The only way to build trust is to be trustworthy

I've read a lot of blogs and sat through a lot of event talks recently, and one word keeps coming up. Trust. More specifically, trust and AI. How do we build trust in AI? How do we build it with staff, with teams, with clients, with the public? How do we reassure people that our use of AI is safe, responsible, ethical? Well it might sound obvious but, If you want people to trust you, you need to be trustworthy.

Two types of trust

The first is trust in the technology itself, the trust layer in the AI stack. Is the model reliable? Is it secure? Does it do what it says it does? Can we check its outputs? What about bias, hallucinations, robustness and all the other technical challenges? There's plenty of good and necessary work happening here, but it's not really what this post is about. The second is trust in the organisations using AI. How they decide to use it, what they use it for, how much power they hand it, how they understand and manage the risks. Whether they're open about what they're doing, and whether they'll be held to account when it goes wrong. You could be running the most technically reliable model in the world and still be using it in ways that are unfair, inappropriate or harmful. Or you could have the best intentions going and very little idea what your AI is actually doing.

Back in my Predictions for 2026 (or: What I'm Actually Thinking About) I said this:

Prediction 6: There will be some major AI discrimination/shitstorm in the UK related to public services.

Well, this week Open Rights Group published the findings of a six month investigation into two generative AI tools the Home Office uses in asylum casework. One summarises asylum interview transcripts, the other is a chat-style search over policy and country information. These are not small insignificant things. What gets summarised, what gets left out and what gets put in front of a caseworker can shape decisions with life-changing consequences. So what did they find? Among other things:

• People claiming asylum still aren't told when AI is used to summarise their case.
• The Home Office's own pilot found 9% of summaries were inaccurate or missing information and had to be pulled. Error rates from later sample checks were higher.
• Between April and July, just 0.3% of generated summaries were checked by Home Office subject matter experts.
• There's no quality assurance process for the summaries, and no plans for an independent audit.
• Neither tool has been recorded on the government's Algorithmic Transparency Recording Standard Hub.

On top of that, the Home Office has refused to say how staff are trained, what prompts the tools run on, or how they're being tested. Does this classify as a shitstorm? I dunno, but it probably should. On a very different scale a blog this week on The Clothworkers' Foundation's blog on trialling AI in its grantmaking caught my attention.

First off, I think it's good they're talking about it at all, lots of others doing this aren't openly talking about it. So fair play for puttin it out there, even if perhaps a little later than ideal, and with all the caveats that I'm not sure the whole 'this will create efficiency' thing is why they should be exploring AI (I've got wider views on grant applications but that's another post.)

The blog lays out that they've tested AI against past applications and compared its assessments with their own, and they're confident enough to expand the trial so AI becomes one of the two assessors on eligible applications. A person keeps the final say where the two disagree, and the AI can't reject applications on its own. All pretty sensible. But the bit that caught my eye was them naming loss of trust from applicants as a risk, and transparency as part of how they'll deal with it. Because the blog is transparent. Sort of? It tells us what they plan to do and something of how. What it doesn't yet give applicants is the evidence they'd need to judge whether that approach is trustworthy.

How well did the AI do in testing? What kinds of mistakes did it make? Were some types of organisation or application assessed differently? How do they know it isn't introducing or amplifying bias? How will they check what happens once it's on live applications? And probably most important, what happens if you're an applicant who thinks an AI-assisted assessment of your work got it wrong? None of that is a criticism of their intentions, or even their process. They may well have good answers to all of it. But there's a difference between telling people you're being responsible and letting people see that you are.

Transparency is necessary. But it isn't enough.

We've published an AI policy, we've told people we use AI, we've set out our principles, cool. But a policy tells me what you intend to do, not what you actually do. An explanation tells me how something is meant to work, not how it works in practice. And a promise to use AI responsibly is exactly that, a promise. They're all important starting points. They're just not evidence that the promises are being kept. None of this is new. Onora O'Neill has been making the distinction between trust and trustworthiness for over twenty years. We spend a lot of energy asking how to increase trust, when maybe we should spend more making organisations worthy of it, and helping people make their own informed decisions about who and what to trust. The aim shouldn't be more trust. It should be more justified trust. And that to me, needs evidence.

What would being trustworthy actually look like?

Start with being clear about where AI is used and what it's actually allowed to do. Not "we use AI to support our work", but which bits of the work? Does it summarise? Recommend? Rank people or organisations? Influence decisions? Make them? Those are very different things with very different implications.

Then evidence. What have you done to show the system works as intended? What did you test, what did you find, what didn't work, what's still uncertain? Then what's happening in practice, which is probably the most important bit, because what you planned for a system to do and what it actually does aren't necessarily the same. Models change. Systems change. The people using them change how they work. An assessment from six months ago doesn't tell you much about whether a system is behaving itself today. And then accountability. Who's responsible? What happens when something goes wrong? Can someone affected by an AI-assisted decision find out what happened and challenge it? Will the organisation own its mistakes and learn from them? And who gets to judge whether it's working: just the organisation, or do the people affected get a meaningful say? None of this is revolutionary. Most of it is just good organisational practice, AI or not. But AI makes the gaps far more visible, and the consequences far bigger.

All of this is part of what got me building something I've called CRUX (the crux of a climb is the hardest bit...)

The idea is pretty simple. What if organisations could set out what their AI is meant to do, show the evidence for those claims, and compare that with what actually happens?

It isn't a policy generator or a trustworthy badge, and it's definitely not some arbitrary trust score. It's more like a living account of how AI is being used, joining up what an organisation says, what it can show, and what can be seen in practice. Four simple ideas:

• SAYS: what does the organisation say the AI does? Its purpose, its role, its limits.
• SHOWS: what evidence backs that up? Testing, evaluations, reviews, other documentation.
• HAPPENED: what's actually been observed in use? Where was AI involved, what happened next, how did people make decisions?
• UNKNOWN: what don't we know yet? Where is evidence missing, patchy or contradictory?

One of the more interesting bits we've been working on is observing AI systems in use and comparing that with what the organisation said should happen. Observation doesn't automatically tell you whether something is safe or fair. But without some view of what's actually going on, most talk of responsible AI stays theoretical. CRUX is still very much a work in progress and I'm learning as I go. A tool can't make an organisation trustworthy on its own. But I think it can make it easier to show your working, spot the gaps, and be accountable for what happens.

Trust is an outcome, not an objective

Back to how we frame the question. How do we build trust? How do we increase public confidence? How do we reassure people that AI is safe? If an organisation wants to be trusted with decisions that affect people's lives, it should be ready to show why that trust is deserved. Not through statements, policies and assurances, but through how it works, what it knows, what it shares and how it responds when things go wrong. Trust isn't something an organisation is owed. So maybe instead of asking "how do we build trust in AI?" we should be asking "what would we need to do, and what would we need to show, to deserve it?" because the only way to build trust is to be trustworthy.