Who Actually Owns AI Decisions in the Enterprise?

Executive Summary

An AI tool is approved to recommend customer refunds. Months later, an update allows it to issue refunds automatically. The software still belongs to the same technology portfolio, but the enterprise now faces a different exposure: a system can initiate transactions affecting customers and company funds.

Who approved that change? Was the decision within the authority delegated by management? Who can suspend the capability if it behaves outside the agreed limits?

This is a hypothetical scenario, yet the governance problem extends well beyond automated refunds. AI is being introduced into decisions involving customers, employees, spending and operations. When authority is unclear, the enterprise may be unable to explain how a consequential action was permitted, even if the system performed exactly as configured.

Context

A CIO may own an AI platform, its reliability and its technical controls. A business leader may be accountable for the customer or operating process it supports. Finance may oversee spending, while risk and legal specialists challenge exposure. None of those roles automatically confers authority to approve every action the system can perform.

An AI committee is useful only if its mandate defines what it may decide, what remains with executives and what must be escalated. Assigning a committee name is not evidence that a particular decision was properly authorized.

This distinction matters most when a capability crosses functional boundaries. A central platform can support several business units, each with different outcomes and risks. The approval route must therefore be attached to the material use and its consequences, rather than assumed from ownership of the shared system.

Thesis

Decision authority must follow the business consequence of an AI action, not the team that owns the technology.

Structured Analysis

What the board, CEO and CIO must each establish

For the Board Chair, the question is whether management operates within an approved mandate. Subject to applicable law and the organization's governing arrangements, the board or designated body defines risk appetite, material investment boundaries, reserved matters and oversight expectations. Directors should challenge consequential AI exposure and the evidence behind it, without approving every routine technical change.

For the CEO, the priority is workable delegation. Executive leadership must identify which roles can authorize each class of AI use, what financial or risk thresholds limit that power, and how unresolved cross-functional decisions reach the appropriate forum. The CEO should be able to show who owns the decision when business and technology interests differ.

For the CIO, the requirement is enforceability. Approved limits must translate into system permissions, monitoring and intervention mechanisms. An AI service authorized only to recommend an action should not be configured to execute it. Technology teams must be able to show whether the system's actual capabilities match the approval recorded by management.

Business executives remain answerable for the outcomes of the processes they control. Finance challenges the economic case; risk, compliance and legal teams provide relevant scrutiny; internal audit may provide independent assurance without taking operational ownership. These roles should reinforce the decision route, not obscure it.

When does an AI use need another decision?

An authorization to test a recommendation tool is not automatically permission for a wider rollout, higher transaction limits or independent action. New data access, integrations, users or agent permissions can materially change exposure without changing the project's name.

Management should set review triggers that reflect financial consequences, customer or employee effects, legal sensitivity, operational dependency and the degree of autonomy granted. A change within approved limits may remain with the delegated executive. A reserved matter or material threshold breach must reach the designated decision authority. The appropriate thresholds depend on the organization and jurisdiction; they are not universal legal rules.

In the refund example, enabling direct transactions would require an authorized decision on transaction limits, exceptions needing human approval, monitoring and the ability to suspend the capability. The business leader can propose the operating change. Risk can challenge the exposure. Technology implements the approved boundaries. The designated authority makes the decision.

Intervention also needs a real operating route. A technical operator may have pre-authorized rights to suspend activity when a defined trigger occurs, with the action recorded and escalated. Restarting, extending a suspension or retiring the use should follow the separately assigned decision authority. An emergency stop is not permission for an automatic restart.

Make the decision traceable

Through the 6xD Digital Cognitive Organization perspective, AI decision-making belongs to the enterprise processes it changes. The governance implication is practical: organizational authority must be translated into enforceable technical permissions. The supporting Digital Transformation 2.0 perspective links changes in authority to investment and performance review.

For each material AI use, management should maintain a reviewable record of the approving authority, its delegated basis, the permissions and limits granted, the evidence supporting approval, escalation triggers and intervention rights. It should also name the investment sponsor and business outcome owner, with an agreed target and review date. These are three connected accountabilities within one record, not three competing governance systems.

An existing investment, transformation or risk register may be sufficient. What matters is whether leadership can reconstruct who made a decision, whether system behavior remains within the approved boundaries, and who is responsible for responding when it does not.

The NIST AI Risk Management Framework and OECD AI Principles support defined responsibilities, ongoing oversight and accountability. The connected initiative-level record described here is a 6xD governance application, not a template prescribed by either source.

Leadership Implications

The four-question executive test

At the next portfolio review, select one material AI use whose scope or permissions have changed. Ask management:

1. Who authorized it? Produce the named decision-maker, current approval and delegated limits.

2. When must it be escalated? Identify the change or exception that requires a higher authority.

3. Who can stop it? Demonstrate suspension rights, intervention evidence and the authority required to restart.

4. Who owns the result? Identify the business executive, intended outcome, baseline and review date.

A policy statement or committee name alone is not sufficient. The evidence should connect the approval to actual system permissions and a tested intervention route where the consequences warrant one. If authority cannot be demonstrated, assign a corrective owner and deadline before further material expansion.

Next Step

Clarify AI Decision Rights, Investment and Outcome Ownership →