Skip to main content
How Can We Help?Contact

If it is wrong, who owns the decision?

Every AI decision needs a name, a review and a record.

AI governance usually starts as a policy. We turn it into what people and systems are actually permitted to do: a named owner for each AI decision, a review sized to its risk, and a record that a board, an auditor or a regulator can read.

Discuss your AI governance Explore the Governance Quickstart

Asked by boards, risk and legal teams, and CIOs.

An illustrative maturity funnel: nine AI uses.

Covered by the AI policy

9

A named owner

5

Reviewed against criteria before launch

3

A record a regulator could read

2

7 with no record

The policy covers every use. Two could show who owned the decision, what it was checked against and which risks were accepted.

9 covered. 2 evidenced.

Not every AI use needs a committee. Every one needs an owner.

Review should match the risk. Describe one AI use. See an illustrative review path, the people who should be involved and the evidence worth keeping. A spellchecker and a credit decision should not go through the same door.

An illustrative review path

Standard review

Standard, because people outside see what it produces and it uses personal or sensitive data.

Owner
The business owner.
People involved
Risk, security or data reviewers, as the use requires.
Evidence worth keeping
Documented tests, the oversight design and the thresholds being monitored.
Reopens when
A threshold is breached, an incident occurs, or the model changes.

A starting recommendation, not clearance to deploy. Legal requirements, contracts and sector rules can override it.

Describe one AI use

The example is a customer-service assistant that drafts replies an agent sends. Change what is true.

The review it calls forStandard review

Illustrative, not legal advice. Any one of the last three facts calls for a full review on its own. Nothing you set here leaves this page.

Four decisions before it goes live.

Every AI use passes through the same four, sized to its risk. Any one of them can hold the launch, and the last one decides when the question opens again.

  1. Owner

    Who is accountable when it is wrong?

    The three questions behind it
    A named owner
    A person in the business, not the vendor and not the data team.
    Decision rights
    What the system may decide alone, what it recommends, and what a person signs.
    Escalation
    Who is called, and how fast, when it fails.

    Go on when one person’s name sits beside the decision.

  2. Tier

    How much oversight does it need?

    The three questions behind it
    Risk tier
    Sized by what it decides, who it touches and whether it can act.
    Proportionate controls
    Light where little can go wrong, full review where someone can be harmed.
    Obligations
    The laws, contracts and standards that apply to this use.

    Go on when the tier is agreed and written down.

  3. Review

    Who approves it, and on what evidence?

    The three questions behind it
    Criteria
    Accuracy, fairness, security and data use, tested before launch.
    Reviewers
    Risk, legal, security or data: the ones the tier calls for.
    Human oversight
    Where a person can see, stop or overturn what it does.

    Launch when the reviewers sign against the criteria, not before.

  4. Record

    What would a board or a regulator read?

    The three questions behind it
    Decision record
    The owner, the evidence, the risks accepted and who signed.
    Monitoring
    The thresholds that trigger a second look.
    What reopens it
    A model change, drift, an incident or a new rule.

    Reopen on the triggers, not when someone happens to remember.

For each AI use, the board’s question is narrower than whether AI is allowed: is this one approved, on what terms, and by whom?

Approve
The owner is named, the review fits the risk, and the evidence would satisfy a board or a regulator.
Constrain
It goes ahead inside limits: a narrower scope, a person checking each output, or a date to look again.
Defer
The owner, the review or the record is missing. It waits until they exist.

When responsibility is split across technology, legal, risk and the business, each tends to assume another signed. The approval names one person.

Where does one of your AI uses stand? Bring it to us. We will show you who owns it, and the review it needs.

Book 30 minutes on your AI governance

Safeguards built into the work, and what they moved.

Each result is labelled. An operating result is a change in the work, as the client reported it. An implemented control is a safeguard built into the system or the process.

A US state government, public health records

Only approved issuers could write the record, and anyone authorized could check it in seconds.

  • 98%of recorded events validated on the first attemptOperating result
  • 42%fewer manual “is this real?” checks at verification pointsOperating result
  • Secondsto verify the issuer, the time and the event, without seeing medical detailsOperating result

Paper proof was easy to lose or fake. Only approved state health and partner entities could write to the record, every write was time-stamped and attributable, and verifiers saw who issued it and when, not the record itself. The governance was built into the record, not written in a policy beside it.

Read the case study
By function: the decision worth governing first
FunctionDelivered resultKind
Compliance and commercialWho decides what the assistant may say?Answers limited to approved labels and inserts, audience-specific rules on every response, and a record of each interaction, for a life-sciences data and communications providerImplemented control
Resident servicesWho owns what the assistant says?Content owners update the answers without code, and questions it cannot answer go to a person with their context, for a major city’s 311 serviceImplemented control

Start where you are.

Two gaps bring most people here. Oversight: nobody can say who approved it. Technical exposure: nobody can say what it can reach. Each has its own way in.

  1. “AI is already in use, and nobody can say who signed off.”

    For an oversight gap

    AI Governance Quickstart

    • A named review path: who reviews an AI use, against what, and how long it takes
    • A decision log, kept where an auditor can find it
    • A policy drafted for sign-off, in your organization’s voice
    • One real use case cleared through the path

    Two to four weeks. Fixed scope, fixed fee agreed in writing first.

    Scope the Quickstart Explore the Governance Quickstart

  2. “We have AI agents and tools reaching our systems, and cannot say with confidence what they can see, change or execute.”

    For a technical exposure gap

    Cyber Risk Sprint

    What your AI and agents can see, change or execute, ranked by consequence, with an owner on every line. It finds the technical exposure; the Quickstart sets who oversees it.

    Two to four weeks. Penetration testing and remediation are not included.

    Scope the Cyber Risk Sprint Explore the Cyber Risk Sprint

  3. “We need the whole operating model: tiers, councils, policies and monitoring.”

    Strategy & Governance Program

    Governance with named owners, tiers and a record, built with the people who have to run it, alongside the strategy it serves.

    Explore the Strategy & Governance Program

  4. “It is running, and the reviews keep falling behind.”

    Governance in operation

    We keep the review cadence, the records and the policy current as your uses and obligations change.

    Ask about ongoing governance

The practices behind this page: Strategy & Governance, AI Security & Cyber Risk, AI & Data Literacy and Data Engineering & Platforms.

Questions boards and risk teams ask first.

Do we need a governance program before our first AI system?

No. You need an owner, a tier and a record for that system. The program grows as the uses do. The Governance Quickstart proves the review path on one real use case before anything bigger is built.

What will a board, an auditor or a regulator ask for?

Who owned the decision, what evidence supported it, which risks were accepted, who reviewed it and against what, and what would reopen it. A record that answers those five answers most of the questions that follow.

Which frameworks do you use?

The NIST AI Risk Management Framework and ISO/IEC 42001 as the structure where they apply, sized to your organization rather than lifted whole.

Will this make us compliant with AI law?

No page can promise that, and we will not. We map the obligations that apply to each use, then build the review path and the record around them. Our guides to the EU AI Act and to Illinois AI law explain what those laws ask.

Will this slow AI work down?

It replaces an undefined review with a defined one. Low-risk uses get a light review, and the full review is kept for uses that can cause serious harm. Work waiting on an answer nobody could give gets an answer with a date on it.

Next: question 3 of 5, Pilot to ProductionWhy did the pilot work but production did not?All five questions

Bring us one AI decision. We’ll show you who owns it.

Thirty minutes with the person who would lead the work: a senior AI and data strategist who has taken programs from strategy to systems running in production, in more than one industry. If all it needs is a name and a one-page record, not a committee, we will say so.

Book 30 minutes on your AI governance

Not sure who owns it? Thirty minutes on one AI decision, with the person who would lead the work.

Discuss your AI governance