requires it by design
AI use case is internal low-impact (e.g., suggested email subject line to rep)Lightweight governance: disclosure in UI, basic audit log, quarterly reviewProportionality — full risk inventory overhead not warranted
AI use case is high-impact (credit, medical, legal, enforcement)Full risk inventory, human oversight gate, independent bias audit, external legal reviewRegulatory exposure and reputational risk justify additional controls
Model is retrained with new dataTrigger bias re-evaluation before new model is promoted to productionBias baselines shift with data distribution changes
Third-party LLM is integrated via Trust LayerGovernance must document zero-data-retention policy and verify Trust Layer is enforcing itGDPR and CCPA data processor obligations; Trust Layer enforces zero retention with approved third-party models
Org is subject to EU AI ActClassify use case risk tier; high-risk uses require conformity assessment, human oversight, and technical documentationEU AI Act is binding law for orgs with EU users regardless of where org is headquartered

Step-by-step instructions for an AI agent or practitioner working on this task:

  1. Inventory all active AI features — pull a list of every Einstein feature, Agentforce agent, and third-party LLM integration enabled in the org. Include sandbox and UAT environments, not just production.
  2. Classify each use case by risk tier — apply the 3x3 likelihood-impact grid. Label each use case: low, medium, or high risk. Flag all customer-facing and high-impact uses for deeper review.
  3. Map controls to the five responsible AI pillars — for each use case, define the Accuracy, Safety, Honesty, Empowerment, and Sustainability control. Identify gaps where no control exists yet.
  4. Design human oversight gates — for medium- and high-risk use cases, specify the review mechanism (approval process, escalation flow), the reviewer role, and the logging requirement.
  5. Run and document the bias evaluation — for Einstein Prediction Builder and Einstein Discovery models, run the built-in bias detection report. Document protected attributes, findings, and any fields removed or adjusted as a result.
  6. Draft transparency disclosures — write the AI-generated content disclosure copy for each customer-facing surface. Confirm legal has approved the language.
  7. Validate audit trail coverage — confirm each AI feature produces a timestamped, attributable audit log. Identify gaps (e.g., Field History Tracking not capturing model version) and fill with custom logging or Data Cloud retention rules.

Review Checklist

Run through these before marking work in this area complete:

Salesforce-Specific Gotchas

Non-obvious platform behaviors that cause real production problems:

  1. Einstein Trust Layer is not equivalent to AI governance — The Trust Layer handles data protection during LLM inference (prompt masking, zero-retention, toxicity scoring). It does not produce a risk inventory, does not enforce human oversight gates, and does not generate bias reports. Orgs that equate Trust Layer enablement with AI governance completion will fail an audit.
  2. Field History Tracking does not capture model version or input features — When an Einstein model writes a score to a field, Field History Tracking logs the before/after value and the user identity of the record owner — not the AI model version, confidence interval, or contributing features. A custom platform event or Data Cloud log must be added to capture those for audit purposes.
  3. Bias report baseline shifts on every retraining — Einstein Prediction Builder's bias report produces a snapshot, not a continuous monitor. When a model is retrained, the protected-attribute scores reset. Governance policy must require a new bias report run before the retrained model is promoted, not just at initial deployment.

Output Artifacts

ArtifactDescription
AI Governance Policy DocumentWritten policy mapping each AI use case to controls across the five responsible AI pillars, with named owners and review cadence
Risk InventorySpreadsheet or Confluence page classifying each use case by likelihood, impact, mitigation, and owner
Human Oversight DesignSpecification of approval gates, escalation paths, reviewer roles, SLAs, and override logging for each high-risk use case
Bias Mitigation ChecklistProtected attributes list, proxy fields identified, bias report findings, and sign-off record
Transparency Disclosure CopyLegal-approved disclosure language for each customer-facing AI surface
Audit Trail SpecificationWhat is logged, log retention period, access control, and incident response runbook

Package files