Who Signs Off When AI Decides? Lessons for CLOs and GRC Leaders
A prospect asks a software vendor, “Is your product AI powered?” The vendor says yes. The prospect says, “Great, that’s what we need.” End of conversation.
That scene opened The Millennium Alliance Enterprise Legal & GRC Assembly in Phoenix this September, and it set the tone for two days. Jan Stappers, EVP, Solutions Strategy at Mitratech, said it worries them. Not the answer, but how quickly the questions stop. (Both keynotes came from Millennium partners. The views below are the speakers’ own.)
The short answer: when an AI system shapes a decision, the person whose name is on the work still owns the outcome. What most organizations can’t do yet is show how the decision was reached. Speakers in Phoenix said that gap is where the legal and regulatory exposure sits, and that many of the people carrying it don’t realize they are.
What delegates told us before they arrived
Ahead of every Assembly, we ask registered delegates to describe their department’s objectives. For the Phoenix event, those pre-event answers came from a room where just over half held legal titles and about three in ten worked in risk, compliance or privacy.
AI came up more than anything else. Just over half named it among their objectives. But fewer than four in ten of those mentions were about governance, policy or risk. Most described adopting or implementing AI. Risk and compliance programs were the next most common theme, named by about four in ten.
Put that next to Stappers’ warning and the picture is clear. Adoption is the stated goal. Being able to defend it is a smaller part of the conversation.
The two groups wanted different things from the same technology. GRC leaders leaned toward compliance, AI governance, privacy and cyber risk, and about one in three named AI governance as an objective. For chief legal officers it was closer to one in nine. They leaned toward growth and organizational change, efficiency, and putting AI to work on legal tasks and contracts. About the same share of each group mentioned AI at all. One is asking how to govern it. The other is asking how to use it.
Is “AI-powered” an answer or a box to check?
According to Stappers, AI has become one more item on a checklist. “It seems that a lot of organizations nowadays have a kind of list of boxes to check. AI is one of them. They check that box and carry on, and that’s incredible risk.”
What gets skipped is the follow-up. “So few people in organizations ask the second and third and 210th question,” Stappers said. What does the AI actually do? How is it set up? Where does the data sit?
Staying cautious doesn’t protect you either. Stappers described organizations that held back and kept working in spreadsheets. The catch: “the compliance department is working on spreadsheets, and meanwhile, the rest of the organization goes berserk on AI.”
Either way, the business is using AI, and the people responsible for oversight need enough visibility to ask real questions. Contract leverage makes that harder. A company with 500,000 employees might get an answer about how a vendor’s prompts work. A company with 3,000 or 10,000 will usually hear that it’s proprietary. For those who can’t win on terms, Stappers suggested keeping a record. Write down what you asked and what worried you, so the file shows a considered decision and not a blind click.
Could you replay an AI decision for a regulator?
This was the sharpest theme in the room. Stappers said the question is shifting: “the question is not so much about, well, what was the output? It is how did that output occur?” Boards, in Stappers’ view, mostly care about adoption and results. The people asking how are in governance and compliance, and increasingly regulators.
Why is that so hard? Most organizations build the paper trail after the fact. As Stappers described it, “the evidence of what happens in an AI model is pulled together when somebody asks for it, not when … the infrastructure is being designed.”
Then there’s repeatability. Feed a model the same input weeks later and it can give a different answer, with no clear reason why. If an auditor or regulator comes asking, the honest reply may be a shrug with a caveat: “You can say most likely, but you cannot prove it.” For a legal team, that’s a weaker position if a dispute follows.
A popular shortcut doesn’t close the gap. Plenty of teams connect AI to their existing risk tools with a connector and a dashboard. Those tools were built before AI was part of the picture, Stappers said, so the dashboard can show outputs without explaining them.
On enforcement, Stappers was realistic. US enforcement is light today. The SEC has addressed AI washing, and a recent Colorado AI law points toward more governance. Europe already has more rules in place, including the AI Act. Waiting for a crackdown before you set priorities is a choice, and the evidence gap is there whether or not anyone enforces.
Who signs off when AI decides?
On liability, Stappers didn’t soften it. Pointing to Sections 302 and 906 and to SOX liability, they said “even if an algorithm made a decision compared to a human being, that doesn’t take you off the hook.”
The people doing the work seem to know it already. Natalie Runyon, Director of Content & Advisory Services at the Thomson Reuters Institute, shared findings from the Thomson Reuters Future Professionals 2026 report. Forty-seven percent of professionals said final responsibility for an AI-assisted error sits with the individual. Runyon’s reading: “This is the accountability structure that your people are already operating under, whether or not your organization says so explicitly.”
That raises the question of who reviews the output before it’s treated as fact. Stappers called it one of the most overlooked checks, and said why it’s hard: “That is so challenging in many organizations because basically no one wants to be that reviewer, no one wants to be responsible.” Handing it to one person in one corner of the business won’t hold up either.
The usual fix creates its own problem. A company forms an AI team and considers the job done. Stappers drew the line back to earlier data protection programs: “You create a new silo in the organization, which again leads to lack of oversight, lack of knowledge, lack of understanding of AI.”
Why does AI strategy stall inside legal and compliance teams?
Runyon opened by noting that most AI sessions on the agenda were about protecting the company. Hers was about the colleague “three doors down” in legal, risk or compliance who is getting AI strategy wrong, “Not because they’re careless, but because no one ever told them what right looks like.”
The research surveyed roughly 1,800 professionals across tax, accounting and audit, global risk and compliance, and legal. Among those at organizations with a named AI strategy, 35% said they couldn’t see it in their daily work. Another 17% said their organization had no direction on AI at all. Runyon’s takeaway: “half of the individuals in these fiduciary professions are guessing what the organizational AI strategy is and how it shows up in their day to day work.”
When professionals were asked what’s holding things back, only one of the top four answers was about tools: not having the right ones in place. The rest were about people. Not enough training, a strategy that hadn’t been turned into priorities, and no shared understanding of it. Runyon’s read: “All four barriers are human behavior challenges and change management and not technology problems.”
Two more findings from the session are worth keeping on hand, as Runyon presented them.
| What the Research Found | Figure |
|---|---|
| Professionals who said AI is meeting or exceeding expectations, where an active AI strategy exists | 66% |
| Same measure, where there is no active strategy | 22% |
| Professionals who feel a gap between what AI promised and what it delivers and are considering leaving within two years | 26%, at an estimated replacement cost of $232,000 each |
Runyon also had a procurement point for your next vendor review. Professionals want tools that protect confidential data, ground their outputs in authoritative content, and produce reasoning that can be explained and defended. Yet 41% of those using AI at work don’t have tools that meet those standards. Runyon’s challenge: “it’s a procurement decision that you are making today by default rather than intentionally.”
The two keynotes came at it from opposite ends, one from audit trails and one from people, and landed in the same place. If your name is on the work, you need to be able to explain it.
What to take back to your team
None of this requires a new tool. It starts with a few conversations.
Ask the second question. Before accepting “AI powered,” ask what it does, how it’s configured, how it reaches outputs and where the data sits. If you can’t negotiate the terms, write down what you asked and what concerned you.
Name the reviewer. Decide who checks AI output before anyone treats it as fact, and make sure that person can see enough to do it. Keep the effort cross-functional, as Stappers encouraged, so AI doesn’t end up in a silo.
Test your own strategy. Runyon suggested asking three people at different levels what the AI strategy means for their work this week. If the answers differ a lot, something is getting lost in translation.
Set the bar before the next purchase. Protect confidential data, ground outputs in authoritative sources, and insist on reasoning you can defend.
Build on what you already have. One delegate from a safety-critical industry described mapping AI and cyber risk onto the company’s existing safety management system instead of starting from scratch. That kept the work right-sized: “let’s not boil the ocean, let’s just figure out what’s going to work for us.”
Where the conversation goes next
The Millennium Alliance Enterprise Legal & GRC Assembly returns on February 9-10, 2027 at the Grand Hyatt in Nashville. The planned agenda includes sessions on what the shift from voluntary guidelines to enforceable AI law means for the board, and on real-time compliance verification beyond the annual audit cycle. Details are at mill-all.com.
About The Millennium Alliance
Founded in 2014, The Millennium Alliance is a premier technology and business advisory firm dedicated to transforming the digital enterprise. By bridging the gap between enterprise C-Suite leaders and their technology partners, we’ve become a global leader in corporate-level executive education and peer-to-peer engagement. Learn more at mill-all.com.
