Most organizations that have thought seriously about AI can produce a principles document: fairness, transparency, human oversight, accountability. Far fewer can answer a narrower, more useful question — when a specific deployment conflicts with one of those principles, who has the standing to stop it, and has that authority ever actually been exercised.Principles Without a Veto Are AspirationsA principle becomes a control only when it is backed by someone who can act on it before the fact. Without that, a responsible-AI document functions as a communications artefact — genuinely meant, and genuinely disconnected from the deployment decisions it was written to shape.What Real Authority Looks Like HereA named reviewer, not a committee that meets quarterly: a deployment decision usually cannot wait for the next scheduled meeting, and a review process that cannot keep pace gets routed around.A defined threshold for what needs review: reviewing every AI-touched change makes the process too slow to survive; reviewing none of them makes it decorative. The threshold is the actual governance decision.A real 'no,' exercised at least once: a review function that has approved every request it has ever seen has not yet been tested, whatever its charter says.A record of what was decided and why: the same evidentiary standard applied to any other governance decision — recoverable later, not reconstructed from memory after an incident.“The test of a responsible-AI programme is not the document it produced. It is the deployment it actually delayed.”Sizing It to the OrganizationNone of this requires a large standing function — a small organization can put real authority behind its principles with one accountable reviewer and a clear threshold for escalation. What it cannot do is treat the principles document itself as the control. The document states the intent; the veto, exercised when it needs to be, is what makes the intent real.Share this articleX (Twitter)LinkedInFacebookCopy Link
AI GRC WorkflowsJun 25, 2026Where AI Governance Actually Belongs in a GRC ProgrammeStanding up a separate AI governance committee is the easy part. Connecting its decisions to the risk register everyone else already reports against is the part that determines whether it matters.
AI SecurityJul 30, 2026The Model Supply Chain Most Security Reviews MissA security review that stops at the application layer never asks where the model came from, what it was trained on, or what changed the last time it was fine-tuned.
ISO 42001Jun 11, 2026The AI Use-Case Inventory an Audit Will Actually Ask ForAn AI management system audited against an inventory that only covers the initiatives IT formally approved will miss most of what the organization is actually running.
