All in favour, say AI…self regulation!

By Amritha Edachery
for the 2025 Risky Women Writing Competition, presented in partnership with Ocorian

With Artificial Intelligence(AI) now being a constant fixture in our daily lives, questions around AI and potential human rights violation/infringement comes up in conversations every once in a while. However, the questions around AI contributing to the erosion of privacy, social issues and discrimination being exacerbated, freedom of expression, human dignity etc. echo a little louder when it comes to Governance, Risk and Compliance (GRC) where the focus is on ethical conduct and preservation of human rights. So the in the pursuit of profits and efficiency using AI tools, are we invariably becoming the monsters we are trying to defeat and save the world from?

Given that this is 2025, I thought the first place to pop that question was to my trustee Large Language Model (LLM) that will not be named with a prompt to “be honest and don’t fabricate”. On a separate note – this prompt has been my own version of AI guard rail because dealing with LLMs have been reminiscent of a gas-lighting partner who is so incredibly charming that I forget what my question was in the first place. But I digress – going back to my original point, question sent and its response was this:

👉 In short, privacy, equality, free expression, due process, fair work, dignity, and freedom from arbitrary control are all on the chopping block when AI tools are misapplied in governance and compliance.

The hardest truth? These violations often happen not out of malice but out of the very drive to optimize, secure, and control risk.

Thank you LLM for being honest and not fabricating!

Optimizing, securing or controlling risk, are all part of the company’s operations and profit is ultimately the driver. In this regard, due diligence plays an integral role in protecting organizations from financial, reputational and hidden risks. Usually, due diligence practitioners and investigators use a hybrid approach that combines public records, site visits, and subject matter experts to conduct Open Source Investigation (OSINT) and source enquiries (HUMINT) on the ground in order to gather insights on potential risks, evaluate partners and suppliers. In the recent past (and future), the due diligence process is increasingly becoming AI-led especially because of the potential it has to accelerate results and reduce costs. However, this raises serious human rights concerns.

The UN Guiding Principles on Business and Human Rights (UNGPs) are clear on the stance: “companies may support or promote human rights in many ways, but this cannot offset failures to respect rights in day-to-day operations” (OHCHR, 2011). If AI-led due diligence amplifies misinformation, malinformation or unfairly excludes partners, then organizations risk violating exactly those rights they are obliged to protect and it might potentially lead to a new road heading straight into good ol’ reputational risk city!

AI-Led Due Diligence in Practice

Typically, AI-led due diligence combines several tools (and counting!):

• AI-led OSINT scraping of news, filings, blogs, and social media.
• Risk scoring using machine-learning models.
• Network analysis that maps potential links to sanctioned or high-risk entities.
• Automated compliance reports for regulators.
• AI-generated summaries and risk reports.

While these tools contribute immensely to making due diligence efficient, faster and potentially cheaper, LLMs introduce new risks into the mix – they can produce well-written, sophisticated but misleading narratives, hallucinate connections and links, and reinforce misinformation already in the system. However, because their outputs appear authoritative, analysts may defer to them – a form of automation bias that compounds the risk of error.

Human Rights at Stake

With this approach, a number of human rights are “on the chopping block” but the two obvious ones that are applicable to most subjects would be:

1. Privacy and reputation (UDHR, Article 12 ). Public data, once scraped, amplified, and de-contextualized, can become a violation of privacy or an attack on honor.
2. Due process and remedy (UDHR, Articles 8 and 10 ). Individuals or organizations labeled “high risk” often have no idea why they were flagged and no way to contest the decision.
   For example, a subcontractor may be excluded from a supply chain after multiple “adverse media” reports link them to labor abuses. But this might stories planted by competitors or political opponents or included in a blod and recycled across social media, more blogs and fake news sites. The subcontractor is never told of the finding and loses business opportunities without recourse. Here, misinformation becomes malinformation, while AI (LLMs include) elevates it to compliance evidence.

The GRC Angle

GRC frameworks are designed to protect companies from regulatory fines, reputational harm, and operational disruption. In practice, however, this more often than not might means a zero-risk appetite: exclude at the first hint of controversy. From a profit and operational perspective, this is rational. But it comes at a human cost, which is further amplified by AI-led due diligence that is not used correctly. AI tools left to its own devices can lead to suspicion being turned into judgment, undermining fairness and justice – the very principles GRC is meant to uphold (World Benchmarking Alliance, 2022 ).

Toward AI Self-Regulation and Context

Although regulation of AI remains fragmented with policy-makers still grappling with AI developing at the speed of light but it is evolving and it is coming. Taking the UNGPs into consideration- businesses should not wait; embedding self-regulation in their AI-led due diligence processes and methodology might be best practice.
Some of the recommendations are:

• Human oversight: Validate AI outputs before they inform decisions.
• Right to respond: Give flagged subjects an opportunity to contest findings.
• Governance logs: Record why AI-led Due Diligence results were included or excluded.
• HUMINT integration: Pair AI-led tools with human intelligence (subject matter experts overseeing the results, interviews, site visits, on-the-ground enquiries) to test digital claims and restore context.

There is no denying that AI-led due diligence offers speed and scale. However there exists the very real risks of entrenching misinformation and eroding privacy, reputation, and due process, which is a violation of human rights. The solution lies in self-regulation: embedding transparency, oversight, and human review — and combining AI-led OSINT with HUMINT for balance.

In this sense, companies must act like responsible AI users themselves. Just as the prompt to “be honest and don’t fabricate” – a user-imposed guardrail – it might benefit businesses to impose their own ethical guardrails on the AI tools they deploy. Without them we risk becoming the monsters we are meant to defeat and save the world from.

References:
1) Inaccurate or misleading information shared without malicious intent. It could be due to mistake, misunderstanding, rumor, poor fact-checking, or misquotation (https://princetonlibrary.org/guides/misinformation-disinformation-malinformation-a-guide)
2) Information that is true or based on fact, but is used, reframed, or shared in a way that causes harm — for example by exaggerating, taking out of context, or using private information to harm reputation. It typically involves intent to harm, or at least disregard for how the information may damage someone (https://princetonlibrary.org/guides/misinformation-disinformation-malinformation-a-guide)
3) https://www.un.org/en/about-us/universal-declaration-of-human-rights
4) https://www.un.org/en/about-us/universal-declaration-of-human-rights
5) https://assets.worldbenchmarkingalliance.org/app/uploads/2023/12/2022-Corporate-Human-Rights-Benchmark-Insights-Report-edited-15.12.23.pdf
6) https://ennhri.org/ai-resource/key-human-rights-challenges/