Is Innovation Outpacing Responsible AI?
The management question is not whether to โallowโ AI, but how to industrialise decision-making around it. For CIOs and transformation leaders, the practical issue is who can approve use cases, who owns risk acceptance, and how exceptions are handled when business units want speed. If responsible AI sits only with a central policy team, it can become a bottleneck; if it sits nowhere, shadow AI will fill the gap.
This makes governance a portfolio discipline, not a compliance afterthought. Leaders should expect different review paths for low-risk productivity tools, customer-facing applications and high-impact decisions. The trade-off is clear: faster experimentation versus stronger controls. The right operating model gives teams predictable thresholds, documented decision rights and a light-touch path for low-risk use cases, while reserving deeper scrutiny for the few that can affect rights, safety, reputation or regulated outcomes.
The more useful question for the board is what evidence proves the programme is working. Mature responsible AI needs metrics beyond โpolicy completedโ or โtraining deliveredโ: cycle time for review, percentage of use cases assessed before launch, number of exceptions approved, incidents detected, and whether risk gating is changing product outcomes. Without those indicators, leaders cannot tell whether the programme is reducing friction or simply adding another layer of process.
There is also a workforce implication. AI fluency is becoming a management capability, not a specialist one, so ownership should extend beyond the ethics lead to product, legal, security and business sponsors. Next questions for executives: Which AI decisions require board visibility? What is the minimum control set for each risk tier? And who has the authority and funding to stop, slow or redesign a use case when the risk profile changes?
-
Mapping trust domains to generative AI
-
Fairness and impartiality
-
Transparency and explainability
AI Adoption Versus Responsible AI Adoption
While the adoption of both AI and responsible AI adoption have increased, the path to risk mitigation and driving business value can be realized more easily if companies prioritize responsible AI. For example, Boston Consulting Group (BCG) and MIT teamed up on some surveys, one of which found that 20% of companies have responsible AI programs, 30% have nothing, and the rest fall somewhere in between. โThere wasnโt a lot of correlation between AI maturity and responsible AI maturity. Interestingly, youโd think all the really mature [organizations] would also have mature responsible AI,โ says Steven Mills, managing director and partner and chief AI ethics officer at BCG. โWhen we dug into the data, we found that it was advantageous to scale responsible AI ahead of AI.โ Related:7 Top IT Challenges in 2024 The reason for that is by tackling responsible AI first, system lapses happen less frequently, and organizations are able to drive more value from their AI investments. โItโs less about guardrails and policy, and more thinking about uses cases and outcomes. Iโve always told people the policies you create, the risk frameworks you create cannot be static, they have to evolve over time as you learn,โ says Mills. Mills set an example at BCG, for example. He updated the policy four or five times during the first 12 months of the generative AI explosion because there were use cases that needed more eyes on them. โYou have to accept that you learn as you go. You also need a tracking function to understand how the technology is evolving. What new risks are popping up?โ says Mills. It also helps to have someone whoโs responsible and accountable for a responsible AI program, such as a chief ethics officer. If thatโs not practical, maybe a CIO or CTO might spearhead the effort or in the case of small companies, the CEO. However, driving value requires the support of the organization, meaning the chief ethics officer or other responsible person has the financial and human resources they need to drive action. Related:Does Your Organization Need a Dedicated AI Leader? It turns out that the companies best equipped to manage AI risks out of the gate operate in highly regulated industries because they already know how to model risk management.Bottom Line
Todayโs organizations are more likely to have a responsible AI program than they were just a couple of years ago because they realize there are AI-related risks, more regulation is coming that will require compliance and they want to drive as much value as possible. Mature responsible AI programs are more likely to achieve all three, though most companies still lack a mature responsible AI program. While not all organizations have the deep pockets larger organizations enjoy, they are nevertheless wise to have a responsible AI program in place and someone to lead the effort. Just remember that person needs adequate resources and the authority to run a successful program.Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.
