Risks, Ethics and Responsible Use of AI within Scrum
Know the risk categories
Accuracy: hallucination and silent errors. Bias and fairness: outputs that disadvantage groups or entrench historical patterns, especially in hiring or performance contexts. Privacy and confidentiality: personal data, client names, unpublished strategy, or code pasted into a third-party tool. Security: prompt injection and over-broad data access. Intellectual property: unclear provenance and licence obligations in generated content. Over-reliance: deskilling and reduced vigilance. Accountability: a human must remain answerable for decisions affecting people.
Responsible use in practice
Responsible use is concrete, not aspirational: an approved-tool list, data classification rules, redaction before prompting, human review proportional to impact, disclosure where it affects a person, retention settings checked, and an escalation route when output looks wrong or harmful. Where regulation applies - for example transparency and high-risk obligations in frameworks such as the EU AI Act - the organisation, not the Scrum Team alone, owns compliance, but the team must know which uses are in scope.
Traps
- "The model said so" used as justification for a decision about a person.
- Assuming anonymised or aggregated data is automatically safe to paste.
- Assuming a vendor will not train on your inputs; that is a contractual question, not a guess.
- Assuming generated content is automatically free of third-party rights.
- Concluding that ethics is someone else's policy domain and therefore not a team concern.
Rule of thumb
The public-forum test: if you would not post the content in a public channel, do not put it in a prompt without an approved, documented basis.
Worked example
A Scrum Master wants help summarising retrospective notes that mention two customers by name. Correct handling: redact names and identifying detail, use the approved internal tool, keep the summary human-reviewed, and store it under the team's normal retention rules.