AI for Wildlife Conservation

Acknowledgements

Graham Wallington, Xeroth AI

Jessica Hodgson, Independent

Julia Li, TUM

Karina Torres, Southern Illinois University

Meredith S. Palmer, Panthera

Md Anwar Hossain, Independent

Naomi Matthews, Chester Zoo

Yanna Vogiazou, Independent Innovation consultant

Of note is that AI tools were used in the creation of this best practice. The authors used them to deepen their understanding of the topic and to find up-to-date references. The authors also used them to check that terms were standardised and used consistently across the document. In that sense the authors directed the tools, rather than being directed by them. Humans checked all content for suitability, accuracy and coverage, and take full responsibility for everything presented in the best practice.

Introduction

Background

Artificial Intelligence (AI) is a tool that speeds up a huge range of operational, data processing, and analytical tasks, enabling users to accomplish more in less time [1,2,3]. This has huge implications for conservation work [4,5]. Combined with other technologies, AI is also becoming more and more effective at capturing and categorising the data conservationists rely on to detect threats and monitor the impact of their work [6]. For example, the Conservation AI platform processes camera-trap and drone images from reserves in Uganda, South Africa, and elsewhere, using machine learning models that automatically detect and classify wildlife species, including pangolins and rhinos [7]. These smart camera networks also detect poachers in real time, triggering alerts to rangers [7]. Meanwhile, in the Peruvian Amazon, platforms like Forest Foresight use AI to combine satellite data, illegal road building, and environmental indicators to pinpoint high-risk rainforest zones up to six months before illegal logging begins [8,9].

As well as specialist conservation uses, AI is becoming fully integrated into how conservationists use the internet, applications, and software in general. Microsoft and Google have built their chatbots (Box 1), Copilot and Gemini respectively, into the office software, email, and web browsers that conservationists already use for everyday tasks [10,11]. Other providers offer similar integrations, so AI assistance now sits inside many of the tools conservationists work in without a separate app to open. Likewise, the makers of chatbots such as Claude and ChatGPT, among many others, are making it increasingly easy to connect their tools to other applications, so that a chatbot can read from and act on the email, documents, calendars, and spreadsheets that conservationists already work in [12].

Box 1. Chatbots.

A chatbot is an application that lets a user converse with an AI model by typing or speaking, with the model replying in plain language. ChatGPT, Claude, Gemini and Copilot are all chatbots. Most are built around a large language model, and many can now also work with images, documents and video [13]. A basic chatbot only responds to what a user gives it in the conversation. More advanced chatbots can search the internet, read a user’s files or connect to a user’s email and calendar [12].

Over time, the use of AI is, therefore, likely to change the size of conservation teams and the work they do [14]. Fewer people may be needed for tasks that conservationists have traditionally done, such as processing data, drafting funding proposals, and creating materials for campaigns [15]. For example, a large NGO may be able to raise the same amount of funds with one staff member using AI as it previously raised with a team of four. So for some roles, people using AI may replace those who do not [14].

Other negative aspects of AI include:

Environmental cost: The infrastructure that runs AI uses large amounts of energy and water [16,17].
A wider digital divide: AI access, tools and training are concentrated in the Global North, so marginalised conservationists and communities, particularly in the Global South, may fall further behind [18,19,20].

Despite these drawbacks, AI may unlock conservationists’ capacity to achieve much greater impact for the wildlife and communities they care about, because those who build their AI skills will be able to do more in the same time [4,5]. For example, a monitoring officer using a species classification model can process a season of camera-trap images in days instead of months, and someone using AI could create a donor report in an hour instead of over several days [1,21]. These skills and uses may also open up new roles [14]. An organisation may need a Head of AI Application to set its policy on responsible AI use and train staff to apply it, or they may need a data officer who can connect AI agents to monitoring databases.

So, the conservationists who build their AI skills now will put them in a stronger position for these opportunities [14]. The purpose of this best practice, therefore, is to help conservationists understand what AI is, and to provide guidance on how to use it effectively and responsibly in their conservation work.

Application

Conservationists can use this AI for Wildlife Conservation best practice whenever they are working out whether or how to use AI in their conservation work. Specifically, it can be used as:

A guide to help learn about and apply AI effectively.
The basis for an organisational policy on responsible AI use.
A training resource for building AI capability across a team or network.

How closely the best practice should be adhered to will depend on what is being produced and which AI tool has been chosen for the task. A quick social media post calls for a lighter check than a funding proposal a donor will scrutinise, but the same principles and process apply to both.

Overview

This best practice is made up of the following components:

Understanding AI: What AI is, how AI models are built, how AI systems and AI agents work, and how AI is likely to change, so you can judge what it is capable of and where it can go wrong.
Principles: Seven principles that should run through every use of AI, covering access to data and applications, your own expertise, moderation, bias, accountability, the value of what you produce, and openness about AI's part in it.
Using AI: A process for producing outputs with AI, made up of designing the output, selecting a tool and setting its permissions, instructing it, verifying what it produces, and finalising the piece.

While Using AI is set out as a sequence, it is not always followed in a straight line. New information at any step can send you back to an earlier one, such as a source that contradicts a draft or a tool that turns out to be unsuited to the task.

Supporting resource

The supporting resource for this best practice is the glossary, which has all the terms used across all WildTeam best practices, together with their definitions.

Understanding AI

Overview

For many people, AI is a black box [22]. You type a prompt, or a camera-trap photo gets identified, and a result appears, with little sense of what happened in between. That gap makes it easy to hold onto a picture of AI that is not quite right, such as treating it as something that thinks or reasons the way a person does [23]. AI is also being built into more of the everyday tools you already use, from email to field sensors, often without you noticing [7,11]. A clear picture of what AI is and where it is heading gives you the foundation for understanding the principles and process for using it.

This section builds that picture, covering:

What AI is, describing the components of an AI system and the two main types of AI model, predictive and generative.
How AI models are built, setting out the steps developers follow to create a model, from defining its purpose to releasing it.
How AI systems work, explaining how simple AI systems and AI agents turn an input into an output or action, how permissions limit what AI agents can do, and where AI systems run.
How AI will change, describing how AI is doing more without a person and being built into more digital tools and physical devices.

What AI is

AI is an area of computer science focused on developing AI systems. An AI system uses machine learning to perform tasks that normally require human intelligence, such as analysing information, making predictions, writing a report or creating a picture [24]. In general, an AI system is made up of two essential components, and may include two optional components:

Data (essential): The information built into and used by the system. It is a core component because it provides the knowledge used to build and run the AI. This can include the massive datasets used to train the system’s memory, as well as new information fed in to generate outputs. For example, thousands of labelled camera-trap photographs from a wildlife reserve could be used to train the model or provide images for it to analyse [21].
Model (essential): The program that has been trained to do a specific task (Box 2). For example, a model trained to recognise animals in camera-trap photographs could identify whether an image contains a leopard, elephant, or other species [6].
Application (optional): The software that uses the AI model to perform a particular task and provides a way for people to interact with the system. For example, a camera-trap monitoring application could automatically send photographs to the AI model, record the species identified, and display the results for someone to review [25].
Tools (optional): An AI system may connect to other software or equipment to access information or carry out tasks. For example, the camera-trap system could connect to a database to store observations, a mapping system to show where animals were detected, or email software to alert someone when a leopard is detected [7,12] (Figure 1).

Figure 1. AI system components.

Box 2. Common types of AI model.

Predictive models: Analyse input data and use patterns learned from existing data to produce an output such as a classification, prediction or detection. For example, a model could identify animals in photographs, recognise bird species from their calls, classify different types of habitat, or predict where a species is likely to occur [6,26].

Generative models: Learn patterns in existing data and use them to generate new content. They can produce text, images, audio, video or code [27]. Large language models are a type of generative model designed to work with language. Tools such as ChatGPT use large language models to generate and analyse text [27].

Not every AI system contains all of these components. One AI system might consist of an AI model within an application, while a more complex system might use several AI models, databases, and various digital or physical tools to carry out a series of tasks [24].

How AI models are built

Most conservationists will use AI models that others have built, and few will need to build one. Some may adapt an existing model for their own task, such as training a published species classifier on photographs from their own site [25]. Even so, knowing how models are built explains most of their limits. It shows why mistakes in the training data become mistakes in the model, why a bird call identification model can fail on recordings from a different region, why a chatbot can repeat the biases in its training data, and why a model can be out of date [28,29]. Understanding these limits will help choose the right AI tool for a task and know what to check in its outputs.

AI models are typically built through the same broad sequence of steps, whether the model identifies bird calls or writes text [30]. The steps differ mainly in scale. A predictive model for one conservation task can be built by a small team of developers, while a large generative model may take years of work, thousands of specialised computer chips, and a large budget [31].

The general steps for building an AI model are shown in Figure 2 and outlined in more detail below.

Figure 2. General steps for building an AI model.

Define purpose

The developers first decide what the model needs to do and how they will judge whether it does it well. For a predictive model this task is narrow, such as identifying 30 mammal species in camera-trap photographs from one region. For a generative model it is broad, such as producing useful text in response to almost any prompt. This decision shapes every step that follows [30].

Design model

Developers write the code that sets out the model's structure and how it will learn. The purpose decides that structure. A model that identifies species in camera-trap photographs needs a structure suited to images, while a model that writes text needs a structure suited to language [32,33]. The purpose also sets the model's rough size, so a model that identifies 30 species is far smaller than a model that responds to almost any prompt.

Most modern AI models are neural networks. This includes chatbots and the models that identify animals in camera-trap images. A neural network is a large set of simple calculations arranged in layers, where the result of each layer is passed to the next. The design was loosely inspired by the way brain cells pass signals to each other [32].

A neural network has two parts. The first part is the code, which sets out the calculations and the order they run in. The code does not change once it is written. The second part is a large set of numbers called parameters (Box 3). The parameters are stored in a separate file, and training changes them [32].

Box 3. Parameters.
Parameters are the numbers a model adjusts during training. Every calculation in the network uses some of them, so they control how the model turns an input into an output. A small model has thousands of parameters, and a large model has billions [32,34]. In a camera-trap model, the parameters decide which patterns of pixels lead to the label “leopard”. In a chatbot, they decide which word is most likely to come next [34].

Figure X. How code and parameters work together in layers of calculations to create an output.

Prepare training data

Developers now collect the training data the model will learn from. A predictive model needs training data for the one task it will do, such as camera-trap photographs, satellite images of cleared forest, or recordings of whale calls [6]. A generative model needs far more training data, gathered from across the internet along with books, articles, and images [29]. Whether the people who created that training data agreed to its use, or were paid for it, is an open legal and ethical question [35].

For a predictive model, people give each photograph or recording a label showing the correct answer, such as which species appears in a camera-trap photograph. This labelling is slow and often done by experts or volunteers, and any mistakes in the labels become mistakes in the model [21,36].

The training data for a generative model is too large to check by hand, so developers often use automated filters to try and remove duplicates, spam, and harmful content. It can still, however, keep reliable content alongside content that is outdated, biased, or wrong [29]. For both types of models, developers set aside part of the training data as test data [30].

Train model

Training is where the model learns. The model is shown one item from its training data, makes a prediction, and compares that prediction with the correct answer. For a predictive model, the correct answer is the label. For a generative model, it could be the next word in a piece of text, which is why generative models can learn from text nobody has labelled [34].

After each comparison, the parameters are adjusted slightly so the next prediction comes a little closer, while the code stays the same. Repeated billions of times, these small adjustments add up to a model that has learned the patterns in its training data. So nobody has to write a rule describing a leopard's rosettes, because the model learns that pattern from labelled photographs [32].

Developers often follow this with a second, smaller round of training called fine-tuning. A generative model trained only to predict the next word can continue a piece of text, but it does not yet follow prompts well. Developers, therefore, fine-tune it on outputs written by people to show what a good output looks like, and on people's ratings of which of two outputs is better [37]. Fine-tuning teaches the model to follow prompts and to decline harmful prompts [37]. Training a large generative model runs for weeks or months on thousands of specialised computer chips in data centres, using large amounts of electricity and water [16,17].

Test model

Developers test the model on the test data they set aside, to measure how often its predictions are correct. A model can perform well on its training data and still fail on new data, so this test gives a truer picture of how it will perform once released [30].

Testing also looks for weak spots. A model trained on camera-trap photographs from East African savannas may perform well there and fail on camera-trap photographs from a Southeast Asian rainforest, where the species and lighting differ [28]. Developers also put generative models through safety testing, in which people try to make them produce harmful or false content [38]. Safety testing also checks how a model behaves once it is built into an AI agent, such as whether it takes unexpected shortcuts when it meets an obstacle [39].

Where the model falls short, developers improve it by returning to earlier steps. In many instances they gather more training data or change how the model is trained, and in some instances they change the design of the model itself [30].

Release model

Before the model is released, the developers fix its parameters. The released model is the code together with the file of trained parameters, and it is built into applications such as a camera-trap monitoring system or a chatbot. Once a model is released, its parameters stay fixed [40].

Some AI tools may save notes about your input between conversations or search the internet for recent information. These features give the model extra information to work with, but they leave its parameters unchanged, so the model itself does not learn anything new. Only a new version, trained again on newer data, updates the parameters and brings the model’s knowledge up to date [40].

How AI systems work

Every AI system takes an input, passes it to one or more models, and turns what those models produce into an output, which could be some text, an image, a video, code for an application, or a mechanical action [24]. Both types of AI systems (predictive and generative) can use tools to do this. A tool can be digital, such as a database or email software, or physical, such as a drone, a robot, or a vehicle. How an AI system achieves this depends on if it is a simple AI system or an AI agent.

Simple AI systems

A simple AI system carries out a fixed sequence of steps to complete its task. The model supplies the intelligence at one or more of those steps, and the application decides what happens before and after. However sophisticated the model is, the simple AI system uses the same general sequence of steps [25] (Figure 3).

Capture input: A sensor, a person, or another piece of software provides the input, such as a photograph, a sound recording, or a typed prompt, which the application receives.
Run model: The application passes the input to the model, which processes it using the parameters it learned in training and returns an output, such as a prediction of what animal is in the photo with a score for how confident it is.
Apply rules: The application checks the model's output against rules a person set in advance, such as accepting it only above a set confidence score and sending anything less certain to a person to check.
Produce output: The application acts on the accepted result, such as saving a record, updating a map, or sending an alert.

Figure 3. Sequence of steps for a simple AI system.

For example, an acoustic monitoring system in a rainforest reserve might work as follows:

Capture input: A microphone mounted in the canopy records a loud sound and sends the recording to the application.
Run model: The application passes the recording to a predictive model trained on thousands of labelled forest sounds, which predicts that the sound is a gunshot with 95 percent confidence [41].
Apply rules: The rules state that any gunshot prediction above 80 percent confidence is accepted.
Produce output: The application records the time and location of the gunshot, marks it on the reserve map, and sends an alert to the ranger team.

A basic chatbot is also a simple AI system, built around a generative model. The input is your prompt and any files you upload. The model, usually a large language model, then predicts the most likely next word, or part of a word, one at a time. Given "The elephant walked into the", it rates "clearing," "water," and "forest" as likely next words, and "teapot" as close to impossible [34].

A chatbot does not always choose the single most likely word. It picks from several likely options, so the same prompt can produce a different response each time [42]. It adds its chosen word to what it has written so far and predicts the next one, building up sentences and paragraphs. The output is the text that appears on your screen. AI tools that generate images and video follow the same sequence, although most such models start from random visual noise and adjust the whole image over many steps until it matches the prompt [43].

Many chatbots now use multimodal models, which can take images, documents and audio as input as well as text, and some can also produce images or video. For example, you could upload a photograph from a field visit and ask for a social media caption, or turn a written project update into a short video for supporters [13].

However, because a generative AI model predicts what is likely instead of checking what is true, it can produce content that sounds correct but is false. This is known as hallucination [44] (Box 4).

Box 4. AI hallucination.

What it is: Hallucination is when generative AI produces content that looks or sounds correct but is false. A chatbot may cite a journal paper that does not exist or give a blue whale population figure that has never been recorded [45]. An image generator may give a species the wrong markings, and a transcription tool may add words that had not been said by the speaker [46]. The false content is presented as confidently as the true content, so it is hard to spot without checking [44].

Why it occurs: A generative model is trained to produce content that fits the patterns in its training data. It is not trained, however, to check whether that content is true. It has no store of verified facts to look things up in. It holds only patterns learned from text and images that were not necessarily checked for accuracy. Most models are also trained to always give an answer, so they rarely say they do not know [47]. Hallucination is more likely on topics that are poorly covered in the training data, such as a little-studied species, a local place name, or recent events [48].

How it occurs: A chatbot builds its answer one word at a time by predicting the most likely next word. When it knows the form of an answer well but lacks the specific facts, it fills the gap with words that fit the form. Asked for a reference on pangolin trade in Nigeria, it recognises that a reference has authors, a year, a title and a journal. It can combine a real researcher’s name, a plausible title and a real journal into a paper reference that does not exist [45]. Image generators work the same way. They produce what a scene typically looks like, not what a specific animal or place looks like, so they can get that wrong also, sometimes introducing elements that would never occur in that context.

The output of a simple AI system can also be a physical action. A habitat monitoring drone can use a predictive model to recognise a riverbed in its camera feed, and its application turns that prediction into steering commands, so the drone follows the river and collects data on tree cover as it goes. Motors, rotors, and other mechanics carry out the action. Making a device act safely in a real forest or river is a harder problem than producing text, which is why AI systems that act physically can lag behind the other AI tools.

AI agents

An AI agent is given a goal and decides for itself which steps will reach it [49]. Most AI agents then work through the following steps:

Receive goal: The AI agent receives a goal, usually as a written instruction from a person, although it can also be started by a schedule, an event, or another AI agent.
Select action: The AI agent’s model, usually a large language model, works out which action will move it closer to the goal, based on the goal and everything it has found so far.
Check permissions: The AI system checks whether the AI agent’s permissions allow that action, such as reading a database. If the action needs a person’s approval, the AI agent waits for it.
Carry out action: A tool carries out the action and returns the output to the model. A tool is any program or device the AI agent can use to act beyond the model itself. Digital tools may let the AI agent search the internet, read or update a database, send an email or run another model, such as a predictive model that identifies species in images. Physical tools, such as drones and vehicles, let it act in the real world.
Assess output: The model judges whether the goal is met. If not, the AI agent returns to Select action and repeats the steps. It stops when it judges the goal is met, or when it reaches a limit set by its developers or user. Its judgement can be wrong, so its results still need checking [49].
Deliver result: The AI agent produces the final output or action, such as a report, a saved file, a message, or a change in direction (Figure 4).

Figure 4. Sequence of steps for AI agents.

For example, an AI agent assessing an elephant population may work as follows:

Receive goal: A reserve manager asks the AI agent to "assess whether the elephant population in this reserve has changed significantly over the last five years, identify the likely causes of any change, and produce a report".
Select action: The model decides it first needs survey data.
Check permissions: The AI agent has permission to read the reserve's database, so it can go ahead.
Carry out action: The database tool returns five years of survey data.
Assess output: The model judges that the goal is not yet met, so the AI agent returns to Select action and repeats the steps several times. It uses a predictive model to estimate the population trend, which shows a decline. It then decides to check whether habitat loss could explain the decline, so it retrieves satellite images of the reserve and uses a second predictive model to measure habitat change. It searches the internet for recent research on elephant populations in the region, plots the population trend and habitat change with a charting tool, drafts the report with its large language model, and checks the draft against the survey data, revising any claim the data does not support. Once the report is complete and checked, the model judges the goal is met.
Deliver result: The AI agent saves the report. Because sending files outside the reserve's system needs approval, it waits for the reserve manager to approve before emailing the report to the conservation team.

The AI agent was not instructed to check habitat loss or search for recent research. It chose those actions because of the decline it found in the survey data, so a second run towards the same goal could take a different route [49].

The same applies when an AI system acts physically. A habitat monitoring drone running a simple AI system follows a river because a person set that sequence in advance. Running an AI agent, the same drone could decide for itself to leave the river, take a closer look at a possible clearing, and then return to its route.

The wider an AI agent's permissions, the more it matters to decide in advance which actions it can take without a person approving them. Permissions sit outside the model, in the settings of the AI system and the tools it connects to. The developers of the AI system decide which permissions are available and what the defaults are [20,50] (Box 5).

Box 5. Defaults.

What it is: A default is how a permission is set before anyone changes it. For example, an AI agent might be allowed to read files by default but need a person’s approval before sending an email.

Why it matters: When the defaults are not changed, those settings decide what an AI agent can do. Developers often set defaults to make an AI agent useful straight away, which can give it more access than a task needs. Developers can also change the defaults when they update the AI system, so a setting that was safe before an update may not be safe after it [50].

What to do: Check the defaults before using an AI tool and again after each update, and change any that give more access than the task needs (see Set permissions).

An instruction typed into the conversation, such as "do not change the database", is different to a permission or default, because the model reads it as text and nothing stops it from acting otherwise. The permissions an AI agent has, therefore, set the limits of the harm it can cause, although that harm can be difficult to predict in advance [51] (Box 6).

Box 6. Unintended harm of AI.

An AI agent does whatever its goal, tools, and permissions allow, so when it meets an obstacle it can take unexpected routes to its goal. For example, AI agents told to beat chess software edited the file that stored the board so their opponent's pieces disappeared [52].

AI agents can also be manipulated by instructions hidden in an email, document, or web page they read, because they cannot reliably tell those instructions apart from yours [51]. For example, an AI agent with access to your email and monitoring database could read a hidden instruction in an email and send the GPS locations of collared rhinos to someone planning a poaching attempt.

Harm can also come from an AI model being wrong. Every model makes mistakes, and a decision based on a wrong output can damage the species or people it was meant to protect [6]. For example, a model could predict that a red deer population is increasing when it is declining, leading to a higher hunting quota that pushes the population closer to extinction.

It is also important to be aware that the same AI capabilities that help conservation can also be used deliberately to cause harm. AI can generate realistic fake images, video, and audio, such as a photograph of a ranger mistreating a suspect, or a recording of a director's voice asking staff to transfer funds. These can be used to discredit a conservation organisation, spread false stories about a community, or commit fraud [53,54]. AI can also be used to monitor people, for example by running facial recognition on camera-trap images to identify community members who enter a protected area, which can breach their human rights and damage their trust in a conservation organisation [55,56].

Where AI systems run

Most AI systems built around a generative model, such as chatbots, run on powerful computers in large buildings called data centres. The input, such as a text instruction, travels there over the internet, the AI system works on it, and the output travels back to a user’s screen, usually within seconds [16]. This is why most chatbots need an internet connection, and why anything that is typed into them leaves the device.

Some generative models are small enough to download and run on a laptop or desktop computer, with no internet connection [54]. For example, a researcher at a field station could use one to summarise notes from community meetings or draft a patrol report. In this case, nothing typed into the model leaves the computer, so sensitive information, such as the names of informants, stays private. The trade-off is that these locally-housed models need a reasonably powerful computer and are usually less capable than a model housed in a data centre.

AI systems can also run on field equipment, such as camera traps and acoustic sensors. Field equipment has far less computing power than a laptop, so it runs even smaller models, each built for a single task. For example, a camera trap can identify a species on the spot and send only the prediction, or an alert, over a satellite or mobile link [57,58]. Sending a short message instead of every photograph saves battery power, which keeps the camera trap running longer in the field. It also means photographs that should stay private, such as those showing people, do not leave the device [55].

How AI will change

What is changing fast is that AI is:

Doing more without a person: AI agents increasingly plan out a series of steps, carry them out using other software, and keep going without waiting for approval at each step [49,54]. For conservation work, that could mean an AI agent that manages a whole grant application from first draft to submission, or one that runs a habitat monitoring programme from end to end, starting with collecting the data and ending with sending a finished report to stakeholders.
Being built into more digital tools: AI is likely to stop being something you open in a separate app or window. Instead, it will show up built into what you already use, email, spreadsheets, mapping tools, and field data collection apps. The same shift is likely across a conservation organisation as a whole, with AI built into donor databases, grant management systems, and monitoring dashboards [10,11].
Being built into more physical devices: AI is increasingly being built into more physical devices such as drones, camera traps, and field sensors, alongside the associated software on a laptop or phone. For example, a drone can already plan its own flight path, spot signs of illegal logging as it flies, and adjust course to get a closer look, without a person piloting it step by step. Camera traps and acoustic sensors are moving the same way, processing and acting on what they capture in the field instead of only recording it for someone to review later [57].

While these changes may help us do more faster, the increased sophistication, pervasiveness, and autonomy of AI may also increase the risks of unintended harm [54] (Box 6).

Principles

Overview

Users of AI can waste resources on a task that doesn't need AI, or reproduce the bias in its training data [29,59]. AI can also produce confident answers that nobody involved knows enough to check, and work that carries no one's name and answers to no one [44,60]. It can expose sensitive data or act on systems it never needed to reach [50,51]. It can also produce a pile of generic content that gives little back to whoever views it, or leave people unaware that AI played a part in what they receive [61,62]. The purpose of the principles, therefore, is to help you use AI effectively and ethically across the whole of your conservation work, regardless of what you are producing or which AI tool you have chosen [62,63,64].

The seven principles are:

Keep it on a short leash, to give AI access only to the data and applications a task needs.
Know enough to judge it, to keep your use of AI within what you can check yourself while you keep building your own expertise.
Use with moderation, to use AI only where it suits the task, and in proportion to what the task needs.
See past the bias, to catch the different kinds of bias AI can reproduce from its training data before AI-generated content goes out.
Keep people in the loop, to keep a named person responsible for anything AI helps create or carry out.
Skim off the slop, to keep anything you produce with AI worth the time it asks of the person viewing the output.
Be open about AI, to make sure people know when AI played a substantial part in something they receive.

Learning to recognise typical AI output, including the generic phrasing, terms, structure, and vague, upbeat tone of text, so you can catch it in your own drafts before a reader does [78]. For example, an education officer recognises the AI slop in the following output “In today's rapidly evolving world, climate change isn't just a challenge — it's an opportunity to genuinely come together and make a difference. At the end of the day, it's not just about saving the environment — it's about safeguarding our shared destiny” is AI slop (Box 7, Figure 5).
Prompting against generic AI style before you start, by telling the AI tool explicitly what to avoid. For example, a fundraiser drafting a newsletter appeal tells the AI to avoid clichés and rule-of-three lists.
Adding in something that the AI could not generate, such as a specific detail, example, or judgement. For example, a programme officer swaps the AI's generic closing paragraph in a funding update for a specific detail from last week's site visit.

Box 7. Examples of AI text slop.

Funding appeal: "Protecting this rainforest isn't just about saving trees, it's about safeguarding a future for the wildlife that genuinely depends on it."

Social media caption: "Every donation truly makes a difference for elephants like these! #WildlifeConservation #ProtectOurPlanet #EverySpeciesMatters"

Report conclusion: "The pilot programme delivered strong results — better data collection and genuinely fewer conflict incidents. Moving forward, these lessons should shape how the next phase is designed."

Figure 5. Examples of AI image slop.

Be open about AI

Purpose

People judge information differently depending on who, or what, produced it [61]. A funder reading a proposal, a community member reading a leaflet, or a supporter looking at a campaign photograph may reasonably assume a person wrote or captured it, and finding out later that AI played a large part can damage their trust in you and your organisation. Some funders, journals, and partners also require AI use to be declared [79,80]. The purpose of the Be open about AI principle is to make sure people know when AI played a substantial part in something they receive, so they can judge it accordingly. Routine use, such as checking spelling or tidying the wording of an internal email, does not need to be flagged.

Application

The Be open about AI principle can be applied by:

Deciding whether the audience would want to know. Consider how much of the piece AI produced, whether the audience would assume a person made it, and whether they have their own rules on AI use. For example, a programme manager checks a funder's guidance before submitting a proposal drafted with AI, finds that it requires AI use to be declared, and adds a statement to the application.
Saying plainly what AI did and what a person checked. Name the AI tool, what you used it for, and how the output was reviewed [3,63]. For example, a research officer adds a note to a species status report stating that AI was used to summarise the literature review, and that all cited sources were checked by the author.
Labelling AI-generated images and video that could be mistaken for real. For example, a communications officer adds the caption "AI-generated illustration" to an image of a pangolin in a wildlife market used in a campaign post, so supporters do not take it for evidence of a real incident [81].
Telling people when they are communicating with AI. For example, a community liaison officer setting up an automated WhatsApp service for reporting crop raiding by elephants makes sure the first message states that replies are generated by AI and explains how to reach a person [63,81].
Publishing an AI use policy. Set out when, where, and why your organisation uses AI, what it will not use AI for, and how staff check and disclose AI-assisted work, then make the policy publicly available [62]. For example, a conservation charity publishes its AI use policy on its website, so funders, partners, and community members can see how it uses AI before they work with it.

Using AI

Overview

AI tools are getting easier to use by the day, but a quick result is not automatically one that fits your audience, gets the tone right, or stands up once someone checks the information in it [1,44]. This section sets out how to create a quality output through the following steps:

Define output, deciding what you are making and what a good version of it looks like before you start.
Select tool, picking the tool that suits the task, judged on more than convenience.
Instruct tool, giving the AI context and clear instructions, then building on what it produces.
Verify, checking what it produced against your sources and other evidence.
Finalise, correcting what verification turned up and editing until it is the way you intend, and disclosing the AI assistance where appropriate.

These steps are shown in Figure 6 and detailed below.

Figure 6. Steps for using AI.

Define output

To define the output, you need to first identify the audience and then decide on the format of the output.

Identify the audience: Name who or what will read or use the finished output, since that shapes everything that follows, including the level of detail, the tone, the length, and what information is presented. For example, a report written for a technical donor with an ecological background may require scientific terminology and charts of supporting data.
Decide the format: Settle on what kind of output is required, such as a report, an email, a slide deck, a social media post, physical action, or something else. The format affects the length, structure, and tone an output needs, and it determines which AI tool is suited to the job.

Select tool

New AI tools appear constantly, and those that are available today will not be the same ones available in a year [31]. You can use the following set of criteria to help you select which tool to use:

Capability: Check the tool produces the kind of output you need, and how well it performs that task. For example, a communications manager comparing two chatbots for translation work tests both using the same awkward sentence to see what it produces as an output.
Ease of use: Consider how much time and skill it takes to get a usable result. A powerful tool that takes hours to learn may not be worth adopting for a task your team does once a year. For example, a field team without a design background picks an image generation tool activated by simple text prompts.
Cost: Weigh the price of the tool against how often you will use it and what the task is worth. For example, an organisation creating one video explainer a year picks a lower-cost tool with a free tier.
Ethical considerations: Look at how a tool was built, including whether it credits or compensates the people whose work trained it, and what its running cost is in energy and water [35,59]. For example, a communications team choosing between two similar image generators checks how each sources its training images before picking one for a public campaign.
Terms and conditions: Read the tool's terms and conditions to find out what happens to anything you put into it, and check they are compatible with your organisation's data protection policy. Look for whether the provider stores your inputs and for how long, whether it uses them to train future models, and whether you can switch that off [20,65]. For example, a monitoring manager rules out a free chatbot for summarising patrol reports after finding its terms allow the provider to use inputs for training, and chooses a paid version whose terms exclude this.

Set permissions

Before you start using an AI tool, set what it can access and what it is allowed to do. This matters most for AI agents and for any AI tool connected to your own files, email, or databases [50] (Box 5). Permissions are set in the settings of the AI tool and the tools it connects to. An instruction typed into the conversation does not limit what the AI tool can do [51].

You can set permissions by deciding:

What it can access: Connect the AI tool only to the files, folders, and databases the task needs (see Keep it on a short leash).
What it can do: Give the AI tool the lowest level of access the task needs, such as permission to read a database without permission to change or delete anything in it [20,50]. For example, a monitoring officer connecting an AI agent to the camera-trap database gives it read-only access and turns off its ability to send emails.
What needs approval: Require a person to approve any action that cannot be undone or that sends information outside your organisation [50]. For example, a grants officer lets an AI agent draft and save a funding application but sets it to wait for approval before submitting it to the funder.

Instruct tool

Instructing the tool to produce an output involves providing the tool with context, and providing the tool with instructions.

Give it context

Within the AI tool, you should upload or link to any source material with information that you want the AI output to use [40]. For example, a fundraiser drafting a grant narrative pastes in the project's monitoring data and last year's approved proposal.

Likewise, you should upload or link to a strong example of the output type you want it to generate, ideally one from your own organisation or a similar one, so the AI tool can match its tone, structure, and format instead of falling back on a generic AI style [34]. For example, a grant manager drafting a donor update provides the organisation's best-performing newsletter from the previous year.

Provide instructions

Use a prompt (Box 8), to instruct the AI tool on such things as:

Purpose of context materials
Audience
Length or dimensions
Information sources
Style
Format
Structure
Process

Box 8. Prompt.

A prompt is the instruction you give an AI tool to tell it what to produce, typically typed into a chat window or the software built around one, such as "write a two-paragraph update for our donor newsletter about the start of the new sea turtle hatching season". You can also ask an AI tool to help you write the prompt itself, by describing what you are trying to achieve in plain terms, and asking it to turn that into a clear, structured prompt [82].

The amount of detail you put in your prompt is important for any type of AI output. More detail gives you a better quality first draft, closer to what you had in mind. Less detail gives the AI tool room to produce something you would not have thought of yourself, sometimes better than what you could have pictured [3,83].

Example grant proposal prompt

Purpose: Draft the first version of a funding proposal for the Cairngorms Peatland Restoration Project.
Audience: A programme officer at a funder with no ecology background.
Length or dimensions: Three pages, under 1,500 words.
Information sources: The attached monitoring data and project budget.
Style: Match the tone of the proposal that secured our last grant from this funder; avoid technical jargon.
Format: Downloadable, undformatted funding proposal.
Structure: Problem, our approach, the budget, and the expected outcomes, in that order.
Process: Do not state a total budget figure until the outcomes have been explained.

Example campaign graphic prompt

Purpose: Encourage members of the public to report suspected badger baiting to the police.
Audience: Dog walkers and countryside visitors in rural England who may witness activity without recognising it as a crime.
Length or dimensions: A3 poster.
Information sources: The attached river cleanup campaign poster, for colour palette and logo placement.
Style: A realistic badger sett scene instead of a cartoon style.
Format: Poster-style graphic.
Structure: A headline, the reporting number, a QR code, and a short line naming the signs to look out for, such as dogs with fresh injuries, spades, or terrier collars near a sett, positioned so it reads clearly from a noticeboard.
Process: Do not show any violence towards the badger itself.

Example data analysis prompt

Purpose: Identify patterns in human-wildlife conflict incidents to inform next quarter's patrol routes.
Audience: The ranger operations manager.
Length or dimensions: Two pages.
Information sources: The attached spreadsheet of incidents from the past 12 months.
Style: Plain language, avoiding statistical jargon.
Format: A chart, with a short written summary.
Structure: Present as a bar chart, grouped by species and location, ranking locations by frequency.
Process: Rank locations by frequency before suggesting any changes to patrols; do not recommend a change for a location with fewer than three recorded incidents.

Example application development prompt

Purpose: Create a mobile web application that enables members of the public to quickly and anonymously report suspected listings or sightings of illegal wildlife products to enforcement authorities.
Audience: Non-technical everyday citizens who may encounter illegal wildlife items for sale online, at local markets, or in shops.
Length or dimensions: A single-page, fully responsive web application with a maximum 3-step reporting workflow.
Information sources: The attached species threat database and national wildlife crime reporting guidelines.
Style: Clean, highly intuitive, and accessible interface with reassuring security indicators to build user trust around anonymity.
Format: Interactive web application.
Structure: A prominent emergency notice/safety reminder at the top, followed by a 3-step reporting form (1. Product & Species Details, 2. Location or Web URL, 3. Photos & Narrative), ending with a clear submission confirmation screen containing a unique tracking reference code.
Process: Automatically strip all personal location metadata from attached images before submission; do not require a user login or any personal identifying information to submit a report.

Iterate

Iterate on the first draft through further rounds of feedback and prompting, building on what the AI tool got right and fixing what it got wrong. This will require additional prompts to instruct the AI tool what changes you want. For example, a programme officer reads the AI's first draft of a funding update, tells it which paragraph misses the point and why, and asks for a rewrite of that paragraph. Running the same prompt again will give a different response each time, so save any version you want to keep before asking for changes [3,42].

Errors can also carry forward from one draft to the next. An AI tool builds each new version on what it produced before, so a wrong figure or a made-up source in an early draft can survive every later rewrite, and fixing one part can introduce new errors elsewhere [84]. Check each new draft in full, and correct errors as soon as you find them.

It is also important to be aware that at some stage generative AI will start to forget context and previous instructions the longer a conversation goes on [20,85] (Box 9). If a conversation runs long, check that the latest draft still matches your original prompt and source material, and start a fresh conversation with that context reloaded if it does not. Likewise you also need to recognise when you can’t push it any further if the outputs are getting further away from what you want. The same applies when reviewing new drafts starts to take longer than it saves. Good elements often end up spread across several drafts, and a single draft that gets everything right is rare. At that point, stop prompting, take the best parts from each draft, and combine and finish them yourself in a text editor, image editor, or other suitable software.

Box 9. How AI forgets

An AI model can only hold a limited amount of a conversation in view at once, called its context window. As a conversation runs longer, earlier material starts to drop out of what the AI is actively working from, even though it is still visible on your screen. A long back-and-forth of edits and feedback can push the source material or the brief you gave it out of its context window, so later drafts drift from what you originally asked for with no signal that this has happened [85]. Where two instructions conflict, AI also leans towards the most recent one. If you asked for 5,000 words early in a conversation and later asked for 200, it will normally follow the 200-word instruction.

Verify

AI outputs can contain errors that look and sound correct [20,44]. You can check any AI output by:

Comparing it with your own sources, such as data, previous reports, and personal knowledge, and with external resources, such as reputable news sources, published books, and journal papers.
Asking people with relevant expertise to review it, such as subject specialists, local community leaders, and Indigenous Peoples, who can judge whether it is accurate and appropriate [75].
Leaving out anything you have not been able to verify.

Specific verification checks should also be carried out before using outputs produced by either generative or predictive AI.

Verification checks for generative AI outputs

Generative AI can make up information and the sources for it, such as a journal paper that does not exist. It can also closely copy existing work, such as a known wildlife photograph or a published article, which can infringe the creator's copyright [35,86]. To check for these problems:

Ask the AI tool for links to the sources it used, then check them yourself [45,63].
Run AI-generated images through a reverse image search and search for distinctive phrases from AI-generated text, then credit, obtain permission for, or replace anything that closely matches existing work.

Verification checks for predictive AI outputs

A predictive model returns its closest match from what it was trained on, even when the input does not contain enough information for a reliable answer. For example, a species identification model can confuse similar-looking species, or label a species it was never trained on as one it knows [21,87]. To check for these problems:

Check that the model was trained on data similar to yours. For example, a bird call identification model trained on recordings from European woodland may perform poorly on recordings from a tropical wetland, where the species and background noise differ [26,28].
Send outputs below a set confidence score to a person to check. For example, a forest monitoring officer sets a satellite imagery model to flag clearance automatically only when it is at least 90 percent confident, and reviews the rest by eye [25].
Have a person with the right expertise review a random sample of the outputs. For example, a bat ecologist checks 100 randomly selected identifications from each month of acoustic monitoring data [25].
Review every output where an error would matter most or is most likely. For example, a ranger team leader checks every area a poaching risk model marks as low risk before patrols are withdrawn from it.
Record results only at the level of detail the input can support. For example, a survey team records grasshoppers in camera-trap images at genus level, since the species can only be separated through closer examination.

Finalise

You should now move on to finalise the output by:

Removing any data, figures, or claims that verification could not confirm.
Correcting anything verification turned up, such as a wrong statistic or a missing citation.
Making any other fixes to structure and content, such as reordering two sections of a report so the argument builds logically, or cutting a paragraph that repeats an earlier point.
Editing for style until the piece matches the tone and format you set out to match, such as rewriting an AI-drafted poster caption so it reads in the organisation's own voice.
Crediting, obtaining permission for, or replacing anything that verification found closely copies existing work.
Disclosing AI's part in the piece whenever the audience would want to know, such as labelling an AI-generated video of a simulated poaching incident used in a training presentation, in case a viewer may otherwise assume it was real footage.

References

Noy, S. and Zhang, W. (2023) ‘Experimental evidence on the productivity effects of generative artificial intelligence’, Science, 381(6654), pp. 187-192. Available at: https://doi.org/10.1126/science.adh2586

Brynjolfsson, E., Li, D. and Raymond, L. (2025) ‘Generative AI at work’, The Quarterly Journal of Economics, 140(2), pp. 889-942. Available at: https://doi.org/10.1093/qje/qjae044

Cooper, N., Clark, A.T., Lecomte, N., Qiao, H. and Ellison, A.M. (2024) ‘Harnessing large language models for coding, teaching and inclusion to empower research in ecology and evolution’, Methods in Ecology and Evolution, 15, pp. 1757-1763. Available at: https://doi.org/10.1111/2041-210X.14325

Reynolds, S.A., Beery, S., Burgess, N., Burgman, M., Butchart, S.H.M., Cooke, S.J. et al. (2024) ‘The potential for AI to revolutionize conservation: a horizon scan’, Trends in Ecology and Evolution. Available at: https://doi.org/10.1016/j.tree.2024.11.013

Rafiq, K., Beery, S., Palmer, M.S., Harchaoui, Z. and Abrahms, B. (2025) ‘Generative AI as a tool to accelerate the field of ecology’, Nature Ecology and Evolution, 9, pp. 378-385. Available at: https://doi.org/10.1038/s41559-024-02623-1

Tuia, D., Kellenberger, B., Beery, S., Costelloe, B.R., Zuffi, S., Risse, B. et al. (2022) ‘Perspectives in machine learning for wildlife conservation’, Nature Communications, 13, 792. Available at: https://doi.org/10.1038/s41467-022-27980-y

Fergus, P., Chalmers, C., Longmore, S. and Wich, S. (2024) ‘Harnessing artificial intelligence for wildlife conservation’, Conservation, 4(4), pp. 685-702. Available at: https://doi.org/10.3390/conservation4040041

WWF-UK (2026) Forest surveillance: innovation against deforestation. Woking: WWF-UK. Available at: https://www.wwf.org.uk/node/50766 (Accessed: 6 November 2026).

World Wildlife Fund (2023) ‘Could AI help stop deforestation before it starts?’, World Wildlife Magazine, Winter 2023. Washington, DC: World Wildlife Fund. Available at: https://www.worldwildlife.org/magazine/issues/winter-2023/articles/could-ai-help-stop-deforestation-before-it-starts (Accessed: 6 November 2026).

Rognier, B. (2025) Copilot is now included in Microsoft 365 Personal and Family. Microsoft 365 Blog, 16 January. Available at: https://microsoft.com/microsoft-365/blog/2025-01-16/copilot-is-now-included-in-microsoft-365-personal-and-family (Accessed: 6 November 2026).

Google (2025) Google Workspace business customers now get the latest in generative AI. The Keyword, 15 January. Available at: https://blog.google/products-and-platforms/products/workspace/google-workspace-generative-ai-features/ (Accessed: 6 November 2026).

Anthropic (2024) Introducing the Model Context Protocol. 25 November. Available at: https://www.anthropic.com/news/model-context-protocol (Accessed: 6 November 2026).

Yin, S., Fu, C., Zhao, S., Li, K., Sun, X., Xu, T. and Chen, E. (2024) ‘A survey on multimodal large language models’, National Science Review, nwae403. Available at: https://doi.org/10.1093/nsr/nwae403

World Economic Forum (2025) The Future of Jobs Report 2025. Geneva: World Economic Forum. Available at: https://www.weforum.org/publications/the-future-of-jobs-report-2025/ (Accessed: 6 November 2026).

Eloundou, T., Manning, S., Mishkin, P. and Rock, D. (2024) ‘GPTs are GPTs: labor market impact potential of LLMs’, Science. Available at: https://doi.org/10.1126/science.adj0998

IEA (2025) Energy and AI. Paris: International Energy Agency. Available at: https://www.iea.org/reports/energy-and-ai (Accessed: 6 November 2026).

Li, P., Yang, J., Islam, M.A. and Ren, S. (2025) ‘Making AI less “thirsty”: uncovering and addressing the secret water footprint of AI models’, Communications of the ACM. Available at: https://doi.org/10.1145/3724499

Speaker, T., O’Donnell, S., Wittemyer, G., Bruyere, B., Loucks, C., Dancer, A. et al. (2022) ‘A global community-sourced assessment of the state of conservation technology’, Conservation Biology. Available at: https://doi.org/10.1111/cobi.13871

UNDP (2025) Human Development Report 2025. A matter of choice: people and possibilities in the age of AI. New York: United Nations Development Programme. Available at: https://hdr.undp.org/content/human-development-report-2025 (Accessed: 6 November 2026).

King, R.A., Abowd, L., Broderick, C.W., Bradley, L.M., Czapanskiy, M.F., Farnisa, M.M., Ferrer, E.M., Galaz García, C., Gill, D., Greco, N.M., Jacquemont, J., Kadi, J.A., Kui, L., LeBuhn, G., Li, L., Meyer, A., Morse, M., Patrick, E., Shanny-Csik, S., Tucker, N.A.C., Wang, Z. and Fong, C.R. (2026) ‘Ten simple rules for effective use of generative AI for code development in environmental science’, PLoS Computational Biology, 22(8), e1014627. Available at: https://doi.org/10.1371/journal.pcbi.1014627

Norouzzadeh, M.S., Nguyen, A., Kosmala, M., Swanson, A., Palmer, M.S., Packer, C. and Clune, J. (2018) ‘Automatically identifying, counting, and describing wild animals in camera-trap images with deep learning’, Proceedings of the National Academy of Sciences, 115(25), pp. E5716-E5725. Available at: https://doi.org/10.1073/pnas.1719367115

Rudin, C. (2019) ‘Stop explaining black box machine learning models for high stakes decisions and use interpretable models instead’, Nature Machine Intelligence, 1(5), pp. 206-215. Available at: https://doi.org/10.1038/s42256-019-0048-x

Shanahan, M. (2024) ‘Talking about large language models’, Communications of the ACM, 67(2), pp. 68-79. Available at: https://doi.org/10.1145/3624724

OECD (2024) Explanatory memorandum on the updated OECD definition of an AI system. OECD Artificial Intelligence Papers. Paris: OECD Publishing. Available at: https://doi.org/10.1787/623da898-en

Vélez, J., McShea, W., Shamon, H., Castiblanco-Camacho, P.J., Tabak, M.A., Chalmers, C., Fergus, P. and Fieberg, J. (2023) ‘An evaluation of platforms for processing camera-trap data using artificial intelligence’, Methods in Ecology and Evolution, 14(2), pp. 459-477. Available at: https://doi.org/10.1111/2041-210X.14044

Kahl, S., Wood, C.M., Eibl, M. and Klinck, H. (2021) ‘BirdNET: a deep learning solution for avian diversity monitoring’, Ecological Informatics, 101236. Available at: https://doi.org/10.1016/j.ecoinf.2021.101236

Feuerriegel, S., Hartmann, J., Janiesch, C. and Zschech, P. (2024) ‘Generative AI’, Business and Information Systems Engineering, 66(1). Available at: https://doi.org/10.1007/s12599-023-00834-7

Beery, S., Van Horn, G. and Perona, P. (2018) ‘Recognition in terra incognita’, in Proceedings of the European Conference on Computer Vision (ECCV 2018). Cham: Springer, pp. 472-489. Available at: https://doi.org/10.1007/978-3-030-01270-0_28

Bender, E.M., Gebru, T., McMillan-Major, A. and Shmitchell, S. (2021) ‘On the dangers of stochastic parrots: can language models be too big?’, in Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency. New York: ACM, pp. 610-623. Available at: https://doi.org/10.1145/3442188.3445922

Amershi, S., Begel, A., Bird, C., DeLine, R., Gall, H., Kamar, E. et al. (2019) ‘Software engineering for machine learning: a case study’, in Proceedings of the 41st International Conference on Software Engineering: Software Engineering in Practice. IEEE, pp. 291-300. Available at: https://doi.org/10.1109/ICSE-SEIP.2019.00042

Maslej, N. et al. (2025) Artificial Intelligence Index Report 2025. Stanford, CA: Institute for Human-Centered AI, Stanford University. Available at: https://hai.stanford.edu/ai-index/2025-ai-index-report (Accessed: 6 November 2026).

LeCun, Y., Bengio, Y. and Hinton, G. (2015) ‘Deep learning’, Nature, 521(7553), pp. 436-444. Available at: https://doi.org/10.1038/nature14539

Vaswani, A., Shazeer, N., Parmar, N., Uszkoreit, J., Jones, L., Gomez, A.N., Kaiser, Ł. And Polosukhin, I. (2017) ‘Attention is all you need’, Advances in Neural Information Processing Systems, pp. 5998-6008. Available at: https://arxiv.org/abs/1706.03762

Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J.D., Dhariwal, P. et al. (2020) ‘Language models are few-shot learners’, Advances in Neural Information Processing Systems, 33. Available at: https://arxiv.org/abs/2005.14165

Samuelson, P. (2023) ‘Generative AI meets copyright’, Science, 381. Available at: https://doi.org/10.1126/science.adi0656

Northcutt, C.G., Athalye, A. and Mueller, J. (2021) ‘Pervasive label errors in test sets destabilize machine learning benchmarks’, in Proceedings of the Neural Information Processing Systems Track on Datasets and Benchmarks. Available at: https://arxiv.org/abs/2103.14749

Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C., Mishkin, P. et al. (2022) ‘Training language models to follow instructions with human feedback’, Advances in Neural Information Processing Systems, 35. Available at: https://arxiv.org/abs/2203.02155

Perez, E., Huang, S., Song, F., Cai, T., Ring, R., Aslanides, J., Glaese, A., McAleese, N. and Irving, G. (2022) ‘Red teaming language models with language models’, in Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing. Abu Dhabi: Association for Computational Linguistics, pp. 3419-3448. Available at: https://doi.org/10.18653/v1/2022.emnlp-main.225

Skalse, J., Howe, N.H.R., Krasheninnikov, D. and Krueger, D. (2022) ‘Defining and characterizing reward gaming’, Advances in Neural Information Processing Systems, 35. Available at: https://proceedings.neurips.cc/paper_files/paper/2022/hash/3d719fee332caa23d5038b8a90e81796-Abstract-Conference.html

Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V., Goyal, N. et al. (2020) ‘Retrieval-augmented generation for knowledge-intensive NLP tasks’, Advances in Neural Information Processing Systems, 33. Available at: https://arxiv.org/abs/2005.11401

Katsis, L.K.D., Hill, A., Pina Covarrubias, E., Prince, P., Rogers, A., Doncaster, C. and Snaddon, J. (2022) ‘Automated detection of gunshots in tropical forests using convolutional neural networks’, Ecological Indicators, 141, 109128. Available at: https://doi.org/10.1016/j.ecolind.2022.109128

Holtzman, A., Buys, J., Du, L., Forbes, M. and Choi, Y. (2020) ‘The curious case of neural text degeneration’, in International Conference on Learning Representations (ICLR 2020). Available at: https://arxiv.org/abs/1904.09751

Ho, J., Jain, A. and Abbeel, P. (2020) ‘Denoising diffusion probabilistic models’, Advances in Neural Information Processing Systems, 33. Available at: https://arxiv.org/abs/2006.11239

Ji, Z., Lee, N., Frieske, R., Yu, T., Su, D., Xu, Y. et al. (2023) ‘Survey of hallucination in natural language generation’, ACM Computing Surveys, 55(12), 248. Available at: https://doi.org/10.1145/3571730

Walters, W.H. and Wilder, E.I. (2023) ‘Fabrication and errors in the bibliographic citations generated by ChatGPT’, Scientific Reports. Available at: https://doi.org/10.1038/s41598-023-41032-5

Koenecke, A., Choi, A.S.G., Mei, K.X., Schellmann, H. and Sloane, M. (2024) ‘Careless Whisper: speech-to-text hallucination harms’, in Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency. New York: ACM, pp. 1672-1681. Available at: https://doi.org/10.1145/3630106.3658996

Huang, L., Yu, W., Ma, W., Zhong, W., Feng, Z., Wang, H. et al. (2025) ‘A survey on hallucination in large language models: principles, taxonomy, challenges, and open questions’, ACM Transactions on Information Systems. Available at: https://doi.org/10.1145/3703155

Kandpal, N., Deng, H., Roberts, A., Wallace, E. and Raffel, C. (2023) ‘Large language models struggle to learn long-tail knowledge’, in Proceedings of the 40th International Conference on Machine Learning. PMLR 202, pp. 15696-15707. Available at: https://arxiv.org/abs/2211.08411

Wang, L. et al. (2024a) ‘A survey on large language model based autonomous agents’, Frontiers of Computer Science. Available at: https://doi.org/10.1007/s11704-024-40231-1

OWASP (2025) LLM06:2025 Excessive Agency. OWASP Top 10 for LLM Applications 2025. OWASP Foundation. Available at: https://genai.owasp.org/llmrisk/llm062025-excessive-agency/ (Accessed: 6 November 2026).

Abdelnabi, S., Greshake, K., Mishra, S., Endres, C., Holz, T. and Fritz, M. (2023) ‘Not what you’ve signed up for: compromising real-world LLM-integrated applications with indirect prompt injection’, in Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security. New York: ACM, pp. 79-90. Available at: https://doi.org/10.1145/3605764.3623985

Bondarenko, A., Volk, D., Volkov, D. and Ladish, J. (2025) Demonstrating specification gaming in reasoning models [Preprint]. Berkeley, CA: Palisade Research. Available at: https://arxiv.org/abs/2502.13295

Chesney, R. and Citron, D. (2019) ‘Deep fakes: a looming challenge for privacy, democracy, and national security’, California Law Review, 107, p. 1753. Available at: https://www.californialawreview.org/print/deep-fakes-a-looming-challenge-for-privacy-democracy-and-national-security (Accessed: 6 November 2026).

Bengio, Y. et al. (2025) International AI Safety Report. London: Department for Science, Innovation and Technology. Available at: https://internationalaisafetyreport.org/publication/international-ai-safety-report-2025 (Accessed: 6 November 2026).

Sandbrook, C., Luque-Lora, R. and Adams, W.M. (2018) ‘Human bycatch: conservation surveillance and the social implications of camera traps’, Conservation and Society, 16(4), pp. 493-504. Available at: https://doi.org/10.4103/cs.cs_17_165

WildTeam (2026) Human Rights-Based Approach for Wildlife Conservation v1. Cumbria, UK: WildTeam.

Whytock, R.C., Suijten, T., van Deursen, T., Świeżewski, J., Mermiaghe, H., Madamba, N. et al. (2023) ‘Real-time alerts from AI-enabled camera traps using the Iridium satellite network: a case-study in Gabon, Central Africa’, Methods in Ecology and Evolution, 14(3), pp. 867-874. Available at: https://doi.org/10.1111/2041-210X.14036

Zualkernan, I., Dhou, S., Judas, J., Sajun, A.R., Gomez, B.R. and Hussain, L.A. (2022) ‘An IoT system using deep learning to classify camera trap images on the edge’, Computers, 11(1), 13. Available at: https://doi.org/10.3390/computers11010013

Luccioni, S., Jernite, Y. and Strubell, E. (2024) ‘Power hungry processing: watts driving the cost of AI deployment?’, in Proceedings of the 2024 ACM Conference on Fairness, Accountability, and Transparency. New York: ACM. Available at: https://doi.org/10.1145/3630106.3658542

Santoni de Sio, F. and Mecacci, G. (2021) ‘Four responsibility gaps with artificial intelligence: why they matter and how to address them’, Philosophy and Technology, 34(4), pp. 1057-1084. Available at: https://doi.org/10.1007/s13347-021-00450-x

Altay, S. and Gilardi, F. (2024) ‘People are skeptical of headlines labeled as AI-generated, even if true or human-made, because they assume full AI automation’, PNAS Nexus, 3(10), pgae403. Available at: https://doi.org/10.1093/pnasnexus/pgae403

AI HLEG (High-Level Expert Group on Artificial Intelligence) (2019) Ethics guidelines for trustworthy AI. Brussels: European Commission. Available at: https://digital-strategy.ec.europa.eu/en/library/ethics-guidelines-trustworthy-ai (Accessed: 6 November 2026).

Treasury Board of Canada Secretariat (2026) Guide on the use of generative artificial intelligence. Ottawa: Government of Canada. Available at: https://www.canada.ca/en/government/system/digital-government/digital-government-innovations/responsible-use-ai/generative-ai/guide-use-generative-ai.html (Accessed: 6 November 2026).

Hagendorff, T. (2024) ‘Mapping the ethics of generative AI: a comprehensive scoping review’, Minds and Machines, 34, 39. Available at: https://doi.org/10.1007/s11023-024-09694-w

Yao, Y., Duan, J., Xu, K., Cai, Y., Sun, Z. and Zhang, Y. (2024) ‘A survey on large language model (LLM) security and privacy: the good, the bad, and the ugly’, High-Confidence Computing, 100211. Available at: https://doi.org/10.1016/j.hcc.2024.100211

Lindenmayer, D. and Scheele, B. (2017) ‘Do not publish’, Science, 356(6340), pp. 800-801. Available at: https://doi.org/10.1126/science.aan1362

Carroll, S.R., Garba, I., Figueroa-Rodríguez, O.L., Holbrook, J., Lovett, R., Materechera, S. et al. (2020) ‘The CARE principles for Indigenous data governance’, Data Science Journal, 19(1). Available at: https://doi.org/10.5334/dsj-2020-043

Carlini, N., Tramèr, F., Wallace, E., Jagielski, M., Herbert-Voss, A., Lee, K. et al. (2021) ‘Extracting training data from large language models’, in Proceedings of the 30th USENIX Security Symposium. USENIX Association, pp. 2633-2650. Available at: https://www.usenix.org/conference/usenixsecurity21/presentation/carlini-extracting

Buçinca, Z., Malaya, M.B. and Gajos, K.Z. (2021) ‘To trust or to think: cognitive forcing functions can reduce overreliance on AI in AI-assisted decision-making’, Proceedings of the ACM on Human-Computer Interaction, 5(CSCW1). Available at: https://doi.org/10.1145/3449287

Lee, H.P., Sarkar, A., Tankelevitch, L., Drosos, I., Rintel, S., Banks, R. and Wilson, N. (2025) ‘The impact of generative AI on critical thinking: self-reported reductions in cognitive effort and confidence effects from a survey of knowledge workers’, in Proceedings of the 2025 CHI Conference on Human Factors in Computing Systems. New York: ACM. Available at: https://doi.org/10.1145/3706598.3713778

Bastani, H., Bastani, O., Sungu, A., Ge, H., Kabakcı, Ö. And Mariman, R. (2025) ‘Generative AI without guardrails can harm learning: evidence from high school mathematics’, Proceedings of the National Academy of Sciences, 122(26), e2422633122. Available at: https://doi.org/10.1073/pnas.2422633122

Wang, P. et al. (2024b) ‘E-waste challenges of generative artificial intelligence’, Nature Computational Science. Available at: https://doi.org/10.1038/s43588-024-00712-6

Navigli, R., Conia, S. and Ross, B. (2023) ‘Biases in large language models: origins, inventory, and discussion’, ACM Journal of Data and Information Quality, 15(2). Available at: https://doi.org/10.1145/3597307

Bianchi, F., Kalluri, P., Durmus, E., Ladhak, F., Cheng, M., Nozza, D. et al. (2023) ‘Easily accessible text-to-image generation amplifies demographic stereotypes at large scale’, in Proceedings of the 2023 ACM Conference on Fairness, Accountability, and Transparency. New York: ACM, pp. 1493-1504. Available at: https://doi.org/10.1145/3593013.3594095

Tengö, M. et al. (2014) ‘Connecting diverse knowledge systems for enhanced ecosystem governance: the multiple evidence base approach’, Ambio, 43(5), pp. 579-591. Available at: https://doi.org/10.1007/s13280-014-0501-3

Motoki, F., Pinho Neto, V. and Rodrigues, V. (2024) ‘More human than human: measuring ChatGPT political bias’, Public Choice, 198(1-2), pp. 3-23. Available at: https://doi.org/10.1007/s11127-023-01097-2

Messeri, L. and Crockett, M.J. (2024) ‘Artificial intelligence and illusions of understanding in scientific research’, Nature, 627(8002), pp. 49-58. Available at: https://doi.org/10.1038/s41586-024-07146-0

Jakesch, M., Hancock, J.T. and Naaman, M. (2023) ‘Human heuristics for AI-generated language are flawed’, Proceedings of the National Academy of Sciences. Available at: https://doi.org/10.1073/pnas.2208839120

COPE (2023) Authorship and AI tools: COPE position statement. Committee on Publication Ethics. Available at: https://publicationethics.org/guidance/cope-position/authorship-and-ai-tools (Accessed: 6 November 2026).

UKRI (2024) Use of generative artificial intelligence in application preparation and assessment. Swindon: UK Research and Innovation. Available at: https://www.ukri.org/publications/generative-artificial-intelligence-in-application-and-assessment-policy/use-of-generative-artificial-intelligence-in-application-preparation-and-assessment/ (Accessed: 6 November 2026).

European Union (2024) Regulation (EU) 2024/1689 of the European Parliament and of the Council laying down harmonised rules on artificial intelligence (Artificial Intelligence Act), Article 50. Official Journal of the European Union, L 2024/1689. Available at: https://eur-lex.europa.eu/eli/reg/2024/1689/oj (Accessed: 6 November 2026).

Zhou, Y., Muresanu, A.I., Han, Z., Paster, K., Pitis, S., Chan, H. and Ba, J. (2023) ‘Large language models are human-level prompt engineers’, in International Conference on Learning Representations (ICLR 2023). Available at: https://iclr.cc/virtual/2023/poster/10850

Liu, P., Yuan, W., Fu, J., Jiang, Z., Hayashi, H. and Neubig, G. (2023) ‘Pre-train, prompt, and predict: a systematic survey of prompting methods in natural language processing’, ACM Computing Surveys, 55(9). Available at: https://doi.org/10.1145/3560815

Zhang, M., Press, O., Merrill, W., Liu, A. and Smith, N.A. (2024) ‘How language model hallucinations can snowball’, in Proceedings of the 41st International Conference on Machine Learning. PMLR 235, pp. 59670-59684. Available at: https://proceedings.mlr.press/v235/zhang24ay.html

Liu, N.F., Lin, K., Hewitt, J., Paranjape, A., Bevilacqua, M., Petroni, F. and Liang, P. (2024) ‘Lost in the middle: how language models use long contexts’, Transactions of the Association for Computational Linguistics, 12, pp. 157-173. Available at: https://doi.org/10.1162/tacl_a_00638

Carlini, N., Hayes, J., Nasr, M., Jagielski, M., Sehwag, V., Tramèr, F. et al. (2023) ‘Extracting training data from diffusion models’, in Proceedings of the 32nd USENIX Security Symposium. USENIX Association. Available at: https://www.usenix.org/conference/usenixsecurity23/presentation/carlini

Hendrycks, D. and Gimpel, K. (2017) ‘A baseline for detecting misclassified and out-of-distribution examples in neural networks’, in International Conference on Learning Representations (ICLR 2017). Available at: https://arxiv.org/abs/1610.02136