When AI Does The Work, Who Owns The Decision?

AI in Risk & Compliance — Part 2: GOVERN — Enable Innovation Without Surrendering Accountability

In my last post, I discussed the importance of prioritizing AI investments based on the value they create—not simply the speed or volume of adoption.

But identifying where AI can create value is only the beginning.

The next challenge is determining how to govern its use without creating so many barriers—and so much bureaucracy—that the benefits of the technology are lost.

The question isn't whether AI needs governance. It's whether your governance is proportionate and tailored to the decisions you're allowing AI to make. Your organization's Risk Appetite should define the boundaries within which AI operates—not simply the restrictions placed upon it.

Not every AI use case creates the same level of risk. Consider the difference between using AI to summarize regulatory publications, recommend whether a regulatory change applies, and autonomously making that determination and closing the record.

The technology may be similar, but the risks—and corresponding governance—are very different.

When thinking about governing AI, consider three things:

1. ACCOUNTABILITY — Who owns the outcome?
It depends. Defining accountability up front is key to governing effectively and adopting AI responsibly.

Is the AI proprietary or operated by a third party? Are there clear lines of responsibility and handoffs between IT, Model Risk, and Third-Party Risk? Between Compliance and the business?

Remember: We cannot outsource accountability for our regulatory obligations and outcomes. Being able to retrace our steps and demonstrate how risks were managed is critical.

2. AUTHORITY — What is AI permitted to do?
Is AI providing information, recommending a decision, making a decision, or independently executing an action?

The level of human oversight should reflect the materiality of the potential consequences—not simply whether AI is involved.

Your organization's AI policies, ethics and conduct standards, and use-case-specific procedures should clearly articulate decision-making authority, permitted activities, and employee expectations.

3. ASSURANCE — How do we know it's working?
What processes are in place to validate the reliability of AI outputs, identify errors, monitor performance, and intervene when results fall outside tolerance?

Can you trace material decisions back to the information, logic, and actions that informed them?

Human oversight is only meaningful if people understand the technology's limitations and have the ability to challenge its outputs.

If we apply the same level of governance to every AI application, we risk creating the very inefficiencies we're trying to eliminate. And if we don't establish clear accountability and oversight, we risk undermining the effectiveness of our programs.

Good governance should enable responsible innovation—not stand in its way.

Next up: OPTIMIZE — Are we measuring adoption or better risk management?