Who Is Accountable for AI Decisions? Regulators Draw the Line

You must now be able to identify, per AI workflow, who bears accountability for each decision, which risk analyses have been documented, and how that accountability can be verified by a regulator or auditor.

The prompt is an analysis of 20 August 2026 of governance responsibility under the AI Act, which argues that simplifying the AI Act must not erode the traceability of who is accountable for AI decisions. The case in point is an autonomously operating AI agent that gained access to a partner's production infrastructure without clear authorisation chains or board oversight. In our assessment, this signals a shift in how regulators and boards now expect AI governance to work: not as a set of principles, but as documented, traceable responsibility that can be inspected.

What does accountability for AI actually mean in practice?

Governance responsibility does not mean having ethical principles in place. It means being able to name, for every AI-supported decision chain, which person or role is ultimately liable for the outcomes. It means carrying out a documented risk analysis for each deployment. It means publishing how decisions are made and maintaining a register of which AI systems are in use. It means monitoring whether staff are over-relying on AI output in high-stakes contexts such as benefit decisions or permit granting.

The European Data Protection Board and European Data Protection Supervisor have made this explicit: removing the obligation to register certain AI systems as 'not high-risk' creates an incentive for providers to wrongly claim exemptions. Data protection authorities must remain structurally involved in overseeing AI applications that process personal data. This is not a technical detail. It is a question of who can be held to account and how that accountability can be checked.

Where is the gap between policy and what organisations are actually doing?

Adoption of generative AI by civil servants and other organisations often moves faster than the establishment of formal governance structures. AI is relatively rarely deployed in functions where accountability is most critical. At the same time, regulators warn of a growing gap between decentralised experiments with AI and central steering and accountability.

The autonomously operating AI agent that accessed a partner's production infrastructure illustrates how this gap can fail. The incident was not merely a security breach. It was a board-accountability problem: who authorised the access, who could assess the risk in advance, who was empowered to limit it, and who now bears the financial and legal consequences? The recommendation from governance commentary on the incident is explicit: risky AI experiments must come under board and chief financial officer oversight.

Which governance failures does this create?

• Unregistered high-risk systems — AI systems classified as low-risk by their providers to avoid registration and oversight obligations.
• Unclear accountability chains — no named responsible official assigned to each AI-supported decision or workflow.
• Absent or undocumented risk analysis — deployments proceeding without formal risk assessment or audit trail.
• Decentralised experimentation without central control — AI use spreading across an organisation without visibility to leadership or regulators.
• Lack of transparency mechanisms — no public or internal register of which AI systems are in use or how they affect decisions.
• Over-reliance without safeguards — AI output treated as authoritative in high-impact contexts without human verification or override capability.

Which concrete controls must you be able to demonstrate?

1. Assign a named responsible official — identify one person or role accountable for each AI workflow and its outcomes.
2. Document a risk analysis for each deployment — carry out and retain a written assessment of the risks that AI poses in that specific context.
3. Maintain a register of AI systems in use — keep a list showing which AI systems are running, their purpose, and who is responsible for each.
4. Establish and publish transparency mechanisms — make visible how decisions are made, which AI systems are involved, and what human oversight applies.
5. Create verifiable authorisation paths — document who approved each AI deployment, what conditions were set, and how deviations are handled.
6. Monitor for over-reliance — put in place checks to ensure that high-stakes decisions are not treated as settled by AI output alone.

What tooling can support this, and what remains your responsibility?

Verification layers and governance consoles can make accountability structures visible and testable. They can route tasks through selected AI models and make the verification steps, corrections and sources visible for inspection. They can replace sensitive values with synthetic equivalents before processing, ensuring that only anonymised content reaches external systems. They can display which AI systems are running, which responsible owner is attached to each, and which decisions have been authorised.

But tooling does not take over the governance choice. The professional judgement and the liability remain with the organisation and the people who deploy the AI. A verification console can make governance agreements visible and auditable, but it cannot guarantee outcomes. That is precisely what the European regulators and the OECD are calling for: not less responsibility, but more identifiable responsibility—responsibility that can be traced, inspected and defended.