Who Gave AI the Authority?

Organisations are increasingly investing in AI, experimenting with its potential or considering how it might be used within the enterprise.

The business case can be compelling.

AI can increase capacity. Automate routine work. Analyse information at extraordinary speed. Support better decisions. Create entirely new ways of working.

What is not to love?

Done well, AI can create significant value for a business.

Investors may even be reaching for the champagne.

There is another side to this, though, that deserves considerably more attention.

AI is still widely thought about as technology. A tool. Something organisations adopt, implement and integrate. Something, perhaps rather conveniently, that naturally sits within the remit of IT or technology.

Yet as its role inside an organisation expands, something much more fundamental can begin to change.

AI can analyse.

It can recommend.

It can decide.

It can act.

Read that again. Slowly.

Once AI is given permission to act on its own, we are no longer simply talking about technology. We are talking about authority — and that should concern every board.

Capability is not the same as authority

Organisations have always been rather particular about delegated authority.

We decide who can approve expenditure. Who can sign a contract. Who can access sensitive data. Who can hire somebody. Who can make decisions that carry financial, legal, operational, customer or employee consequences.

We set authority levels and approval thresholds. We put controls around them. We monitor, review and audit them.

Underpinning these decisions is another judgement organisations make all the time: what is our risk appetite?

Yet AI has the potential to enter an organisation under the guise of a technology tool and gently morph into something considerably more significant.

That creates a significant contradiction.

We have not stopped caring about delegated authority or risk appetite. We may simply have failed to recognise that AI belongs within the same conversation.

Once AI moves beyond analysing and recommending, and we give it permission to decide and act on its own, we have, by definition, delegated authority.

Potentially, we have also introduced a different order of risk. AI can exercise that authority at speed, repeatedly and at a scale considerably greater than we are accustomed to when delegating authority to an individual. Some of the consequences may be foreseeable. Others may be considerably harder to anticipate.

The question is whether we are governing that delegation with the same care we would expect anywhere else in the organisation.

Delegation can become dependence

Giving AI authority is one decision. Becoming dependent on it may be another. The second decision may never consciously be made.

Sometimes authority moves gradually. A system begins by supporting work. It makes something faster, easier and more effective. People use it. They trust it. Human verification reduces. More processes begin to rely on it.

Gradually, what began as assistance can become delegation. Delegation can become dependence.

That is not the only route.

An organisation may give AI significant authority from the outset. It may introduce a system capable of making decisions or taking actions across a process without ever really considering the implementation as a delegation of authority.

In either case, the result can be the same. AI is no longer simply supporting how the organisation works. Parts of the organisation may now depend on it to work.

The organisation may never consciously decide to become dependent on AI. It may simply discover that it has.

When error can scale as quickly as value

The same characteristics that make AI commercially powerful can also change the consequences when something goes wrong.

Speed matters. Scale matters. The ability to act matters.

AI can work from poor data, follow a flawed assumption, apply an inappropriate rule, miss important context or replicate bias already embedded in a process.

None of that requires AI to become conscious, malicious or behave in some extraordinary way.

It can simply be wrong.

Humans make mistakes too. The difference is that an AI system with delegated authority may be able to repeat or act on an error at a speed and scale that a human cannot. The consequences can be disastrous.

One poor decision can be repeated thousands of times. One inaccurate communication can reach an entire client or customer base. One flawed assumption can be applied repeatedly across a process before anybody realises anything is wrong.

Automation does not make a badly designed process a good one. It can simply allow that badly designed process to operate much faster.

The same capability that allows AI to scale value can also scale error.

The consequences may be financial, operational, regulatory or reputational. They may affect clients, customers or employees. In some circumstances, they may threaten something considerably more fundamental: the organisation itself.

The governance question is therefore not simply whether AI can make mistakes. It is whether the organisation understands what should happen when a system with delegated authority gets something wrong, how quickly it should know, and whether it can intervene before the consequences scale.

The board does not need to govern every use

The potential consequences of AI do not mean that every use of it suddenly becomes a matter for the board.

An employee using AI to summarise a meeting does not require board oversight. Neither does every experiment, workflow or low-risk application of the technology.

Trying to govern AI at that level would not only be impractical, it could undermine much of the value organisations are trying to create.

The board’s role is different.

It needs confidence that the organisation has a system for determining where AI can be used, what authority it can be given, where human judgement remains necessary and when the potential consequences become sufficiently material to require board attention.

That threshold will not be the same for every organisation or every use of AI.

Authority matters. So do consequence, scale, uncertainty, reversibility, regulatory exposure, data sensitivity and strategic significance. All may change the level of oversight required.

There is no perfect governance model that can simply be lifted from one organisation and dropped into another.

A business using AI to support relatively contained, low-risk activity is not in the same position as one allowing AI to make consequential decisions, execute actions across critical workflows or operate at significant scale.

Governance has to reflect the organisation, the use of AI, the authority being delegated and the consequences involved.

So perhaps a more useful place for a board to begin is with a set of questions.

Where is AI being used across the organisation?

Are we confident we actually know?

What work and workflows is it changing?

What information and data is it being given access to?

What decisions is it influencing?

What decisions is it making?

What actions is it authorised to take?

Where has authority been delegated, and is that delegation still within our risk appetite?

Where does human judgement remain — and is it genuine judgement rather than ceremonial approval?

Who is accountable for the decisions and consequences?

Where have we become dependent on AI to operate?

What happens if that capability fails, disappears, changes or has to be switched off?

Are our controls actually working?

What errors, exceptions, overrides or near misses are we seeing?

Can we identify and intervene quickly enough if something starts going wrong at scale?

Do we have the capability and expertise to challenge what we are being told?

What should reach the board, how often, and who is responsible for bringing it there?

Is AI actually creating the value we expected it to create?

One question is worth returning to more than any other:

What has changed?

That question matters because governance cannot be static.

AI will evolve. Its capabilities will expand. Models, vendors, integrations, regulation and workflows will change. The organisation will change too.

Something that begins as an experiment may become embedded in how the organisation operates. A recommendation can become a decision. A decision can acquire permission to act. A useful capability can become an operational dependency.

Governance that was appropriate when AI was first introduced may no longer be appropriate as its role, authority and importance within the organisation change.

What might that mean in practice?

There is unlikely to be one governance model that works for every organisation. Nor should there be.

What matters is whether the governance reflects what AI is actually doing inside the organisation, the authority it has been given, the work it is changing, the dependencies being created and the consequences if something goes wrong.

That requires more than an AI policy or a set of principles. It requires AI to become part of how the organisation itself is governed.

In practice, that means considering AI across a number of interconnected areas of the organisation.

Strategy and value. AI should connect to what the organisation is trying to achieve and how it creates value. That means understanding not simply where AI is being deployed, but what it is expected to change: capacity, cost, service, decision-making, client or customer experience, operating model or potentially the economics of the business itself. The board should be able to see whether that value is actually being realised and whether the consequences of achieving it remain acceptable. If AI becomes strategically material, it should be governed as part of the strategy, not periodically reported as a technology initiative. Good governance should also enable the organisation to move with confidence where AI can create advantage. Moving too slowly carries consequences too, particularly where competitors are learning, adapting and changing their economics faster. Where AI becomes material to growth, margins, competitive advantage or the organisation’s ability to execute its strategy, the board should also understand how much of the business — and potentially the investment case — has become dependent upon that capability.

Authority and decision rights. Decide deliberately what authority AI should have. What may it analyse? What may it recommend? What may it decide? What may it act upon without further approval? Those boundaries should not emerge accidentally from implementation. They should be explicit, understood and capable of being changed. That includes deciding who has the authority to extend, restrict or withdraw AI’s authority and what circumstances should trigger that decision. Greater autonomy should not automatically be treated as the destination. In some areas, recommendation may be precisely where AI’s authority should end.

Work, workflows and human judgement. Before automating work, understand the work. Map the process, its decisions, hand-offs, dependencies, controls and known weaknesses. Otherwise AI may simply allow a badly designed process to operate faster and at greater scale. Then decide where human judgement genuinely adds value. Having a human somewhere in the workflow is not the same as retaining human judgement. If somebody routinely approves an AI-generated decision without the information, capability or authority to challenge it, the organisation may have retained human involvement while effectively removing human judgement.

Accountability. AI is unlikely to respect the boundaries of the organisational chart. A single use may involve technology, operations, data, risk, legal, finance, commercial, People and other functions. Responsibility therefore needs to follow the decisions, work and consequences involved. Different executives may own different aspects of AI across the enterprise; that is different from making one executive the organisation’s convenient ‘AI owner’. Expertise can be distributed. Accountability must remain clear, and the board’s collective accountability does not disappear because specialist expertise sits elsewhere.

Risk and controls. AI should form part of the organisation’s existing risk architecture, with risks assessed in the context of the organisation’s appetite, the authority being delegated and the potential consequences. That means more than adding ‘AI risk’ to a register. Controls should exist around material uses, and their effectiveness should be visible. The organisation should know what it is measuring: output quality, errors, exceptions, overrides, control failures, incidents and near misses may all tell the board something different about how AI is actually operating. A control that exists on paper but is not monitored or tested is not much of a control.

Business continuity and resilience. Where AI becomes part of a critical process, dependency becomes a governance issue. Ask what happens if the capability fails, becomes unavailable, changes unexpectedly, produces unreliable output or has to be suspended. How far could the impact travel before it is contained? Can the organisation continue operating? Is there an alternative process? Does sufficient human capability remain? Resilience should be designed while the capability is working, not discovered when it stops.

Data and access. Authority is not only about what AI is permitted to decide or do. It is also about what it is permitted to know. Understand what information AI can access, why it needs that access, how the information is being used and what exposure follows from it. Access should change when the purpose or authority changes. The fact that a system technically can access information is not, by itself, a reason that it should.

Third-party dependency. Much of the capability an organisation uses may sit outside the organisation itself. Understand what happens if a provider changes its model, functionality, terms, availability or approach to data. Consider what the organisation can control, what it cannot, and where critical operations have become dependent on decisions made by a third party. Supplier due diligence matters, but so does understanding the operational consequence of that supplier changing beneath you.

Board capability and expertise. Directors do not need to become AI engineers. They do need enough understanding to ask intelligent questions, recognise when authority or risk has materially changed and challenge the assurance they are receiving. That capability should not reside in one technically knowledgeable director while everybody else politely listens. Where the board does not have sufficient expertise, it should know when to bring it in.

Board visibility. AI should have an appropriate and regular place on the board agenda. That does not mean reviewing every experiment or use case. It means agreeing what the board needs to see, how frequently it needs to see it and what should trigger escalation between those reviews. Material changes in authority, dependency, risk, performance, incidents, controls and value should not have to wait for an annual technology update. Different executives may bring different parts of that picture, but somebody needs to ensure the board can see the whole.

Incident response and intervention. Decide what happens before something goes wrong. How will the organisation know? Who investigates? Who assesses the potential scale of the impact? Who can intervene? Who has authority to restrict or stop the system? How will affected clients, customers, employees or other stakeholders be dealt with where necessary? Who decides that the system is safe to resume? The ability to delegate authority should be matched by the ability to take it back.

Review and assurance. Governance cannot end when a framework, policy or control set is approved. AI will change, and so will the organisation around it. Review whether delegated authority remains appropriate, whether controls are working, whether human judgement remains meaningful, whether dependencies have increased and whether the expected value is being realised. Look at incidents, errors, exceptions, overrides and near misses not simply as failures to record, but as information about how the system is behaving. Independent assurance may sometimes be appropriate. At other times, existing internal assurance may be enough.

More importantly, keep asking what has changed.

A governance model can be perfectly sensible on the day it is designed and inadequate six months later. The purpose of continuous review is not to create more governance for its own sake. It is to notice when AI’s position inside the organisation has changed before the organisation discovers that change through failure.

The precise answer will be different for every organisation.

It should be.

The objective is not to create the largest possible AI governance apparatus. It is to build governance proportionate to what AI is actually doing inside the enterprise and the consequences that follow from it.

So where do you start?

That depends on where you are.

If AI is already embedded in the organisation and there is no meaningful governance framework around it, get on with it now.

Establish a baseline. Find out where AI is being used, what it is doing, what it can access, what authority it has, where human judgement sits, where dependencies have developed and what controls already exist.

You may discover that the organisation you are governing is not quite the organisation you thought you were governing.

Build from there.

If AI is being implemented now, build the governance alongside it.

Do not wait until implementation is complete and then attempt to wrap governance around decisions that have already been made. Think about authority, work design, human judgement, accountability, risk, controls, resilience and board visibility as part of implementation itself.

If AI is still being considered, make governance part of the roadmap from the beginning.

Decide how you will govern authority while you are deciding where AI can create value. Think about the work, risk, accountability and oversight before the organisation becomes dependent upon something it never consciously decided to depend upon.

Other organisations have already done some of the learning.

Use it.

Governance does not need to slow AI down.

Done properly, it should give an organisation greater confidence about where it can move quickly, where it should proceed carefully and where it should not delegate authority at all.

The objective is not maximum governance.

It is appropriate governance.

AI can create extraordinary value. That is precisely why organisations will continue giving it more capability, more access and, in some cases, more authority.

AI does not decide how much authority it has.

We do.

The board’s responsibility is to make sure the governance keeps pace with that authority.