Ethical AI with Kerryn Arnott

Kerryn Arnott, Head of Legal, Digital Innovation at Standard Bank CIB, joined Colin Iles for this Standard Bank One Hub Series conversation on what ethical AI actually means once you move past the slogan. Using a live trolley problem poll, a lending example from underserved African markets, and a comparison of the EU and UK's opposite regulatory bets, Kerryn lays out why there is no single correct answer to "is this AI ethical" and what Standard Bank does about that in practice.

Why ethics has no right answer: the trolley problem Kerryn ran live on the call

Kerryn opened by distinguishing ethics from law: ethics is about what is morally good or bad, and unlike law it rarely has a single correct answer. To make the point concrete, she ran a live poll using the classic trolley problem: a train is heading toward five people tied to the track, and pulling a lever diverts it to kill one person instead. Votes split, which she said is typical. Those who chose to pull the lever fall into consequentialist ethics, judging actions by their outcomes and favoring the best result for the most people. Those who refused fall into a values-based camp that will not accept direct personal involvement in causing harm, regardless of outcome. She then varied the scenario: instead of pulling a lever, the choice becomes physically pushing a man off a bridge to stop the train. Many who were willing to pull the lever were not willing to push the man, even though the outcome is identical, and the vote typically splits roughly fifty-fifty again. The exercise, she said, explains why "ethical AI" is hard to pin down: an AI system's ethics depend on whose ethical framework is doing the judging.

Lending algorithms in rural Africa: the example Kerryn uses to show AI ethics is not abstract

Kerryn argued that even a simple-looking algorithm can carry serious real-world stakes, and used lending as her example. A biased lending algorithm making decisions in a rural environment can determine whether someone gets access to money for something as basic as school fees, and a wrong or biased outcome can mean a family cannot afford the fare to get a child to hospital when they need it. Colin connected this to South Africa's pre-AI credit history, noting that old scorecards penalized people for lacking a proof of address or a credit bureau record such as XDS, regardless of whether they were actually a credit risk, showing that this kind of bias predates AI. Kerryn's point was that AI can either entrench that same bias at scale or help correct it, depending on how the data and the model are built.

Standard Bank's method: incubate the framework against a live use case before scaling it

Kerryn described Standard Bank's practical starting point as mapping the organization's full AI and data landscape, not just what IT or the data science team is doing, since neither has visibility into every AI use case running across the bank. The team built to do this work deliberately mixes perspectives, avoiding a group made up only of risk-averse lawyers or only of data scientists. Standard Bank then tests any new ethical framework inside a small incubated environment against a live use case, in Kerryn's example the bank's own AI nudging technology, before rolling it out organization-wide. She was candid this model will not suit every organization, particularly smaller startups, but it lets Standard Bank work out what a value like "fair" means in practice before scaling.

EU versus UK: two opposite bets on how to regulate AI

Kerryn contrasted the European Union's approach, an all-encompassing, prescriptive AI Act, with the United Kingdom's, a principles-based approach that adds AI considerations to the remit of existing sector regulators such as Ofcom rather than writing new AI-specific law. Her own view is that companies operating across jurisdictions often default to the most conservative applicable standard, such as GDPR for data privacy, because it is lower risk, even though that can cost local nuance and innovation. Asked how a bank with operations across dozens of African countries plus London stays consistent when staff in different countries may hold different views on fairness, Kerryn pointed to a blended approach: agree a single set of AI values and principles at a high level, then contextualize how those principles are weighted case by case, drawing a direct comparison to how human rights are balanced against each other, such as COVID-era tradeoffs between privacy and the right to life. On South Africa specifically, she said regulation is still lagging and will likely follow either the EU or UK model once it moves.

What is the Collingridge dilemma in AI regulation?

The Collingridge dilemma, as Kerryn used it, describes the tradeoff regulators face with a fast-moving technology: regulate too early and you cannot anticipate the full range of ways the technology will be used, but regulate too late and the behavior around it is already entrenched, making it far harder to change course. She cited the EU's need to rewrite its AI Act after ChatGPT's release, once the original text proved not to have anticipated generative AI, as a live example of a regulator caught by exactly this problem.

Does being outside the EU AI Act's high-risk categories mean a company is in the clear?

No. Kerryn was direct that assuming "I'm low risk, so my AI isn't in scope" is a mistake: even if a company's AI does not fall squarely within AI-specific legislation, other existing laws still catch problematic behavior. She pointed to the sheer number of other pieces of regulation that can apply to what a company's AI is actually doing, meaning gaps in AI-specific law do not translate into an absence of legal exposure.