◇ OpenCyber Academy
Professional · Chapter 9 · English

Chapter 9 — Communication, ethics and reporting

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 9 — Communication, ethics and reporting

Lesson map

Lesson 09 published. Map, example, EX041.

flowchart TD
  N0["Learning outcomes"]
  N1["9.1 Audiences"]
  N2["9.2 Honest uncertainty"]
  N3["9.3 Ethical pressure"]
  N4["9.4 Protecting affected people"]
  N5["9.5 Incident communication"]
  N6["9.7b Checking the message before it goes"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX041"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["9.1 Audiences"]
  N2["9.2 Honest uncertainty"]
  N3["9.3 Ethical pressure"]
  N4["9.4 Protecting affected people"]
  N5["9.5 Incident communication"]
  N6["9.7b Checking the message before it goes"]
  N7["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX041"]

[Learning outcomes]
    |
    v
[9.1 Audiences]
    |
    v
[9.2 Honest uncertainty]
    |
    v
[9.3 Ethical pressure]
    |
    v
[9.4 Protecting affected people]
    |
    v
[9.5 Incident communication]
    |
    v
[9.7b Checking the message before it goes]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX041]

Learning outcomes

You will (1) write findings and reports for different audiences; (2) state uncertainty honestly; (3) handle ethical pressure; (4) protect people affected by AI failures; and (5) communicate during incidents.

9.1 Audiences

Engineers need reproduction steps and fixes. Managers need impact, priority and decisions. Customers and the public need clear, accurate, timely information. Write separately for each, from the same facts.

For the callback finding, engineers received the test IDs and tool configuration, managers the impact and decision needed, and claims handlers a short note on what had changed for them. Check that all versions agree on the facts. Engineers need test IDs and reproduction steps, managers the risk and decision, and front-line staff what changes in their work. Write each version from the same evidence.

9.2 Honest uncertainty

Say what you tested, how many times, what you found, and what you did not test. "0 of 90 attempts succeeded (95% upper bound about 3%) on staging; non-English uploads untested" is honest. "ClaimChat is secure" is not.

Sofia's statement for ClaimChat followed this form, naming the untested non-English uploads. Make the untested parts visible, so readers can decide whether they matter. Readers can act on numbers and limits, but not on reassurance. When asked for a simple answer, give the numbers and what they mean for the decision, and say what further testing would reduce the uncertainty, with its cost.

9.3 Ethical pressure

You may be asked to soften findings before a launch. Keep facts unchanged; you may add context and management responses. If pressure continues, escalate and record it. Your duty includes people outside the organisation who could be harmed.

Sofia's response in the worked example below is an example: she kept the rating, added the status of the fix and offered to update after verification. Record the request and your response, with dates, in case questions arise later. Context such as a management response is welcome; changed facts are not.

9.4 Protecting affected people

Consider who bears the harm: honest claimants wrongly flagged, customers whose data leaks. Recommend recourse: explanations, appeals, fast human review. The EU AI Act's Article 14 emphasises human oversight that can understand, interpret and override AI outputs in high-risk systems.

For FraudFlag, Sofia's recommendation of review within 48 hours and a neutral "under standard review" message protects honest claimants. Ask what recourse an affected person has whenever a finding is reported. Affected people include claimants who never use ClaimChat. Consider their harm and recourse before recommending controls, and say what they will be told.

9.5 Incident communication

Inform the right people quickly, with what is known, what is not, and next update time. Avoid speculation. Coordinate external messages through the designated owner.

During the FraudFlag storm, updates went to claims managers with what was known, what was not and when the next update would come. Keep a log of messages sent, and correct any message that turns out to be wrong in the next update. Updates should be regular even when nothing new is known, since silence worries people more than slow progress.

9.6 Worked example (synthetic Meridian case)

Before ClaimChat's wider launch, a manager asks Sofia to label the disclosure finding "low" because it is "fixed already". The fix is deployed but not yet verified on the held-out suite. Sofia keeps the rating, adds "fix deployed; verification due Friday", and offers to update the report after verification. On Friday, 0 of 20 disclosure tests succeed; she lowers the status to "closed — verified", with evidence.

The rating changed only when evidence changed, and the report showed both states. The manager's request came before the wider launch, when pressure was highest.

9.7 Errors and limits

Each error damages trust. One report for all audiences gives engineers too little detail and managers too much. Overstated certainty, such as calling ClaimChat secure, collapses at the first failure. Changing facts under pressure, which Sofia refused to do, undermines every report that follows. Check each report for all three before sending it. Fix any you find before the report leaves the team. A reviewer who was not involved can spot them more easily than the author can.

9.7b Checking the message before it goes

Before a report about FraudFlag errors leaves the team, a colleague who was not involved reads it for three things: whether any customer could be identified, whether uncertainty is stated honestly, and whether the recommended action is clear. Changes are made before sending.

Record who reviewed it. The reviewer's comments are recorded with the report, and any disagreement goes to Sofia's supervisor before sending. Watch especially for combinations such as postcodes and claim dates, which together could point to a single customer even when no name appears.

Exercises

Synthesis

Good communication tailors facts to audiences, states uncertainty plainly, holds firm under pressure and keeps affected people in view.

Continue studying — chapter 09 of 12

← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →