Accountability, Decision Rights, and Independent Challenge

Accountability means a named person or body has authority and responsibility for a decision, can obtain evidence, and faces consequences for failing to act. Responsibility can be distributed. Final approval, challenge, operation and remedy should not. Ambiguity collects at one point in particular: the moment a release is finally approved. Several functions contributed, and afterwards nobody can say who cleared it.

A practical model separates three things. The first line owns and operates the risk. The second line sets frameworks and challenges decisions. The third line provides independent assurance. The structure should fit the company it sits in rather than copy a diagram mechanically.

This is no longer only good practice. It is law. The EU AI Act puts the same demand on deployers of high-risk systems, and it applies from 2 August 2026. Oversight has to be assigned to named natural persons (Article 26(2)). Use has to be suspended when the system may present a risk (Article 26(5)). An explanation is owed to the person the decision fell on (Article 86(1)). The rest of this lesson is largely those three paragraphs, and what other regulators and standards bodies found when they tested them.

Business owner, technical owner, independent challenge, approval authority, remedy owner. Five roles, and a review has to be able to name a person in each. That requirement is not this lesson's invention. Article 26(2) of the EU AI Act states it: “Deployers shall assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.”

Read the four attributes slowly, because a governance chart usually carries none of them. Competence: the reviewer must understand what they are reviewing. Training: someone has to have supplied that understanding. Authority: the reviewer must be able to act on what they find. Support: the organisation has to carry the reviewer when they do. A box on a diagram asserts a role. The statute asks what stands behind the box.

The fifth box has a claimant behind it. A person the decision fell on can demand clear and meaningful explanations, and can demand them from the deployer. The system has to be a listed high-risk one, and the decision has to be taken on its output. That is Article 86(1). The remedy owner is answering a legal claim, not running a courtesy service.

A RACI label says who is consulted. A decision-rights design says who may block. Committee consensus says nobody in particular.

The strongest form of a decision-rights design is filed with a regulator and enforceable against a person. In the UK, an application to perform a designated senior management function must be accompanied by a statement of responsibilities. That is section 60(2A)–(2B) of the Financial Services and Markets Act 2000. Section 66A of the same Act, in force from 7 March 2016, then attaches consequences to that map. Under condition C in section 66A(5), a senior manager is personally guilty of misconduct where the firm contravened a relevant requirement in an area they were responsible for managing and “the senior manager did not take such steps as a person in the senior manager's position could reasonably be expected to take to avoid the contravention occurring (or continuing).” That duty-of-responsibility limb, section 66A(5)(d), arrived on 10 May 2016 with the Bank of England and Financial Services Act 2016. The same Act repealed the original reverse burden of proof. FCA guidance then sets the standard: the steps a competent SMF manager would have taken, at that time, in that specific individual's position, with that individual's role and responsibilities, and in all the circumstances. That is what separates a label from a design. The label records who was consulted. The design records whose name is on the contravention.

The diffusion of responsibility that committee consensus invites is not a metaphor either. It has a measured size. Fischer and colleagues pooled the bystander literature in Psychological Bulletin in 2011, and the abstract reports: “In a fixed effects model, data from over 7,700 participants and 105 independent effect sizes revealed an overall effect size of g = -0.35.” People help less when other people are present. That is how much less.

The same meta-analysis reports when the effect weakens: when the situation is perceived as dangerous, when a perpetrator is present, and when the costs of intervening are physical. That qualifier is the design brief for a governance forum. Make the danger explicit with a risk tier. Give the cost of not acting to a named approver.

A lending model passes every review meeting because product, legal, risk and data science each assume another function owns the final decision. Then the complaints arrive. Every team can describe its input, and none accepts accountability.

AI used to evaluate creditworthiness or set a credit score is high-risk under the EU AI Act (Annex III, point 5(b)). So the appeal that dies at the support desk is not a goodwill matter. Article 86(1), “Right to explanation of individual decision-making”, provides: “Any affected person subject to a decision which is taken by the deployer on the basis of the output from a high-risk AI system listed in Annex III, with the exception of systems listed under point 2 thereof, and which produces legal effects or similarly significantly affects that person in a way that they consider to have an adverse impact on their health, safety or fundamental rights shall have the right to obtain from the deployer clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken.” The right runs against the deployer. Routing it to a desk with no authority over the source policy does not answer it. It parks a legal obligation with the one function in the chain that cannot discharge it.

Step five is the one that matters. Run the whole review again under a deadline, with an executive sponsor in the room and the evidence still uncertain.

Steps 1 and 2 already have a published description of what finishing them looks like. The AI RMF offers both as outcomes rather than requirements. GOVERN 2.1: roles, responsibilities and lines of communication for mapping, measuring and managing AI risks are documented and clear throughout the organization. GOVERN 2.3: executive leadership takes responsibility for decisions about risks associated with AI system development and deployment. Both sit in a voluntary framework. That is precisely why the same document warns that using it alone will not produce the accountability mechanisms or the incentive structures.

Step 5 supplies the missing test. It asks whether the documented clarity of step 1 and the executive responsibility of step 2 survive a room with a launch date in it.

Accountability is real only where a named person can stop a release and still have a job the following week.

One legislature has made the stopping mandatory. Article 26(5) of the EU AI Act provides: “Where deployers have reason to consider that the use of the high-risk AI system in accordance with the instructions may result in that AI system presenting a risk within the meaning of Article 79(1), they shall, without undue delay, inform the provider or distributor and the relevant market surveillance authority, and shall suspend the use of that system.” Three hinges are worth reading twice. The trigger is reason to consider, not proof. The deadline is without undue delay, not the next scheduled committee. The duty falls on the deployer, which through Article 26(2) means the natural persons it has assigned.

UK financial regulation makes the mirror-image point. Failing to take the steps a person in that position could reasonably be expected to take is the individual's misconduct, not the committee's. That is section 66A(5) of the Financial Services and Markets Act 2000.

Define when accountability and decision rights requires the board to redesign, restrict, remedy, or retire the system.