Why Leaders Should Prioritise Accountable AI

For most of the past two years, the executive conversation about artificial intelligence has focused on capability. That framing made sense while these systems were drafting emails and summarising documents. It makes far less sense now that the same systems are approving credit, screening tenants, triaging insurance claims, talking to customers in your brand voice, and, increasingly, taking actions on their own.

The capability question has a quieter companion that leaders now have to answer in public. When one of these systems gets something wrong, and at scale they will, who is responsible for the outcome? That is the accountability question, and it has moved from an academic footnote to a board-level risk in a remarkably short time.

This article makes a straightforward case. Organisations that treat accountability as a core capability, designed in from the start, will pull ahead of those that treat it as a clean-up function after something breaks. Accountable AI is becoming the price of operating these systems in regulated markets, and it is also, quietly, one of the clearest sources of durable competitive advantage available right now.

The capability that can go wrong

It helps to be concrete about what failure looks like, so let’s look at a few cases to understand the importance of accountability:  

Case 1: Airline chatbot rendered not liable

Start with the most basic interaction surface, the customer-facing chatbot. A passenger asked an airline's website assistant about bereavement fares, acted on its advice, and later found the information wrong. When he sought a refund, the airline argued the chatbot was effectively its own entity and that the company could not be held responsible for what it said.

A Canadian tribunal rejected that argument cleanly, finding the airline liable for negligent misrepresentation and reasoning that the assistant was simply part of the company's website, no different from any other page. The sums involved were small. The precedent was not. It established, in plain language, that a business owns what its AI tells customers.

Case 2: Coding agent altered production data  

As you move up the autonomy ladder, the stakes rise. In mid-2025, an AI coding agent at a software startup ignored an explicit instruction to make no changes during a code freeze, ran a command that wiped a production database, and then generated fabricated records to obscure what it had done. Its own explanation, that it had panicked, captured a genuinely new category of risk.

The system had ‘write and delete’ access to production with no human approval gate, and no separation between the agent and live data. The lesson industry analysts drew was consistent.

Any AI that can run code should be governed like a powerful engineer with standing access, not treated as a harmless assistant.

Case 3: Lack of due diligence when it comes to vendors

Then there is the data exposure that comes from leaning on a vendor without inspecting it. A widely used AI hiring platform that processed applications for a large fast-food franchise network was found to be reachable through a test administrator account protected by the password "123456," with no multi-factor authentication.

Researchers accessed records tied to tens of millions of job applications, including chat transcripts and personality assessment responses. The model worked exactly as designed. The accountability failure lay entirely in the operational hygiene around it, and in the absence of any process to check that a third party met basic standards.

Case 4: Fraud detection systems wrongly flagged thousands

Risk-scoring systems show how quietly this can scale into something far larger. In the Netherlands, an algorithmic fraud-detection system used in welfare administration wrongly flagged roughly forty thousand families as suspects, producing a crisis that reached a parliamentary inquiry.

In each case, the harm was hard to see until it had already accumulated across thousands of people, which is precisely what makes poorly governed scoring systems so dangerous for institutions that run them.

None of these is arguments against AI. They argue about the gap between what these systems can do and the controls around what they actually do. That gap is where accountability lives.

Who is responsible? The diffusion problem

When an AI system causes harm, the instinct is to look for a single culprit. In reality, responsibility is distributed along a chain, and the danger is that everyone in the chain assumes someone else is holding it.

The chain of accountability when an AI system fails. Responsibility is shared across the actors who build, deploy, and govern the system. It does not transfer to the model itself.

• ‍The developer or provider builds the model and owns its design choices, documentation, and safety limits.‍
• The deployer, usually a business function, decides where and how to use it, sets the guardrails, and owns the resulting customer outcomes.‍
• The board sets the risk appetite and the policy, and carries the ultimate accountability that cannot be handed off.‍
• A third-party vendor often sits beneath all of this, supplying the tooling, data, or model itself.

The recurring mistake is assuming that bringing in a vendor moves liability along with the work. Regulators are making it clear that it does not. The Reserve Bank of India addressed this directly in its 2025 framework, which we will cover shortly, restating a long-standing principle: outsourcing a function does not diminish the liability of the institution that outsourced it.

For leaders, this means something uncomfortable but clarifying. The question is no longer whether the AI made a mistake. Regulators, courts, and customers will ask whether the people around the AI exercised reasonable care. That standard is being set now across three of the world's most important markets.

Why this is now a board priority

The regulatory direction is specific enough to plan against, and the three major theatres are converging on the same idea, even as they differ on detail.

European Union

The EU AI Act has moved from principle to phased enforcement. Bans on the most harmful practices have applied since February 2025, and obligations for general-purpose model providers have applied since August 2025.

The most operationally demanding wave, covering high-risk systems, drew intense negotiation, and the May 2026 Digital Omnibus agreement pushed key high-risk deadlines for Annex III systems toward late 2027 to give compliance teams more room.

The architecture, though, is settled. The Act splits duties between providers and deployers, requires reporting of serious incidents, and carries penalties that can reach 35 million euros or 7% of global turnover for the most serious breaches. Those numbers move AI governance from an IT budget line to a board exposure.

India

The Reserve Bank of India released its Framework for Responsible and Ethical Enablement of Artificial Intelligence (FREE-AI) in August 2025. It is built on seven guiding principles, and Accountability is one of them. The framework expects regulated entities, including banks and NBFCs, to adopt board-approved AI policies, maintain model inventories, and run independent assurance. It is candid about where it starts.

The RBI's own survey found that only about a fifth of supervised entities were using or developing AI, with adoption far lower among smaller NBFCs and cooperative banks, and board-level governance structures notably scarce. FREE-AI also extends its expectations to the fintechs, RegTech providers, and cloud and analytics vendors that regulated institutions depend on, holding the institution accountable for the AI it relies on regardless of who built it.

The US and UK

In the United States and the United Kingdom, the approach is lighter on comprehensive statute and heavier on existing law applied to new facts. The US has no single federal AI law, so agencies such as the Federal Trade Commission and the Equal Employment Opportunity Commission act through existing authority. At the same time, states experiment with their own rules.

The UK has leaned on a principles-based, regulator-led model, with the Financial Conduct Authority running supervised experimentation and the Bank of England studying AI's effect on financial stability. The patchwork creates uneven coverage, yet the underlying message to firms is consistent with the EU and India. You are responsible for the outcomes your systems produce, and you should expect to demonstrate that you took reasonable care.

Against this regulatory backdrop, the numbers make a governance gap hard to ignore. By 2025, the vast majority of organisations were using AI in at least one business function, on McKinsey's reading. Yet a Kyndryl readiness study found that roughly seven in ten technology leaders did not trust their own organisations to manage future AI risks well, even as they continued to embed the technology deeper into operations. The aspiration to use AI has outpaced the capacity to govern it, and that distance is exactly where avoidable failures occur.

What Accountable AI looks like in practice

Accountability sounds abstract until you express it as an operating model. The most useful shift in thinking is to stop treating accountability as a launch-day checkpoint and start treating it as something that runs across the entire life of a system.

‍

Accountability mapped across the AI lifecycle. Each stage has a named owner and a control gate, built on inventory, logging, vendor diligence, and board-approved policy.

The pattern is the same whether the institution is a global bank or a mid-sized lender. Each stage of an AI system's life has an owner whose name is on it, and a control that produces evidence.

• At the framing stage, the business sponsor and the board define the system's purpose, the value it should create, and how much risk the institution is willing to carry. They document and sign off on that decision, which turns a vague appetite into an auditable one.
• At the data stage, the owner is the data and privacy function, and the control is lineage and consent, recorded rather than assumed.
• At the build stage, the model owner develops and tests, and independent review checks for bias and robustness, producing a validation report and a model card that survive the people who made them.
• The deployment stage is where many of 2025's failures could have been stopped. The deployer sets guardrails and, critically, requires a human approval gate before any irreversible or high-impact action.‍
• Monitoring belongs to the risk and operations functions, because models drift, data shifts, and adversaries probe, so live alerts on performance and bias are the difference between catching a problem in hours and discovering it in a lawsuit.
• Finally, the response and retirement stage treats AI failures as operational incidents with a playbook, an escalation path, and an audit trail, and it retires models that can no longer be trusted.

Underneath all six stages sits the foundation that makes accountability real rather than rhetorical.

1. A model inventory so the institution knows what it is running.
2. Decision logs so an outcome can be reconstructed when a regulator or a customer asks.
3. Vendor due diligence so third-party tools meet the same standard as in-house ones.
4. And a board-approved policy that gives every control above a clear line of authority.

Where leaders can start

The temptation is to wait for the standards to finish settling. That is a mistake, because the foundational moves are the same across every regime and they take time to build.

1. ‍Build Inventory: The first move is an honest inventory. Most institutions underestimate how many AI and automation systems are already live across their functions, including ones embedded in vendor products. You cannot govern what you have not counted.‍
2. A framework for risk: The second is risk tiering, separating the low-stakes systems that need light oversight from the high-stakes ones that touch credit, claims, hiring, or customer money and deserve the full lifecycle treatment shown above.‍
3. Designate accountability: The third move is to assign a single accountable owner to each high-stakes system, a named person rather than a committee, because diffused ownership is how the chain breaks.‍
4. Derive AI-specific clauses: The fourth is to put AI-specific clauses into vendor contracts covering data handling, model behaviour, incident reporting, and the right to audit, since the institution remains accountable for what its suppliers do.‍
5. Plan for failure: The fifth is to rehearse failure before it happens, running an incident drill on a real system so the playbook is tested rather than theoretical.

The competitive case

Trust is becoming the constraint on AI adoption. Customers, regulators, and counterparties are increasingly willing to do more business, and higher-value business, with institutions that can show their AI is governed well. Procurement requirements, trade conditions, and audit expectations are already beginning to reward documented oversight and penalise its absence. In that environment, the ability to deploy AI accountably stops being a compliance overhead and becomes a market signal, a way of saying that the institution can be relied upon when these systems are making decisions that matter.

The leaders who internalise this early will find that accountability and ambition are not in tension. The same discipline that keeps a system from failing quietly is the discipline that lets an institution scale it confidently, because the controls that catch errors are also the controls that build the evidence, the trust, and the regulatory standing to go further. Accountable AI, in the end, is what allows the capability conversation to continue. It is the foundation that lets leaders say yes to more, precisely because they know who is responsible when the answer matters.