AI and Governance · 10 minutes · Decision-system mapping · AI governance · Rule ownership
An organization introduces an automated or AI-assisted system to improve speed, consistency, efficiency, or access.
The system may screen applications; assess eligibility; prioritize cases; recommend actions; identify risk; route people to services; flag anomalies; or support staff decisions.
The technology may perform exactly as designed. But a deeper question remains: who owns the decision rule the system is applying?
This question is often harder to answer than expected. The rule may have emerged through an old policy; a spreadsheet formula; a program convention; a technical configuration; staff practice; procurement requirements; historic funding criteria; or a series of informal adjustments.
No single person or function may be responsible for it. Yet once the rule is automated, it can influence hundreds or thousands of decisions with greater speed, consistency, and reach.
Automation can scale not only efficiency, but also ambiguity.
Organizations often describe AI or automated systems as tools. This language can minimize the decisions embedded within them.
A system that ranks, filters, predicts, flags, approves, rejects, routes, or prioritizes is participating in a decision process. Even where a human makes the formal final decision, the system may influence what information is seen; which cases receive attention; how options are presented; which outcome appears normal; and how much effort is required to disagree.
The question is not only whether a human remains involved. The question is how the full decision system operates. That system includes policy; rules; data; models; interfaces; staff; authority; exceptions; appeals; monitoring; and change control. The AI component is one part.
A policy may contain broad language requiring interpretation. Technical teams must convert that language into variables, thresholds, categories, and logic. During that translation, judgement enters the system.
For example: What counts as sufficient evidence? How should missing information be treated? Which factor receives more weight? What threshold changes the outcome? What happens when criteria conflict? These choices may be made during implementation without clear policy authority.
Staff may have developed informal ways of handling common situations. Those practices may never have been formally approved. When a system is built, the informal practice may be encoded because it appears to represent "how the process works." Automation gives the practice new permanence and scale.
A vendor may provide default rules, model settings, categories, or workflow assumptions. The organization may adopt these defaults because they are technically convenient or common across other implementations. But "default" does not mean appropriate. The organization remains responsible for what the system does.
A rule may be shaped by what data is available rather than what the decision actually requires. A proxy becomes necessary because the ideal variable is not collected. Over time, the proxy may be treated as if it were the concept itself. The model begins to define reality according to the available data.
Systems change after launch. A threshold is altered. A new field is introduced. A category is removed. An exception is temporarily handled differently. If change control is weak, the cumulative system may no longer reflect any coherent, approved policy.
Every significant automated or AI-assisted decision rule should have a clearly defined owner. Ownership does not mean that one person designs or controls the entire system.
It means an accountable authority can answer: Why does this rule exist? What objective does it serve? What evidence supports it? Which policy or authority permits it? What data does it require? What risks does it create? Who can change it? What happens when it does not fit a case? How is its performance monitored? When should it be reviewed or retired?
Without ownership, the organization cannot govern the rule. It can only operate it.
Responsible AI governance should begin with the decision process, not the model. A decision-system map should identify the decision point, the applicable rule, the required evidence, the authority, the discretion, the exception path, the consequence, and the monitoring. This structure makes the system governable.
Many organizations respond to concerns about automation by stating that a human remains "in the loop." That phrase is not sufficient.
Human review is meaningful only when the reviewer knows a review is required; receives enough information; understands how the system reached its output; has authority to disagree; has adequate time; has relevant expertise; can access an exception pathway; and can document the reason for changing the result.
A human who simply confirms the system’s recommendation is not providing oversight. They are functioning as an administrative checkpoint.
Human review must specify when it occurs; what triggers it; what the reviewer sees; what authority they hold; how disagreement is recorded; and how recurring disagreements inform system changes.
Standardized systems are designed for recurring patterns. Real cases do not always fit those patterns. An exception pathway should not be treated as a workaround. It should be a designed component of the operating model.
The organization should know what qualifies as an exception; who can identify one; who reviews it; what additional information is required; how quickly it must be resolved; who can approve a departure from the standard rule; and how exceptions are analyzed over time.
Exception data can reveal a flawed rule; incomplete data; a new population; a changing operating context; or a system that is too rigid for the decision it supports. If exceptions are managed informally, the organization loses this evidence.
Technical model performance is important. But a technically strong model can operate within a weak decision system.
The organization should monitor more than accuracy; precision; recall; speed; and system availability. It should also examine unresolved cases; override rates; exception rates; appeals; processing delays; referral failures; service bottlenecks; user experience; distributional patterns; and downstream outcomes.
A model may perform well according to technical measures while the operating system produces exclusion, delay, or inconsistent access. Governance must therefore connect model performance to institutional outcomes.
AI and automated systems are not static. They change through new data; model updates; revised thresholds; policy changes; user feedback; staff workarounds; vendor releases; and operational pressure.
The organization needs a change-control process that records what changed; why; who requested it; what evidence supported it; who approved it; what testing occurred; what risks were identified; when it took effect; and how the impact will be monitored.
Without change control, a system can evolve away from the policy, purpose, or risk tolerance that originally justified it.
Before approving an AI-enabled decision system, leaders should ask:
If the answers focus mainly on technical performance, the governance model is incomplete.
Artificial intelligence can create significant value. It can help organizations analyze information; identify patterns; compare options; reduce administrative burden; and support more consistent decisions.
But the technology cannot answer questions of legitimacy, authority, accountability, or institutional purpose on its own. Those questions must be designed into the operating system.
The organization must know what is being decided; which rules apply; who owns them; where judgement remains; how exceptions are handled; what outcomes are monitored; and who can change the system.
The question is not whether the AI works. It is whether the organization can explain, govern, review, and take responsibility for the decision system around it.
Common Practice maps the rules, decision rights, exceptions, risks, governance, and implementation structures surrounding AI-enabled and automated decisions. We build the system around the tool.
The Decision-System Map — One page: the eight elements, the five origins of an unowned rule, and the questions leaders should ask before approving an AI-enabled decision system.