The ethical challenges of AI washing

The rise of artificial intelligence is leading to deceptive marketing practices. Buyer beware 

The rise of artificial intelligence (AI) has created immense opportunities for businesses. But there are significant ethical issues as well that businesses are slowly becoming aware of. One of the latest issues is “AI washing,” where companies exaggerate the capabilities of their AI-powered products to attract investors. 

What exactly is AI washing?

Think “greenwashing” – the term used to describe misleading claims about environmental responsibility – but instead apply it to artificial intelligence. Companies might overstate their AI’s capabilities, innovativeness or intelligence to secure a competitive edge in the market. The SEC, for one, has made it clear that such practices will not be tolerated. In March 2024, the SEC fined two investment firms approximately $400K for making misleading statements about their AI use.

But it’s complicated. AI washing not only violates securities regulations but also presents ethical challenges that can impact corporate integrity and reputation. Compliance officers must navigate a complex landscape of legal and ethical responsibilities when advising companies on AI-related claims. 

As primary risk assessors, compliance officers must ensure their companies adhere to regulations, particularly those related to disclosures. Given the evolving nature of AI, companies need to be extra cautious in how they market their AI-powered products. Failure to do so could result in penalties and reputational damage.

Ethical obligations, corporate responsibility

Companies must also consider their ethical obligations when making AI-related claims. AI marketing needs to align with both regulatory standards and ethical business practices. This includes:

  • Avoid exaggerated or misleading statements about AI capabilities
  • Establish review processes to validate AI claims before they are made public.
  • Help executives understand the risks associated with AI washing and the importance of transparent communication with investors and customers.

Understanding AI is becoming a compliance necessity

Compliance officers do not need to be AI experts, but they must have a basic understanding of AI technology to properly assess risks. This includes recognizing the limitations of AI systems, understanding machine learning principles and identifying when marketing claims may be misleading. A strong foundation in AI literacy will enable compliance officers to ask the right questions and push back against dubious claims.

There’s no donut that the competitive AI landscape has created a climate where companies feel pressured to make bold claims about their technology. But organisations that engage in AI washing risk legal liability, regulatory action and loss of stakeholder trust. This is likely to become an enforcement priority.

Old issue, new technology

Deceptive marketing practices have been around as long as there have been businesses to utilise them. AI washing is just the latest iteration of fraud but the principles of regulatory compliance apply in the same way. Compliance officers will need to be vigilant in making sure that AI claims are truthful and legally sound. They will not only be protecting their organisation but will also be upholding ethical business practices in an era of incredibly rapid technological change.

To help compliance professionals stay ahead of these challenges, we invite you to join our upcoming webinar, AI compliance and ethical practices – Ensuring the responsible use of AI in your organisation on Wednesday, 7 May 2025 at midday UK time.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.