AI accountability cannot rest on the line "the AI said it, not us". In 2024, an airline in Canada tried exactly that argument after the chatbot on its website gave a customer wrong information about its refund policy. The tribunal rejected it: the chatbot was part of the airline's own website, and the airline was responsible for what it said.
Inside a company the risk grows quietly, because AI takes on more each step: answering questions, then drafting quotes and orders, then proposing the figures in them. Most suggestions are sensible, so confirming becomes a habit rather than a check. When a suggestion causes a loss, responsibility has no clear owner: the user points to the AI, the implementer to the user, the vendor to the fact that AI only suggests.
The consequences still belong to the company. This article sets out a practical approach to AI accountability: four levels of authority for AI, the roles of requester, checker and approver, and how to trace, stop and fix things when AI gets it wrong.
Suggest, draft, decide, execute: four levels of authority in AI accountability
"Using AI" covers four very different levels of authority. The difference is not how clever the AI is, but who presses the final button and how far the result travels before a person sees it.
| Level | What AI does | Example | Where the person stands |
|---|---|---|---|
| Suggest | Points out an option or a risk | "This customer usually gets 5%" | Decides and does the work |
| Draft | Prepares a document for someone to finish | A draft quote with the discount filled in | Reviews, edits, sends |
| Decide | Chooses within a rule; a person may review later | Approves discounts up to 3% on repeat orders | Sets the rule, checks samples |
| Execute | Carries the action out of the company | Sends the order to the supplier | Learns of it afterwards |
The higher the level, the later a person sees the result, and the more the checkpoint must be designed in advance.
The line that matters most lies between drafting and deciding. At the first two levels a person still makes the choice and AI accountability is simple: the person who confirms answers for it. From the third level on, the choice is made by a rule someone set earlier, so responsibility moves to whoever set that rule and whoever was meant to check it.
The trade-off is speed against reach. Higher levels save more time, but an error can reach a customer or a supplier before anyone sees it. That does not mean AI should never decide or execute. For internal, small and easily reversed actions, such as sorting incoming requests or drafting a reminder, the cost of a person checking every case is higher than the cost of the occasional mistake. Keeping AI at "suggest" there only adds clicks.
Requester, checker, approver, accountable person
AI accountability rests on the same four roles as any other control in a company. When AI joins the work, the role that quietly disappears is usually the checker.
Requester
Starts the transaction and answers for its purpose. If AI drafted it, the person who sent it on is still the requester.
Checker
Compares the content with the facts: price list, cost, stock, contract. This is the step people assume "the AI already did".
Approver
Accepts the risk within their limit. Approving is not the same as checking, and approval without checking is only a signature.
Accountable person
One named person who answers for the result of a whole area, including the rules AI works by. Not "the AI team", and never the AI.
Common signs: AI proposes a larger discount for a big order, based on the customer's buying history. The salesperson confirms, because the target is monthly revenue. The sales manager approves, because the discount is within their limit. Nobody notices that the cost of the main material has risen, and the order loses money. Both acted within their role. The loss comes from a missing checker: the history the AI used did not include today's cost, and no one was assigned to compare the two.
Sales wants the order, finance wants the margin. Both views need checking before anyone clicks confirm.
The company cannot transfer this responsibility to the AI. In a 2024 case in Canada, an airline's website chatbot gave a customer wrong information about a refund policy. The airline argued that the chatbot was responsible for its own answers. The tribunal rejected that, saying it should be obvious that the company is responsible for all the information on its website. This is one small-claims decision in one province, not a general legal rule. But it shows the direction of the argument: to a customer, the AI's answer is the company's answer.
Separating checker from requester costs time, and a small company may not have enough people. Then one person can hold two roles, provided the trail is complete and someone else reviews a sample later. What must never happen is the same person setting the AI's rule, using it and judging whether it works.
Risk thresholds by value and type of transaction
If every AI action needs the same approval, one of two things happens. Either the approver is flooded and starts approving without looking, or the company stops using AI because it slows everything down. The way out is to set thresholds, the same way a company sets spending limits for its staff.
Value is only one factor. Three others matter as much: whether the action can be undone, whether it leaves the company (to a customer, a supplier or the bank), and whether it is routine or new, such as a first order with a new supplier.
| Risk level | Typical work | What AI may do | Human control |
|---|---|---|---|
| Low | Internal, small, reversible | Decide or execute | Sample checks each week |
| Medium | Routine quotes and orders within limit | Draft and propose | The owner of the work confirms |
| High | Above limit, price below floor, new partner | Suggest and flag | A checker and an approver, two people |
| Not delegated | Bank details, contract terms, staff decisions | Provide information only | People decide and do |
A threshold depends on value, reversibility, external reach and novelty, not on value alone.
For AI accountability, thresholds work only when AI follows the same four rules as staff: who may see what, how much may be spent, who approves, and who changed what. AI should never have a higher limit than the person who uses it, and an action AI proposes should go through the same approval route as one a person proposes. Who may see which data is a topic of its own, covered in the next article.
Thresholds age. When prices, customers or suppliers change, a limit that was safe last year may not be today. They need an owner and a review date, like any other company rule.
Data, reasoning, process or supervision: four kinds of error
"The AI got it wrong" is a description, not a diagnosis. The same loss can come from four different causes, and each has a different person who must fix it.
Common signs: AI proposes a large materials order based on expected demand, the buyer confirms, the material arrives but sales do not follow, and the company is left with stock it cannot use for months.
| Type of error | How it could happen with that order | Who fixes it |
|---|---|---|
| Data | Cancelled orders were still counted as demand | The owner of that data |
| Reasoning | AI treated last year's seasonal peak as a lasting trend | Whoever set up and tests the AI |
| Process | The order was split into several small ones, each under the approval limit | The owner of the approval rules |
| Supervision | The buyer confirmed without comparing with confirmed sales orders | The buyer's manager |
This is where AI accountability most often goes wrong: fixing the wrong cause makes things worse. If the problem was data and the company tightens approvals, approvers get more work and the same bad numbers keep coming. If the problem was supervision and the company changes the AI, people will keep confirming without looking, whatever the AI says. Usually more than one cause is present, so an incident review should go through all four before deciding what to fix.
The same excess stock can come from bad data, flawed reasoning, a weak process or a missed check.
Rubber-stamp approval and the habit of trusting the machine
A confirmation step does not protect anything if the person confirming no longer looks. And the more often AI is right, the less people look. Researchers call this automation bias: people tend to over-trust a system that is usually right, both by missing what it fails to flag and by following its advice when other information says otherwise.
| Study | Finding |
|---|---|
| Experiment in a simulated flight task, USA, 1999 | People working without the aid did better on monitoring than people using an aid that was very reliable but not perfect. Those with the aid missed events it did not flag and followed its wrong advice against their training and other correct indicators. |
| Review of studies on automation and decision aids, 2010 | Over-trust appears in both beginners and experts, is not removed by training or instructions, and affects teams as well as individuals. |
| Survey of 319 knowledge workers, 936 real examples of using generative AI at work, 2025 | The more confidence people had in the AI, the less critical thinking they reported. The more confidence they had in their own ability, the more they checked. |
For a CEO this has a direct consequence. An approval step can look healthy on paper while being a formality in practice. The warning signs are measurable: approvals given within seconds, an approval rate close to one hundred percent, and approvers who cannot say what they checked. AI accountability is then only on paper, because a signature exists but no check took place.
When most suggestions are right, confirming turns into a habit. That is when a wrong one gets through.
The evidence has limits. The experiments were done in aviation and laboratory settings, and the 2025 survey relies on what people say about themselves. They do not measure approvals in Vietnamese companies. But the pattern is consistent across decades, and it points to one lesson: telling people to "check carefully" is not enough. The confirmation step itself has to be designed so that checking is easy and skipping it is visible.
Logs, explanations and incidents: the trail of AI accountability
When something goes wrong, the first question is always "why did we do this?". A company can only answer if it recorded five things at the time: which data the AI used and as of when, which rule or version it followed, what it proposed, what the person changed, and who approved and when.
An explanation here does not mean opening up how the AI model works inside. It means a reason a manager can read: "proposed 8% because the customer has ordered every month for the last three months, using the price list of 1 October". If the reason cannot be read, the approver has nothing to check against.
A widely used AI risk framework from the US National Institute of Standards and Technology (NIST AI RMF) asks for the same things in general terms: roles for people and AI are defined and documented; people who did not build or run the system take part in regular reviews; and someone is assigned to override, disengage or switch off an AI system that does not behave as intended. Applied to an SME, AI accountability during an incident comes down to a short sequence:
Stop the AI action in that area
Contain what has left the company
Trace data, rule, proposal, approval
Fix by type of error
Update the threshold or rule
Each step needs a named person decided before the incident, not during it.
The step most often missing is the first one. Many companies can switch AI on, but nobody has clear authority to switch it off for one area while keeping the rest running. Undoing is easier while a transaction is still inside the company, which is another reason to set a later point of no return for actions that leave it.
Four decisions for AI accountability
An authority matrix for people and AI by risk level
For each kind of work, write down what AI may do (suggest, draft, decide, execute), the limit, and the approval route. AI never gets a higher limit than the person using it.
A confirmation step that means something
Show the confirmer what is unusual compared with normal, and the data the suggestion came from. Ask for a reason only on exceptions, so it is not skipped. Review approval speed and approval rates every month.
Record source, version, decision and approver
For every AI-assisted transaction above the low-risk level, keep the five items: data and its date, rule version, AI proposal, human changes, approver and time.
A way to stop, undo and handle exceptions
Name who can switch off AI in each area, how to reverse what it did, and who reviews incidents. Rehearse it once with a real past case.
AI can take over a step of the work. It cannot take over the responsibility. AI accountability is designed in advance, or it does not exist.
Five items recorded at the time are enough to answer "why did we do this?" months later.
An incident review ends with a changed rule or threshold, not only with a person to blame.
Points to keep in mind
Legal liability depends on the country and the field. This article is about management responsibility inside the company. Who is liable to customers, partners or the authorities depends on the law of each country, the contract and the sector. The Canadian case is one example, not a rule for Vietnam. For specific situations, ask a lawyer.
Too many checkpoints also cost money. If every AI action needs two approvals, people will stop using it, or use AI tools outside the company's system where nobody sees anything. AI accountability should be proportionate to risk.
The right comparison is AI versus people as they actually work. People also make mistakes in quotes and orders, often without a trail. Well-designed AI control can make a company easier to check than before, not harder.
The direction Viindoo has chosen
When a salesperson and a sales manager both act within their role and an order still loses money, the cause is usually that the AI worked from buying history without today's material cost, and no one was assigned to compare the two. AI did not remove responsibility; it made the missing checker harder to notice.
Viindoo sees AI accountability as a matter of operating rules, not of how intelligent a model is. If AI is a new kind of team member, it lives under the same rules as every employee: authority, limits, approval routes and a trail. That is the spirit of the Agentic AI business management platform Viindoo is building: the company sets the rules, and the rules apply to people and AI alike.
Applied to this article, the four levels of AI authority (suggest, draft, decide, execute) become a choice the company makes for each type of transaction, not a default. AI stays at suggesting or drafting where the risk is high, and anything beyond its authority goes to a person. A proposal drafted by AI follows the same route of requester, checker and approver as one drafted by a person. And when AI works on the same data as everyone else, the checker compares the proposal with today's cost, not last year's history.
Tight control does not have to mean hard to use. The salesperson only needs to work with AI as with a colleague, while authority, approval routes and logs are kept by the platform underneath. Viindoo takes on that backbone role, so AI is easy for each person and stable and safe for the whole company.
A platform does not decide who is legally liable, and it cannot make an approver read carefully. Choosing thresholds and keeping each approval meaningful remain leadership's part of AI accountability.
Four questions to check where you stand
- For each kind of work where AI is used, is it written down whether AI may suggest, draft, decide or execute?
- Who has the authority to stop or correct AI in each area, and do they know it?
- For the last expensive AI-assisted decision, can you trace which data, which rule and which approver it went through?
- How long do approvers spend on an AI proposal, and how often do they reject one?
Frequently asked questions
Inside the company, the person who confirmed the action and the person who owns the rule AI followed. Toward customers, the company. In a 2024 Canadian case, a tribunal held an airline responsible for its chatbot's wrong answer. Legal liability varies by country and sector.
No. Studies over two decades show that people over-trust systems that are usually right, and training does not remove this. The approval step must show what is unusual and be reviewed for speed and rejection rates.
Yes, for internal, low-value and reversible work, with sample checks. For anything that leaves the company, above a limit or with a new partner, keep AI at suggesting or drafting.
Five items: the data used and its date, the rule or version followed, what AI proposed, what the person changed, and who approved and when. Without them, no one can explain the decision later.
Next in this series: controlling what AI does is one half. The other half is what AI can see. As AI reads more of the company's data and answers more fluently, is it getting easier or harder to control? The smarter AI gets, the harder it is to control?
Sources
- National Institute of Standards and Technology (January 2023). Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1. GOVERN 2.1, GOVERN 3.2, MEASURE 1.3, MANAGE 2.4.
- Skitka, L. J., Mosier, K. L., & Burdick, M. (1999). Does automation bias decision-making? International Journal of Human-Computer Studies, 51(5), 991-1006.
- Parasuraman, R., & Manzey, D. H. (2010). Complacency and Bias in Human Use of Automation: An Attentional Integration. Human Factors, 52(3), 381-410.
- Lee, H.-P., Sarkar, A., Tankelevitch, L., Drosos, I., Rintel, S., Banks, R., & Wilson, N. (2025). The Impact of Generative AI on Critical Thinking: Self-Reported Reductions in Cognitive Effort and Confidence Effects From a Survey of Knowledge Workers. CHI 2025. 319 knowledge workers, 936 examples.
- Moffatt v. Air Canada, 2024 BCCRT 149. Civil Resolution Tribunal of British Columbia, 14 February 2024.
