Responsibility normally attaches to people and organisations — developers, deployers, employers, service providers or other actors — through existing legal duties. An AI system does not become a convenient legal person that automatically absorbs everyone else’s responsibility.
Ask who has authority and accountability
AI governance sounds abstract until you turn it into ordinary questions: who owns the system, who can approve high-impact actions, what is logged, who can stop it and who is accountable when something goes wrong.
Existing laws can apply to harmful outcomes even when AI is part of the process. That matters because responsibility only becomes meaningful when someone has the authority and the controls to change what happens next.
What matters in practice
Existing laws can apply to harmful outcomes even when AI is part of the process.
Rules only matter when they connect to a real decision-maker and a real control. A policy without ownership, monitoring or enforcement can look reassuring while changing very little in practice.
Responsibility can depend on who designed, supplied, deployed, controlled or relied on the system.
Different sectors already have different obligations, which is why “is AI regulated?” rarely has a useful one-word answer. The relevant question is which law, regulator or contract applies to the actual use case.
Logs, human oversight and documented decision processes matter when reconstructing what happened.
Technical and organisational controls work together. Permissions, approval thresholds, logs and shutdown routes give governance something concrete to act on when risk changes.
What rules can — and cannot — do
Governance claims often sound stronger on paper than they are in practice. The important distinction is between a published rule and a control that is owned, monitored and capable of changing what a system can actually do.
- Liability is fact-specific and can involve multiple legal regimes.
- This page cannot determine liability in an individual dispute and is not legal advice.
What could change the answer?
The assessment should change when authority, permissions or accountability change. A new policy matters less than a new approval gate, logging requirement, regulator decision or tested shutdown route that alters real behaviour.
What you can do now
Turn broad principles into controls someone owns. Named responsibility, limited permissions, approval gates, logs and a tested escalation route are more useful than a policy document nobody can enforce.
- Keep records of model version, inputs, outputs and human approvals for consequential uses.
- Do not assume a vendor disclaimer automatically removes your own obligations.
- Seek qualified legal advice where actual loss, injury or regulatory exposure exists.
A four-question reality check
When a claim sounds dramatic, work through these four questions before deciding how much weight to give it.
What can the system demonstrably do?
What tools, credentials and networks can it actually reach?
Can it keep operating after errors or intervention?
What real-world outcome follows if safeguards fail?
Bottom line
Governance does not guarantee that an AI system cannot fail. It makes responsibility clearer and gives people more places to interrupt a bad chain of events before the consequences grow.
Responsibility normally attaches to people and organisations — developers, deployers, employers, service providers or other actors — through existing legal duties. An AI system does not become a convenient legal person that automatically absorbs everyone else’s responsibility.
Sources & further reading
These links are selected for the claims and methods discussed above. Primary or official sources are preferred where available.
Two useful questions
What is the biggest caveat?
Liability is fact-specific and can involve multiple legal regimes. This page cannot determine liability in an individual dispute and is not legal advice.
What is the most useful next step?
Keep records of model version, inputs, outputs and human approvals for consequential uses. Do not assume a vendor disclaimer automatically removes your own obligations.