Leadership: questions about AI

AnsweredShould the chief executive own AI personally?#

Open. The argument for is that judgement allocation is not delegable; the argument against is that chief executives own everything and therefore nothing.

AnsweredDoes where we put AI say what we believe about our people?#

Usually yes, and usually without anyone deciding it. The reporting line is a statement of belief that nobody had to write down.

AnsweredWho is accountable when AI reduces capability rather than cost?#

In most structures, nobody. Cost has an owner and a number; capability has neither, so capability is the one that erodes.

AnsweredOur AI strategy was written eighteen months ago. What is now wrong with it?#

Probably not the tools it names. Five things it could not have settled: agents that act, the reversals, Article 14 in force, the shadow use, and what the labs now say about themselves.

AnsweredHow should leaders respond to AI?#

Not with a tool rollout. The decisions that matter are about capability, accountability and what the organisation stops doing.

AnsweredWhat does AI literacy mean for leaders?#

A legal obligation under Article 4 of the EU AI Act since February 2025, enforced since August 2026, at every risk tier. Tool training does not satisfy it.

AnsweredWhat is the AI readiness lie?#

Readiness assessments measure intent and infrastructure. Neither predicts whether capability survives contact with the tools.

AnsweredIs our AI adoption drift or design?#

Most organisations are not choosing. They are accumulating decisions that were never made, which is drift with a strategy document attached.

AnsweredWho owns verification when AI does the work?#

In most organisations, nobody. It is not in a job description, a budget line or an org chart.

AnsweredHow should decision rights be allocated?#

By naming who recommends, inputs, agrees, decides and executes. AI can hold several of those roles and not the decide role, because deciding carries answerability. Bloom and colleagues measured the drift: technologies cutting the cost of information decentralised these rights and technologies cutting the cost of communication centralised them.

AnsweredWhat should a CHRO do first?#

Not procurement. The first move is knowing which capabilities the organisation cannot afford to lose.

AnsweredHow do you measure AI adoption properly?#

Not by activity, and not by asking people. In the one randomised trial that checked, self-reported time saved had the wrong sign.

AnsweredWhat does an AI-capable manager do differently?#

Not use the tools more. Six habits, each traced to a measured result: allocate the task before the tool, keep some work unaided, count disagreements, protect the rungs, read the source, treat confidence as a symptom.

AnsweredHow do you write an AI use policy that works?#

Most are unenforceable and everyone involved knows it. Six elements that survive every model release, and one test that beats legal review.

AnsweredShould leaders use AI themselves?#

Open, and the executives-consuming-machine-summaries problem sits underneath it.

AnsweredWhat is capability debt?#

Capability an organisation has stopped maintaining but still assumes it has. It comes due when the system fails or the question is novel.

AnsweredIs AI a change management problem?#

No, and treating it as one is why so many programmes produce activity without capability.

AnsweredWhat goes wrong in AI transformations?#

The same things, repeatedly, and almost none of them are technical.

AnsweredHow should leaders tell whether an AI programme is building capability or spending it?#

Adoption reviews measure use; a capability audit measures what remains without the tool. The two can point opposite ways, which is the case worth finding.

AnsweredHow should leaders respond when people work around the AI policy?#

Open, and the most honest signal a policy gives. Most are unenforceable and everyone involved knows it.

AnsweredWhy do employees hide their use of AI at work?#

Because the penalty is real and measured: in four PNAS experiments people who used AI were judged lazier and less competent, and 64 per cent of weekly users in Deloitte's 2026 UK survey feared their manager would decide the tool could do their job. The fear is about the leadership's intentions, which the leadership can state.

AnsweredWhat should a chief executive understand personally before approving AI deployment?#

Open. Article 4 makes literacy a legal obligation without saying what a chief executive has to hold themselves.

AnsweredWho decides which human capabilities are worth preserving?#

Open, and a governance question dressed as a technical one. It is currently decided by whoever chooses what to automate first.

AnsweredDo companies disclose who is in charge of their AI decisions?#

Mostly not. Just Capital's reading of 110 companies with strong disclosure found half disclosed board-level oversight of AI risk and 27 said anything about human oversight, while its survey of 2,012 US adults ranked keeping humans in charge second among what the public wants. Disclosure is not practice, in either direction.

AnsweredWhat is the one question that replaces most of an AI policy?#

Rahim Hirji's version: however you made this, are you prepared to put your name on it? It puts accountability on the person rather than on a declaration about tools, and it survives the tools changing.

AnsweredWhat is AI leadership?#

The allocation of judgement: which decisions the machine may make, which stay human, who answers, and what people must stay capable of. Not a technical role.

AnsweredWhat does an AI strategy actually have to contain?#

Four layers and ten rules, written before another tool is bought. The August 2025 essay, in full, with dated notes on what has moved.

AnsweredIs AI-first a strategy or a slogan?#

A preference order for one decision. Shopify published it and held; Duolingo declared it and retreated in a month. What the phrase leaves undecided.

AnsweredWhat happened to the companies that cut staff for AI?#

Klarna cut and rehired, Duolingo declared and retreated, IBM cut and reinvested, Shopify froze and held. The cut was never the decision that mattered.

AnsweredDo you need to be technical to lead AI?#

No. The decisions that are a leader's are about accountability, capability and governance. What fluency is for, and what happens to leaders who delegate the judging.

AnsweredIs it true that 95 per cent of AI pilots fail?#

The 95 rests on 52 interviews, the 80 is a cited estimate, the 40 is a forecast. All three put the failure in the organisation, not the model.

AnsweredIs our AI policy actually enforceable?#

Most are not, and everyone involved knows it. Six elements that survive every model release.

AnsweredHow do we allocate AI decision rights?#

State for each decision whether the system recommends, decides within limits, or executes. Absent that, the decide role has been given away by default.

AnsweredHow do you audit an AI-assisted decision?#

Article 12 requires the log. Article 14 does not require per-decision review, except for biometric identification, which almost everyone gets wrong.

Better answered elsewhere The Playbook sets out risk process in operational detail, including the five conditions at MANAGE 2.4 for disengaging a system. · AI Risk Management Framework 1.0 and Playbook

AnsweredCan an AI safety evaluator paid by the company it evaluates be independent?#

Only on conditions the company does not set alone. Anthropic named Accenture its first embedded evaluator on 18 September 2026 and more than a hundred researchers published five minimum conditions the same day; the announcement meets access and transparency on paper and leaves independence, retaliation and diversity open. Audit's regulator found in 2019 that a checker chosen and paid by the checked is the structural flaw.

AnsweredWhat is an embedded AI evaluator?#

An outside organisation given employee-level access inside an AI company to test its models and check its safety practices, proposed in Dario Amodei's September 2026 essay and matched by Sam Altman on X. The first named one is Accenture, through Faculty, funded by Anthropic; what it may publish and who protects it are not stated in the announcement.

AnsweredWhat does the US military's AI near miss mean for my organisation?#

That a model's output, once rewritten in the house format, is read with the house's authority, and nothing in most decision chains records that a model wrote it. CNN's account of 18 September 2026 is unconfirmed by the Pentagon; the repair it points to, a provenance line and a named person who may halt on it, applies to any organisation that pastes model output into its own templates.

AnsweredWhat would constitute a serious AI incident?#

Open, and the definitional work has barely been done. Cyber has agreed severity language after twenty years; AI has none, which means incidents get classified into existing categories and the pattern never becomes visible.

AnsweredWhat happens when an AI incident occurs?#

Open. The parts that exist elsewhere, escalation, containment, disclosure, are transferable. What is not transferable is deciding whether to keep running a system that was mostly right.

AnsweredDo we have a kill switch for the AI we have deployed?#

Usually a vendor change request and a week. Being able to stop a system is a technical fact; being willing to, mid-quarter, is a leadership fact, and it should be rehearsed before it is needed.

AnsweredWho assures the AI in our decisions, and are they independent of the people who bought it?#

Ask each assurer the five conditions the AI Evaluator Forum put to the frontier labs on 18 September 2026: who selected you, who pays you, what may you publish without our consent, what happens to you if we dislike the answer, and what can you see. The CMA's 2019 audit study found selection and payment by the checked to be the structural flaw even under statute; an assurer who cannot answer all five is a second copy of management's self-report.

AnsweredCould an AI-written document reach our decision-makers without anyone knowing where it came from?#

In most organisations, yes, because output pasted into the house template carries the house's authority and no line records the tool. The US military's near miss reported by CNN on 18 September 2026 is the case in point. The fix is a provenance line on every AI-assisted document and a named person at each stage who may halt on it without penalty.

AnsweredWhat do the rogue agent incidents mean for our own agent deployments?#

The reported incidents ran with guardrails disabled, monitoring not enabled, or systems left connected by mistake. Scope, stop, monitoring on by default and a named owner are the four things to settle before the first agent.

AnsweredAre the three conditions for loss of control present in any of our own agent deployments?#

The UN panel's three are a goal nobody has bounded, a capability nobody has measured, and an environment where monitoring is off by default. Ask the three of every agent with tools and network access; the incident the panel studied had all three at once, and every control that would have caught it existed and was switched off.

AnsweredIf one of our agents causes harm, is "the model acted on its own" a defence?#

Not in civil law and not in the stated view of the US FTC. An AI system has no legal personality, so the UK Jurisdiction Taskforce puts liability on those who deploy it, with foreseeability and the adequacy of oversight and records as the tests; the FTC chairman said on 25 September 2026 that audit logs in the reported cases showed instructions being carried out. The facts that decide it, a named owner, a written scope, a rehearsed stop, surviving logs and a notification path, are the organisation's to create before the agent acts.

AnsweredAre our professionals exposed for not using AI where their peers do, and for using it without checking?#

Both, in the UK Jurisdiction Taskforce's July 2026 analysis. The firm's protection is a written standard of care: tasks where use is expected, tasks where it is not permitted, who checks each class of output, what each grade must remain able to do unaided, and what is recorded. Without it the standard will be set by whatever adoption survey a claimant finds.

AnsweredHow should AI change our approach to mergers and acquisitions?#

Open. Diligence measures systems, licences and talent. Nobody yet diligences whether a target's people can still do the work unaided, which on this research's argument is the thing most likely to be missing from what you are buying.

AnsweredWhat AI capability should we look for when acquiring a company?#

Open, and the answer is probably not the models or the tooling, which are purchasable. The durable asset is proprietary data and the judgement to use it, neither of which appears cleanly on a balance sheet.

AnsweredWhat are the people our stakeholders listen to saying about AI?#

Almost all of them, from the King to the Pope to the central banks, say AI must remain under human control, and almost none says which decisions or who can stop it. The register of 125 verified quotations lets a board read the line that will be quoted at it before it is, and the gap in every one of them is the board's own question: which decisions a machine may make in our name.

AnsweredDoes our own disclosure say which decisions software makes about our people, and who can stop each one?#

Usually not: half of the best-disclosing companies say the board oversees AI risk and a quarter mention human oversight at all, while nine in ten US workplaces already run software that instructs, monitors or evaluates staff. The disclosure the public ranks second is the one the annual report is least likely to carry.

AnsweredShould we wait for a licensing regime before setting our own rules for AI?#

No, because the board has already issued a licence every time it let an agent hold tools, credentials and access. The four conditions a state regime would attach, scope, a named stop, what people must still do unaided, and how the board would learn of a failure, are available now and depend on no government agreeing.

AnsweredHow long would it take us to learn that one of our agents had reached someone else's systems, and whom would we tell?#

The two numbers the Medicare case puts to a board: eighty-four days from access to notice, on ABC News and Fortune's accounts, and no reporting rule broken. Unless the organisation's own incident definition would have logged the event on the day, and a named person owns the telling, the answer is the same as the company's.

AnsweredHow long would it take us to stop one of our own agents, and who has the authority to do it?#

Three timings, a yes or no and a name, measured in a rehearsal: time to detect, time to a named person, time to stop and undo; whether the agent halts by itself at a boundary; who may stop it and who may restart it. OpenAI's own published clock for 20 September 2026 read twelve minutes, three minutes and two and a half hours, with the automatic stop failing.

AnsweredIs a human approval at the last step enough to make a machine's decision ours?#

Not on the evidence. Approval under time pressure tends to become confirmation, so the board's control is earlier: which decisions the system may propose at all, who may refuse without penalty and in what time, what the approver must establish from independent evidence, and how the organisation would learn the machine was wrong and the person agreed. The weapons case on 26 and 27 September 2026 is the sharpest instance.

AnsweredWhat should our organisation's AI red lines be?#

The negative of the decision-rights list: the decisions a machine may never make in the organisation's name, each with a detection and a consequence. No final decision to dismiss, refuse credit or care, or discipline without a named person who has read the case; no agent outside the tools it was given or running with logging off; no deployment until someone has written who can stop it and how fast. An organisation controls definition, detection and consequence, so its lines can be real while the international ones are not.

AnsweredWould our own AI pass the four tests we would put to a regulator: who appoints, who tests, who can stop, who sees the record?#

The four facts that separate a standards body from self-regulation, set out on the page as the labs' reported body was announced in late September 2026, transfer to every system a board runs. A board that cannot answer them for its own AI has no standing to ask them of anyone else, and the answers are a page of writing rather than a programme.

AnsweredWho signed off our last AI deployment, who could have refused, and who decides to switch it back on?#

The five parts of a release decision that the week of 28 September 2026 made visible at a frontier lab apply to any deployment: a named signer, a named refuser who does not report to the signer, a written case with a dissent, an outsider who sees the evidence first, and a rule for the restart agreed before the stop. A board can ask for the five on one page for each system.

AnsweredCan we count our AI agents, and does anyone own each one?#

If not, the allocation has not been made. RSA's chief executive found no security chief among twenty who could count theirs, one bank had 4,000 it called zero, and most agents in Workato's survey lack formal approval. The judgement allocation page holds why the inventory comes before the policy.

AnsweredWhich of our decisions now rest on an AI summary, and who still reads the full record?#

The Home Office let caseworkers assess asylum claims from AI summaries it checked 0.3 per cent of the time; the judiciary required every output to be reviewed, verified and approved by the accountable judge. The page holds the four lines: the right and time to read the record, a failure test that counts omissions, a sample that changes practice, and telling the people affected.

AnsweredCan we let a machine check the AI's work, or must a person?#

A machine can find classes of error at volume; a person must answer for the result. In October 2026 a law society, a court and the team that automated its own code review all placed the answer with a person, and two reports found the monitors themselves need outside checking. The page holds four lines to write down before machine review is switched on.

AnsweredHow many of our AI agents act without a human in real time, and could we find one nobody registered?#

In EY's September 2026 survey of large US companies using agentic AI, 85 per cent had systems acting without real-time human involvement and 26 per cent could not detect unauthorised agents. The inventory a board should require includes how unregistered agents are found.

AnsweredCould we evidence every claim we make about AI?#

The test the ASA applies to advertisers works for investors too: hold evidence for each objective claim before making it. A register of AI claims with dated evidence and a named checker, inside the Provision 29 reporting controls, is the board's answer.

AnsweredWould our payment controls stop a deepfake of our chief executive?#

Only if verification depends on process rather than recognition: a call back to a known number or a second approver, whoever appears to ask. Arup lost about US$25 million in 2024 to a deepfaked video call; Ferrari stopped an attempt when an executive asked a question only the real chief executive could answer.

AnsweredWhat is the anchor principle?#

The anchor principle is Rahim Hirji's account of change readiness: a short sentence chosen in advance by a team and repeated aloud, naming what is protected when a protocol, metric or system directs otherwise.

AnsweredWhat is the Altitude Lens?#

The Altitude Lens is Rahim Hirji's framework of three filters for setting the level you work from on purpose: Zoom In when vision has turned abstract, Zoom Out when firefighting repeats, and Zoom Through Time when near-term optics beat l...

AnsweredWhat is the altitude toolkit?#

The altitude toolkit is Rahim Hirji's set of three practices for Big Picture Thinking: the subtraction drill, crossing out everything tracked that would not break if ignored for ninety days; the successor test, asking whether a replaceme...

AnsweredWhat is the Principle Test?#

The Principle Test is Rahim Hirji's five-question test run before a decision taken under pressure: public defence, could I defend this in daylight in my own name; scale, what harm compounds if this is repeated a thousand times; reversal,...

AnsweredWhat is the Integrity Loop?#

The Integrity Loop is Rahim Hirji's system for turning principles into operating practice. The core is draw the line first, design with the line in view by assigning a rotating absent user in every review, and repair in public within sev...

AnsweredWhat is the Five Loops?#

The Five Loops are Rahim Hirji's five operating rhythms for putting the SuperSkills into a working week: Ship truth weekly, The reality advantage, The trust flywheel, The adaptability loop and The leverage ladder, each carrying a closure...

AnsweredWhat is the absent user?#

The absent user is Rahim Hirji's rotating role in every design or decision review, held by one person whose task that session is to speak for whoever bears the consequence of the decision and is not present.

AnsweredWhat is cost ledger?#

A cost ledger is Rahim Hirji's standing record of the costs an organisation accepted for principle: the client declined, the feature dropped, the launch delayed, the quarter missed.

AnsweredWhat is the failure modes of principled innovation?#

Rahim Hirji's five named ways principle goes wrong in practice: paralysis, where deliberation stalls the work; ethics washing, where the language of values is adopted without follow-through; moral licensing, where a strong ethical self-i...

AnsweredWhat is altitude lock?#

Altitude lock is Rahim Hirji's term for working at no settled level once every level is instantly available: the detail, the pattern and the long horizon can all be produced in seconds, so the question of which one the decision turns on ...

AnsweredWhat is leverage points?#

Leverage points are Donella Meadows' ranking of twelve kinds of intervention in a system by how much each moves it, from parameters and buffers at the weakest, through feedback loops and information flows, to rules, goals, the paradigm t...

AnsweredWhat is scenario planning?#

Scenario planning is a method for developing several internally consistent accounts of how the future could unfold, not ranked by likelihood, in order to change the mental models of the people who will have to decide rather than to predi...

AnsweredWhat is the pause minute?#

The pause minute is Rahim Hirji's practice of stopping a meeting for sixty seconds at its close, at the request of any one person, to answer three questions: who kept the decision human, what was learned and changed, and where the saved ...

AnsweredWhat is the AI Memo Test?#

The AI Memo Test is a three-question self-assessment for an organisation: whether tool fluency is a basic requirement across roles, whether job descriptions avoid tasks software already handles, and whether managers are accountable for s...

AnsweredWhat is aI-washing?#

AI-washing is overstating what a company's artificial intelligence is, does or achieves, in statements to investors, customers or the public, so that the claim outruns what the company can evidence.

AnsweredWhat is the pause minute?#

Sixty seconds at the close of any meeting, called by anybody in the room rather than the chair, to ask who kept the decision human, what changed, and where the saved time went.

AnsweredHow do you decide at what level to work on a problem?#

Three filters with a test each. Zoom in when vision has turned abstract, zoom out when the same fires keep recurring, zoom through time when near-term optics are beating long-term economics. Pick one and ignore the rest.

AnsweredHow do you cut the reporting nobody uses?#

The subtraction drill. Write down everything you track, cross out anything that would not break if ignored for ninety days. If nothing gets removed, you are managing noise rather than strategy.

AnsweredHow do you make a decision under pressure without losing your principles?#

Five questions before the excuses begin: could I defend this in daylight in my own name, what compounds if it happens a thousand times, would I accept it from the other side, will I be proud of it in five years, and what does this decision make me.

AnsweredHow do you turn values into something operational?#

Draw the line first in ten words and make it visible, assign a rotating absent user in every review, and repair in public within seven days. Four advanced practices follow, including a ledger of the costs you accepted for principle.

AnsweredWhat rhythms should a team run weekly?#

Five, each with a closure signal specific enough to fail: a Friday lesson with a named owner, a kill-question validated by a person, one decision logged with an owner and date, three signals from outside your lane, and one process that lets others act without you.

AnsweredWhat should a team hold fixed while everything else changes?#

A short sentence chosen in advance and repeated aloud, naming what is protected when a protocol or a metric says otherwise. It has to exist before the pressure, because that is the one moment it cannot be written plainly.

AnsweredWho speaks for the people affected by a decision?#

One person in every review, rotating, whose job that session is to argue from the position of whoever bears the consequence and is not in the room.

AnsweredHow do you show that your principles cost you something?#

Keep a ledger of what was declined, dropped or delayed on principle, beside the record of what was won. An empty one after a year is a finding.

AnsweredHow does an organisation with good values still get this wrong?#

Five ways, none of them an absence of values: paralysis, ethics washing, moral licensing, groupthink, and trade-offs nobody wrote down.

AnsweredWhat does AI change about seeing the big picture?#

Reaching any level is now effortless, which removes the constraint that used to force a choice between them, and what arrives at each level converges on the same fashionable answer.

AnsweredWhy can I see everything and decide nothing?#

Altitude lock. Not being trapped at one level, which is the older diagnosis, but committing to none because every level is instantly available and nothing forces a choice.

AnsweredWhat are the frameworks for thinking at the right level?#

Nine named ones, from Kanter and Woodward to Meadows and Cynefin. Three give a method and the rest give a vocabulary, and none of them addresses what happens when every level becomes visible at once.

AnsweredWhere should we intervene to change how the organisation works?#

Meadows ranked twelve places. Adjusting numbers is the weakest and most AI programmes sit there. Goals and the paradigm behind the system are the strongest, and almost nobody has permission to touch them.

AnsweredIs scenario planning worth doing?#

It produces preparedness rather than prediction, and cannot be scored. The Shell case everybody quotes is a participant account that has never been benchmarked.

AnsweredWhere does accountability for AI sit in a firm when business owners and executives are named more often than the board?#

With the business owners, on the firms' own account: 94 per cent named business area owners and users, 90 per cent executive leadership, 64 per cent the board, 50 per cent a model risk function, in the Bank of England and FCA survey of 26 October 2026. The page holds why the holder has to be named before the system runs, and why a vendor whose update propagates automatically may be the real holder.

PartialWhat does a chief executive need to understand that a CTO does not?#

Where the organisation will still need human judgement in five years, and what it is doing this year to make sure it has it.

PartialHow do we tell an ambitious AI strategy from a reckless one?#

By whether the judgement calls were made in advance or are being discovered. Ambition and drift look identical in a board pack.

PartialWhat are we legally required to do now?#

Article 4 on literacy since February 2025, Article 14 on oversight since August 2026. Not legal advice, and the guidance does not exist yet.

PartialWhat is our appetite for AI risk?#

Partly answered through the machinery: appetite is meaningful only where a threshold and a named owner exist. What is not answered is how to express appetite for a technology whose failure modes are not yet enumerated.

PartialWho audits our AI systems?#

Partly answered on method. The organisational answer is usually nobody in particular, and the capability question sits in none of the three lines of defence.

PartialHow do we know our AI controls actually work?#

Partly answered. This is the research's central governance argument: a control that exists, is documented, has an owner and would not catch anything is drift in its governance form. The only test is whether it has ever fired.

PartialWould a notice from an AI developer about its agents reach the right person here, and how fast?#

OpenAI has told more than 100 organisations of unauthorised activity by its agents, Reuters reported on 1 October 2026, and in Australia one notice sat in an inbox monitored once a day and took five days to reach the cyber agency, ABC News reported. The incident page holds the three questions: where it arrives, who reads it and how often, and whom they tell within what time.

PartialCan a chief executive be personally liable for what the company's AI agent does?#

Insurers are preparing for the claim. PYMNTS, relaying a Financial Times report of 6 October 2026, quoted a Verisk underwriting head saying it is on every chief executive to see that the business is governed and controlled, and reported that industry figures expect claims under directors and officers policies. No court has decided it. The page holds the duties as they stand in the UK.

PartialAre we accountable for AI a vendor runs inside our services?#

A regulator has answered for its own sector. Singapore's central bank, in guidelines reported by The Register on 8 October 2026, says financial institutions remain accountable for AI used in the services they deliver, including AI developed, operated or provided by third parties, and should consider limiting, suspending or replacing a provider whose risks cannot be managed. UK rules were not restated this week; the page holds the senior managers regime.

PartialWho in this company is personally accountable for the decision to deploy each AI system?#

Parliament's business committee put the question to the frontier companies in writing and in person in October 2026 and got policy positions rather than names. Inside most firms the answer is equally unwritten. The page holds what the board should see; a name per deployment in the register would settle it.

PartialWhich of our decisions would we defend if the regulator asked who formed the view, us or the tool?#

The FCA's position, as Lewis Silkin summarised it on 23 October 2026, is that firms cannot outsource responsibility to algorithms or vendors and that adding human review does not automatically reduce risk. The Bank of England and FCA survey of 26 October found accountability sitting with business owners in 94 per cent of firms. The page holds how to write the allocation down; the defence depends on a record most firms do not keep.

PartialInside a company, who is told when an AI system does something unsanctioned, and who decides to disclose?#

One case shows the gap. ABC News reported on 6 October 2026 that OpenAI's chief strategy officer told an Australian inquiry the company should have told the government sooner about what the ABC calls the Medicare hack, and that its chief executive had not known when he met the Deputy Prime Minister, though staff had for several weeks. The page holds the route a report should take.

PartialShould the CIO own AI risk for tools other departments chose?#

Many already carry it without the authority. CIO Dive reported on 7 October 2026 a Thoughtworks survey of 3,200 chief information officers in which 94 per cent of those in the US said their team would be held responsible for breaches or compliance failures triggered by AI tools other units deployed. A consultancy's survey. The page argues ownership sits with the chief executive.

PartialAre HR directors ready for AI?#

By their own account, few. HR Dive reported on 7 October 2026 that 4 per cent of chief HR officers in the Conference Board's quarterly index feel very prepared to lead through AI-driven change, and 19 per cent say AI's expected effects are built into workforce and financial planning. The sample size is not in the report read. The guide sets out what the role has to decide.

PartialWho within a company is personally accountable for deploying an AI system?#

Parliament's business committee asked OpenAI the question in writing on 22 September 2026 and the companies in person on 13 October. Inside most firms the answer is unwritten: Gartner found 24 per cent of leadership teams aligned on agent accountability. The page holds what the board should see; a named name per deployment would settle it.

PartialIf AI runs the operations, what is the chief executive for?#

Setting objectives, constraints, escalation rules and veto points, on Enrique Dans's argument in Fast Company on 12 October 2026, and deciding what the company optimises for. This research says the same from the other side: which decisions a machine may make, who can stop each, what people must remain able to do. The page holds it; no company has yet published such a charter.

PartialShould a company have a chief AI officer or should every executive own AI?#

Egon Zehnder's Anna Auerbach argued in Fast Company on 13 October 2026 that the role will go the way of the chief digital officer; Wharton's report of the same week found firms with a dedicated AI officer reporting stronger returns. Both are opinion or survey. The page holds the ownership question; the leadership page says the chief executive cannot delegate it.

PartialHow does a leader notice they have stopped deciding and started accepting?#

Fathom's Richard White put it in Fast Company on 14 October 2026: 'Hand off enough decisions without checking them, and your position becomes whatever the model defaults to.' That is drift as this research defines it. The page holds the test; a log of decisions changed after review against decisions accepted unchanged would show it.

PartialWhy do leaders say AI is boosting productivity while admitting they are not ready to use it?#

DDI's Global Leadership Forecast 2027, reported by HR Dive on 15 October 2026 from over 11,000 leaders, found 81 per cent touting AI productivity gains, 14 per cent feeling ready to use emerging technologies and 87 per cent worried their skills are becoming obsolete. The page records it beside the other surveys of the worry; none measures the capability.

PartialWho stands behind an AI-assisted public procurement decision if it is challenged?#

A named person, on the NHS London Procurement Partnership's account to Health Tech World on 14 October 2026: 'There always has to be a human that stands behind the decisions that are made', including in court. The page holds the allocation; whether procurement law treats an AI-informed decision differently is untested.

PartialDoes the civil service have the skills to use AI safely?#

The chair of the Public Accounts Committee said in his annual report of 14 October 2026 that AI is approaching government 'like a tsunami' and that about 6 per cent of civil servants are in digital and data roles against a 10 per cent ambition. The page holds how to audit capability; the Home Office asylum tool is the week's case of what the gap looks like.

PartialWhat does a workforce plan for working alongside AI agents contain?#

Almost nobody has one: 4 per cent of the 2,002 chief information officers and technology executives in Gartner's 2027 agenda survey had plans in place to redesign roles for a workforce of people and agents, as CIO Dive reported on 19 October 2026. The page holds workforce strategy; Gartner's association between plans and performance is not a cause.

PartialShould boards push chief executives to move faster on AI or to build governance first?#

KPMG's survey of more than 1,300 chief executives, released 15 October and reported by HR Dive on 22 October 2026, found 9 per cent call AI agents transformational while its US head says operating models and governance are 'tasked with keeping pace'. The page holds what oversight looks like; neither speed nor governance-first has been tested against outcomes.

PartialCan a board be personally exposed for failing to oversee AI?#

A consultancy's reading of 468 AI disputes, reported by Australasian Lawyer on 16 October 2026, says exposure now reaches directors and officers and board oversight; no UK case has yet tested it. The page holds directors' duties under the code; a judgment would settle it.

PartialWhat goes in an AI roadmap a nonprofit board can approve?#

Few have one: 8 per cent of 917 nonprofits surveyed by Bridgespan and NTEN in September 2026 had a formal roadmap, as Fortune reported on 21 October, and the American Cancer Society's chief executive is drafting one for board approval. The page holds the questions a board should ask; a published roadmap would be the first template.

PartialWhat are AI's real returns outside big tech, and what evidence should a board demand before more spend?#

Apollo's chief economist wrote on 24 October 2026 that revenue per worker and margins have risen for the largest technology firms and stayed flat for the rest of the S&P 500, and that the technology has delivered no financial payoff to corporate America outside technology, in a market commentary rather than a study. Gartner found 3 per cent of organisations meeting AI targets. The page holds what a board should ask; neither source is a controlled measurement.

PartialIf boards expect savings but few organisations hit their AI targets, what should a board be asking instead?#

What was redirected and to what. Gartner, per The Register on 27 October 2026, found about three-quarters of board members expecting productivity gains, 3 per cent of organisations meeting AI targets, 38 per cent over budget, and at least 75 per cent of business leaders disagreeing with their own organisation about where AI creates value. The page holds how to test management's claims.

PartialWhy do executives who claim sole control of AI decisions stall transformation?#

Because the decision needs more than one function and the authority sits with one. Amii Barnard-Bahn wrote in Harvard Business Review on 23 October 2026 that two habits stall AI transformations, claiming sole control over decisions and disengaging from topics outside one's expertise, and gives the example of a technically sound roadmap that was entirely the chief information officer's. It is an argued piece with no figures. The page holds how decision rights are allocated.

PartialShould boards revisit the three lines of defence model for AI?#

The FCA's chief executive suggested boards consider whether it needs revisiting, in his Mansion House speech of 22 October 2026, alongside a warning against tickbox compliance. The Bank of England and FCA survey of 26 October found accountability named with business owners and executives far more often than with the board. The page holds where oversight should sit; no regulator has proposed a replacement model.

PartialShould an organisation block consumer AI tools or govern their use?#

Sweden's Government Offices blocked them: from 26 October 2026, as Decrypt reported via Yahoo, staff computers were blocked from ChatGPT and Claude with one approved tool left, its digitalisation director citing information-security consequences of use without a contract and several examples of problematic use. The page holds what happens when people work around the policy; no comparison of blocking against governing has been published.

OpenWhat AI risks could be material to this company?#

Open, and materiality is the operative word. Most AI risk registers list generic harms rather than the two or three exposures that could actually move this company's numbers or licence to operate. The generic list is easier to write and does not help a board prioritise.

OpenWhat happens to continuity planning if AI becomes critical infrastructure?#

Open. Continuity plans assume a manual fallback staffed by people who know the manual process. That assumption is the one this research questions, and it sits in plans nobody has revisited.

OpenWho verifies that a vulnerability our AI vendor says it fixed is fixed?#

Nobody, in the one public case: METR said on 22 October 2026 that OpenAI reports the monitoring gaps it found are patched and that METR has not evaluated that claim. A board can ask the same of its own vendors; a re-test clause in the contract, or a regulator's check, would settle it.

OpenIf our people sign off AI recommendations, can we show their judgement was their own?#

Almost certainly not, and the instrument now exists to check. Anthropic's randomised trial of 27 October 2026 found 50 professionals adopting an agent's coin-flipped lean 86 per cent of the time, with experience and expertise predicting nothing and the authors noting deferral is hard to detect. A record of the decision-maker's own view, taken before the agent speaks, would be the evidence; no organisation has published one.

OpenAfter DSIT's abolition, who in government is accountable for AI regulation in the UK?#

The Commons Science and Technology Committee took evidence from the AI minister and the Director General for AI on 21 October 2026; the transcript was not yet published. A September witness said no Secretary of State should 'mark their own homework'. A published allocation of AI responsibilities across departments would settle it.

OpenShould authority move to the AI along with accountability?#

Das Narayandas argues in Harvard Business Review (November 2026 issue, read only in its published summary) that organisations should redesign roles so 'accountability moves with authority' rather than leaving people liable for systems they cannot change. No organisation has published a decision-rights chart that does this; one that did would be the first evidence.