An organisation may have an AI policy, a risk committee and a director responsible for artificial intelligence. The practical test is whether those arrangements can control what its AI systems actually do.

Research commissioned by IBM highlights the challenge. Among 3,221 senior executives surveyed at large organisations across eight European and Middle Eastern countries, 80% reported that an AI-related incident had reached their board or senior leadership in the previous year. Only 40% of those organisations reported changing their AI governance policies or frameworks in response. Just 37% said their governance was designed to scale with autonomous AI agents. These are reported survey findings, rather than an independent audit of organisational controls.

The findings raise a management question: how does responsibility in the boardroom become effective command during everyday operations?

From policy to action

A policy might state that AI must protect confidential information, operate within agreed limits and refer important decisions to a human. Each requirement needs a practical mechanism.

Who checks whether information can be shared? What prevents an agent from exceeding its authority? Who receives an alert, and can that person stop the activity before harm occurs?

These questions become more pressing when AI can use tools, access records and initiate actions across connected systems.

Connecting governance to operational control

The Four-Layer Assurance framework described in Orchestration and Command in the Age of AI offers a structure for addressing this gap.

The working AI performs the task. An independent checking AI examines its work. A Runtime Assurance Controller enforces operational boundaries and can pause, flag or reroute activity. Human Command provides direction, judgement and authority.

Each layer has a distinct responsibility. Its effectiveness depends on implementation, testing and the suitability of its controls for the task.

Give people the means to command

Naming a responsible person is only the beginning. That person needs sufficient understanding, timely information and the authority to intervene.

Records should show what the system did and what people authorised, changed or overrode. Human decisions matter: who approved deployment, set the limits, accepted a warning or permitted work to continue?

Training and practice also matter. Someone who rarely intervenes may struggle when an unfamiliar failure demands a rapid decision.

Make responsibility operational

Boards should ask managers to demonstrate how their AI policies work in practice. Can an unauthorised action be blocked? Can a warning reach someone able to respond? Can activity be stopped, and can the organisation reconstruct what happened?

Effective governance connects responsibility to observable actions, enforceable limits and capable human command.

For a practical framework connecting organisational AI governance to independent checking, runtime controls and human command, explore Orchestration and Command in the Age of AI.

Source

For further information: ai-humancapability.com