Data Ethics for Finance Teams: Principles from the EU Trustworthy AI Guidelines and GDPR

Data ethics is the practice of asking whether a use of data is fair, explainable and proportionate, in addition to whether it is legal. For finance teams, the question arises whenever data about customers, staff or suppliers feeds a forecast, a scoring model, a fraud check or an AI tool. Two official sources give a useful frame. The first is the European Commission's Ethics Guidelines for Trustworthy AI, produced by an expert group, which set out seven key requirements. The second is the set of seven principles in Article 5 of the GDPR, as explained by the Irish Data Protection Commission (DPC). This guide outlines both and shows how they can be turned into practical questions for a finance team. The practical steps are our suggestions, not legal requirements.

If your team is also deciding who is accountable for AI use, our guide to AI governance for managers is a good companion to this one.

Two sources, two different roles

It is important to be clear about what each source is. The GDPR is binding law, and the DPC is the Irish regulator that explains it. The Ethics Guidelines for Trustworthy AI are different. According to the Commission's page, the High-Level Expert Group on AI presented them on 8 April 2019 (page last updated 31 January 2024). The Commission's expert group page (last updated 6 May 2025) says the group's mandate ended in July 2020 and that the concepts in the guidelines "are guiding the upcoming legislative steps in AI". The pages we read do not say whether the guidelines are binding, and they are produced by an expert group, so we treat them as a framework for good practice rather than as law.

The seven requirements for trustworthy AI

The Commission says trustworthy AI should be lawful, ethical and robust. It lists seven key requirements. In summary, based on the Commission's page:

• Human agency and oversight: AI should help people make informed decisions and protect their fundamental rights. Oversight can take human-in-the-loop, human-on-the-loop or human-in-command forms.
• Technical robustness and safety: systems should be resilient, secure and accurate, with reliable, reproducible results and a fallback plan if something fails.
• Privacy and data governance: systems should fully protect privacy and data, alongside good data quality, integrity and legitimate access.
• Transparency: data, systems and business models should be open to scrutiny, with traceability. Explanations should suit each stakeholder, and people should know when they are interacting with AI and understand its capabilities and limits.
• Diversity, non-discrimination and fairness: unfair bias should be avoided, and relevant stakeholders involved through the life cycle.
• Societal and environmental well-being: AI should benefit everyone, be sustainable, and have its social impact carefully considered.
• Accountability: mechanisms should ensure responsibility for AI systems and their outcomes, with auditability where it matters most and accessible redress.

The Commission also hosts the Assessment List for Trustworthy AI (ALTAI), a self-assessment checklist presented by the expert group on 17 July 2020 (page last updated 11 November 2025). The page says it helps put the principles into practice and that a web-based version exists.

The seven GDPR principles

The DPC's guidance on the principles of data protection lists the seven principles from Article 5 GDPR. Its Quick Guide (version last updated October 2019) explains them as follows:

• Lawfulness, fairness and transparency: processing needs a legal basis and must be fair, and people must be clearly told about it.
• Purpose limitation: data is collected for specified, explicit and legitimate purposes and not used in conflicting ways.
• Data minimisation: collect only what is needed for the stated purpose, and review holdings periodically.
• Accuracy: data must be correct and kept up to date, with procedures to fix or erase inaccurate data without delay.
• Storage limitation: keep data only as long as necessary and set retention periods.
• Integrity and confidentiality: use technical and organisational measures to protect against unauthorised or unlawful processing, loss or damage.
• Accountability: comply with the other principles and be able to demonstrate it.

The DPC's web page itself shows no last-updated date; the October 2019 date comes from the linked Quick Guide. Check the DPC site for current guidance.

How the two fit together for a finance team

The following mapping is our own reading and is not taken from either source. It is a way to organise questions, not a compliance test.

Practical steps

These are our suggestions.

• Keep a short register of data uses. For each analytic or AI use, record the purpose, the data fields, the owner and the reviewer.
• Test for surprises. Before a model goes live, ask someone outside the build team what would surprise a customer or employee about the way their data is used.
• Define human review points. Say which outputs are advisory and which can trigger action, and keep evidence of review.
• Use the self-assessment. The ALTAI checklist can structure a review discussion, although the Commission describes it as a set of concrete steps for self-assessment.
• Connect to your professional duties. Accountants also have ethical duties under their professional codes; see our guide to the IESBA Code of Ethics for professional accountants in Ireland.
• Read regulator guidance on language models. For generative AI specifically, see our summary of DPC guidance on AI and large language models.

An illustrative example

This is a fictional example with made-up details. A finance team builds a model to prioritise which overdue invoices to chase first. It uses invoice age, amount and customer history. Applying the questions above, the team notes that customer contact notes in free text are not needed for the ranking, so it drops them (minimisation), documents that a collections manager reviews the top of the list each morning (oversight), and records the reason for the approach (accountability). Nothing here is legal advice; it simply shows how short, specific questions can shape a design.

Learnsignal's offices are off Baggot Street in Dublin, and we offer in-person training from there. For current details, see our CPD pages.

Frequently asked questions

Are the EU Trustworthy AI guidelines legally binding?

The Commission pages we read do not say. They were produced by an expert group, so treat them as a good-practice framework and rely on the law itself, such as the GDPR, for binding obligations.

How many GDPR principles are there?

The DPC lists seven: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

What is ALTAI?

It is the Assessment List for Trustworthy AI, a self-assessment checklist from the Commission's expert group that puts the seven requirements into practical questions.

Does data ethics only matter for AI projects?

No. The same questions about purpose, fairness and proportionality apply to ordinary reporting and analytics, although AI adds extra risks such as opaque outputs.

Start small: pick one data use in your team and answer the questions in the table.