While all businesses are required to follow certain regulatory and legal requirements, what it means to be ethical varies from company to company — and even from person to person. 

Aligning business values with vendor relationships is a "long-standing issue that companies have to grapple with when they decide who they're going to do business with," according to Kirsten Martin, professor of technology ethics at the University of Notre Dame's William P. and Hazel B. White Center. 

Ethics can come up in unusual ways, such as blowback for not supporting social issues or labor practices. "Tech is not immune" to the ethical issues faced by all of the supply chain, such as whether to support a vendor known for union busting or a vendor contracting with controversial organizations, Martin said. 

IT business decisions bring a whole new set of ethical challenges. Use of data and AI, for example, can present privacy and discrimination issues on top of traditional supply chain ethics. And it falls on IT leaders to account for the ethical dilemmas. 

"The idea [that] needs to always be with the CIO is that, 'this is still my business decision,'" said Martin. "I need to make sure that ... using the technology to augment it actually fits within the values of my organization, and that I still have control over that decision."

The ethical issues fit into a business's bottom line, too. Strong ethics sustains internal and external trust, which is good for competitive advantage. 

"More organizations are seeing that trust is a measurement of profitability, of organizational health, of success," said Catherine Bannister, Tech Savvy and ethical tech leader at Deloitte. "This notion of ethics is becoming much more visible to stakeholders across the board and they are using that as a measure of trust, both internally and externally."

But there's no common definition for what ethical technology looks like and the conversation is ongoing. Instead, CIOs and other members of IT leadership are responsible for figuring out what tech ethics mean for their organizations in the near- and long-term. 

If an organization doesn't do its ethical due diligence, customers will catch on and trust will be diminished, according to Bannister. 

The role of the CIO

Ultimately, businesses take responsibility for the ethics of their technology decisions even if the tech is supplied by a vendor. 

When outsourcing an algorithm, for example, CIOs should be asking if it was tested for accuracy and what that test looks like, according to Martin. 

Businesses should understand how the technologists behind the algorithm identify and judge mistakes to gain clarity into what mistakes the business may not be aware of, according to Martin. Questions would include: 

• Has the vendor defined and tested for accuracy? 

• Where does the data behind the algorithm come from?

Not only should the algorithm be making accurate predictions, but it should also be based on data that is representative of the population. For instance, Amazon ditched an AI recruiting tool that discriminated against women because it was based on past hiring data featuring mostly men. 

"One of the things that you need to do as an IT procurement person is to assess how transparent the product vendor is in where and how they got their data and how they are ... developing mitigation strategies," Bannister said. Ideally, a business could use their own data, but oftentimes the business won't have that opportunity. 

The business, not just the vendor, is liable for any bias or ethical issues stemming from tech investments. 

As a business, "I'm responsible for that decision no matter how I automate it, whether I use an Excel spreadsheet or my own homegrown [department] creates AI, or if I buy a product off the shelf and use it," Martin said. 

"Let's just say [the technology] starts making mistakes, who between the two of us — my vendor and me CIO — who is in charge of identifying and fixing mistakes?" said Martin. These questions can be applied to any type of technology, and businesses can build an ethical framework to apply to tech generally that is adaptable to emerging technologies as the business adopts them. 

"If you can build the ethical decision-making muscle memory of approaching any technology with a healthy degree of skepticism …  then you'll be able to apply it to … whatever fill-in-the-blank technology," said Bannister. "These are capabilities that should transcend the technology."

Conversations around ethics should also include voices from different backgrounds and even include secondary users that may be impacted by the technology, according to Bannister. 

"Ethics lives in the gray," Bannister said. "So, there may not be contract language, there may not be regulation." Instead, it's an ongoing conversation about responsibility that many businesses are still grappling with. 

"The more ethical outcomes come from a more diverse conversation," Bannister said. "Diversity in the sense of widening the aperture on the perspectives that you're interrogating the dilemma about."