Accelerate & Transform
Who answers for what the AI decides?
What may a system decide on its own, and who signs for it?
What may a system decide on its own, and who signs for it?
The systems are already deciding. Which claim is paid, which candidate is shortlisted, which price a customer sees, which shift a worker is given, which supplier order is placed. Each was deployed by a team under competitive pressure, each works. Few on the board could say today which of them falls under which risk class of the EU AI Act, who is accountable when one of them is wrong or what the company would show an auditor who asked how a given decision was reached.
The law has stopped waiting. Since 1 January 2026 a defendant in California who developed, modified or used an AI can no longer argue that the system autonomously caused the harm. The EU AI Act attaches its obligations to those who deploy, with its high-risk regime dated and its penalties sized on turnover. Employees managed by an algorithm, clients steered by one, communities whose data trains one: each is a party who will ask the question in the title. The first time it is asked in public is the wrong moment to start answering.
What each system may decide alone, what requires a human, who signs.
This is a board decision dressed as a technical one. The risk function will build a framework; it usually does so after deployment and sometimes after an incident. What the leadership team has to settle is the allocation of authority: which classes of decision the company delegates to a system, under which oversight, with which explanation available to the person affected, which named executive answers for each. Settled that way, the governance is also what lets the company deploy faster than its competitors, because each new use case arrives with its permission already defined.
The work sits in what we call AI, Digital & Technology, on the governance side of it.
We audit the deployment posture first: every AI and digital system in use, the decisions it takes or influences, its risk classification under the Act, the oversight mechanisms actually in place and the trust status with the people it touches, whether the employees trust the system that schedules them, whether the clients trust the one that prices them, whether the data governance would survive a community's scrutiny. The inventory usually surfaces systems that had not been declared.
Then we build the governance architecture: the risk classification, the decision authority matrix that says what a system may decide and when a human must, the human oversight protocols, the explainability and transparency standards per use case, the logging that makes a decision auditable, then the board reporting that makes all of it visible at the level where the liability sits. For the CHRO the workforce part is designed before it is announced: roles redrawn around the system, people involved in the oversight rather than subjected to the output. For the CDO the architecture is written so that it speeds up the next deployment instead of adding a review layer to it.
Then we deploy with the governance embedded: each use case governed before it goes live, each workforce impact designed before the change is made. What leaves the room is the inventory with its classification, the authority matrix signed by the executives it names, the oversight and logging standards and the board scorecard. We stay for the first use cases that go through it.
In the case below we take an autonomous agent about to be put in front of customers and separate the two things that are being deployed together: the capability the business wants and the liability that has not been assigned. The governance makes that separation before the launch; otherwise the incident review makes it.
97% of enterprise leaders expect a material AI agent incident within the year. Only 6% of security budgets are dedicated to AI agent risk. Four binary conditions close the gap before go-live.
ReadFabrice Macarty, Founder, CEO. Twenty-five years across Google, Microsoft and Deloitte, from technology to strategy, with current research at HEC Paris on the dual impact of AI. He works with boards on the governance of the decisions technology is taking out of human hands. On this situation he holds the authority question: what the company delegates, to which system, under whose signature.
Agentic AI decides; the law asks who answers. A decision delegated to a system remains a decision someone signs.
Read the force in Our Approach: force 04The systems already deciding, the risk class you cannot name, the executive who would answer if asked tomorrow. Tell us where it binds and we will tell you where to start.