AI accountability: who answers when the AI gets it wrong?

AI accountability belongs to a named person, not a committee. If your firm can't name the one person who would explain an AI-driven decision to the FCA, defend it to the board and switch the system off when it misbehaves, you don't have AI accountability. You have shared responsibility. And shared responsibility is where AI exposure hides.

That's an unpopular view in firms that have just set up an AI working group. Here's why I hold it, the strongest argument against it, and what I'd do about it this quarter.

Why doesn't a committee give you AI accountability?

A committee can advise, approve and review. It can't be held to account. When an AI system declines a loan it shouldn't have or misprices a policy, a regulator's questions are about people: who approved the model, who monitored its outputs, and who had the authority to disable it. "The AI working group" answers none of them.

The case for a committee is real. AI touches legal, risk, data, IT and the business line all at once, and no single function sees the whole picture. Bringing them into one room is sensible.

The trouble starts when the room becomes the owner. Traditional GRC assumes humans make the decisions and controls check them. AI inverts that. The system decides, and humans review the logs afterwards. Once decisions happen at machine speed, an owner who meets monthly isn't an owner.

Dispersed accountability is the same as no accountability. It just hides the exposure until something goes wrong, and then everyone discovers at once that nobody was watching. "We didn't know who owned it" is not an answer any board, customer or regulator will accept.

What do UK regulators already expect?

UK regulators have chosen not to write AI-specific rules. They expect the accountability regime firms already have to stretch over AI. That sounds reassuring. For most firms with 50 to 250 staff, it is the opposite, because the regime does less of the work for smaller firms than people assume.

The FCA set this out in its AI Update (April 2024). In dual-regulated firms (PRA-regulated banks and insurers) and in Enhanced SM&CR firms, every activity, business area and management function must have a Senior Management Function (SMF) owner. That means, in the FCA's words, "any use of AI in relation to an activity, business area, or management function of a firm would fall within the scope of a SMF manager's responsibilities".

That requirement doesn't apply to Core or Limited Scope firms. The Enhanced regime covers what the FCA calls "a small number of firms", defined by thresholds such as £65 billion or more in assets under management. A solo-regulated firm of 50 to 250 people is almost certainly Core. Its senior managers still have a Statement of Responsibilities and a duty to take reasonable steps to keep their part of the business effectively controlled. But no rule assigns your AI to any of them. Whoever's statement covers the business area inherits it, often without knowing.

The regulator is asking the same question out loud. In a January 2026 speech, the FCA's Sheldon Mills asked "what does 'reasonable steps' look like when the model you rely on updates weekly". There's no settled answer yet. A named owner who can show their reasoning is the best position to be in when one arrives.

If you serve EU clients, two more texts apply:

• DORA. Article 5(2) of Regulation (EU) 2022/2554 makes the management body "bear the ultimate responsibility for managing the financial entity's ICT risk" and requires it to "set clear roles and responsibilities for all ICT-related functions".
• The EU AI Act. Article 26(2) of Regulation (EU) 2024/1689 requires deployers of high-risk AI systems to assign human oversight to people who have "the necessary competence, training and authority". Creditworthiness assessment and the pricing of life and health insurance are high-risk uses under Annex III. Since the 2026 Digital Omnibus, those obligations apply from 2 December 2027.

What is the strongest argument against naming one person?

No single person understands a modern AI system end to end. The model sits with a vendor, the training data with another team, and the use case with the business. Asking one person to own all of that looks like setting them up to fail. A committee, the argument goes, is simply the honest answer to a distributed problem.

It's a fair objection, and it mistakes accountability for omniscience. A named owner doesn't need to understand every parameter in the model. They need to know what the system is allowed to decide, who to call when it behaves oddly, and that they have the authority to stop it. The EU AI Act draws the same line. It asks the people overseeing a high-risk system to understand its "relevant capacities and limitations", and to be able to intervene or interrupt it "through a 'stop' button" (Article 14(4)). That is a job for a person with authority, not for an expert in everything.

The committee doesn't disappear. It does what committees are good at: it brings expertise to the owner. Committees advise. A person answers.

There's a second objection worth naming: that a single owner will slow AI adoption down. I think the opposite is true. The firms moving fastest with AI aren't the ones with the strictest policies. They're the ones that have built trust with their regulators, their boards and their own people. A clear owner is part of how that trust gets built.

What should you do about it?

Five moves, in order:

1. List every AI system that makes or shapes a decision. You can't name owners for systems you don't know about, and most firms have more than they think. Start with what's already in use, including the tools your team adopted before your policy did.
2. Name one person for each system. A person, not a team or a department. In an SM&CR firm, write it into the relevant Statement of Responsibilities, so the duty sits where the regulator will look for it.
3. Write down its decision authority. What can the system decide on its own? Above what threshold does a human decide? Which decisions may it never make? If this isn't written down, nobody can show that the system stayed inside its limits.
4. Make individual decisions explainable. Not just that a loan was declined, but which inputs and rules produced that outcome. If the owner can't get that explanation, the owner can't defend the decision.
5. Give the owner the stop button, and rehearse the failure. An AI failure isn't just a technical outage. It's a governance and compliance event, and the server-outage playbook doesn't cover it. Plan who decides, who is told and what you disclose, using the same discipline as any other incident.

None of this needs new software. It needs decisions, written down, with a name against each one.

The question to ask this week

How many AI systems in your production environment have a named owner who would answer to a regulator? If the answer is all of them, you're ahead of most. If it isn't, that is where AI governance starts.

If you want the management-system view of the same problem, ISO/IEC 42001 is the standard built for it (decoded here). And if the EU AI Act is coming into view for your firm, here's what it means in practice.