The use of artificial intelligence (AI) is changing the way companies make decisions. Priority is given to fraud alerts. Transactions are flagged. Applications are assessed, and a score is assigned to customer behaviour. Decisions affecting people, money and access are increasingly influenced by technology. The apparent efficiency argument is compelling. However, the question of accountability is less settled. When an AI-supported decision causes financial loss, customer harm or regulatory exposure, who bears the consequences?

IN THE first of a three-part series that addresses accountability, controls and board oversight as they relate to AI, we start with:

The accountability gap

Respectfully, the writer believes the answer cannot be an algorithm. It is common for AI implementation to distribute responsibility across several functions. The system may be implemented using technology. The business uses it. Risk provides a challenge. Compliance considers regulatory exposure. Internal audit provides independent assurance. Even external providers may control the underlying model. Everyone may have responsibility, but accountability remains difficult to identify. This is becoming increasingly difficult to defend.

In July 2024, the US National Institute of Standards and Technology published its Generative AI Profile to supplement its Artificial Intelligence Risk Management Framework. The guidance identifies risks specific to generative AI and provides actions companies can consider across the AI life cycle. Its underlying message is relevant beyond generative AI: Trustworthiness must be managed deliberately rather than assumed.

Start with the decision

Boards and executives should therefore begin somewhere else. Do not start by asking what the technology can do. Start with the decision it will influence. What is the business purpose? What happens if the system is wrong? How much authority are we delegating? Who can challenge the output? When must a human intervene? The answers to these questions should determine the level of governance. An AI tool summarising an internal document does not create the same exposure as one that influences fraud detection, credit, recruitment, insurance or access to financial services. Governance should be designed for the risks involved.

Professional judgement can also be affected. AI may identify patterns faster than humans, and process volumes of information no individual could reasonably assess. Professionals must still determine when to rely on an output, when additional investigation is required and when human judgement should prevail.

Accountability before scale

In 2025, the Institute of Internal Auditors reiterated this point. Among other recommendations, it suggests maintaining a living inventory of AI systems, models and embedded tools, as well as examining governance roles, escalation paths and decision rights. As a result, companies have a practical starting point. Identify material AI systems. Establish accountable business owners. Document their decision authorisation. Determine monitoring requirements. Establish the escalation procedures. Include third-party AI.

It is extremely important to emphasise that outsourcing technology does not transfer responsibility for its consequences.

In short, AI creates a governance paradox. As machines gain increased influence over company decisions, human accountability should become clearer, not weaker. AI's potential is no longer the defining question. Instead, we must ask what we are prepared to let it influence, and who will answer when the outcome is wrong. While judgment can be supported by technology, it cannot absorb accountability.

• NB: About Derek Smith Jr

Derek Smith Jr has been a governance, risk and compliance professional for more than 20 years with a leadership, innovation and mentorship record. He is the author of ‘The Compliance Blueprint’. Mr Smith is a certified anti-money laundering specialist (CAMS) and holds multiple governance credentials. He can be contacted at hello@pineapplebusinessconsultancy.com