How Can Organizations Demonstrate They Exercised Due Diligence After an AI Failure?
AI failures will happen.
Even well-designed AI systems may produce inaccurate outputs or recommendations.
The important governance question is no longer simply:
"Why did the AI fail?"
It is increasingly becoming:
"Can the organization demonstrate that it exercised appropriate due diligence?"
Having worked in both legal and operational leadership roles, I have learned that good governance is not demonstrated by intentions alone, but by clearly assigned responsibilities and documented evidence.
When an AI-related incident occurs, regulators, auditors, business partners, insurers, customers, and courts may examine whether the organization exercised reasonable care before, during, and after deploying AI.
One way to demonstrate this is through a well-defined governance structure.
The IIA Three Lines Model provides a practical framework:
First Line – Business and Operations implement and operate AI responsibly.
Second Line – Risk, Compliance, Legal, and AI Governance establish oversight and monitor AI risks.
Third Line – Internal Audit provides independent assurance that governance and controls are operating effectively.
Together, these three lines help organizations demonstrate accountability, oversight, and independent assurance across the AI lifecycle.
Evidence may include:
• A documented AI governance framework.
• AI risk assessments appropriate to the intended use case.
• Clearly assigned governance responsibilities.
• Human oversight over significant AI-assisted decisions.
• Testing and validation before deployment.
• Ongoing monitoring for performance, reliability, and emerging risks.
• Incident reporting and escalation procedures.
• Records showing how AI-generated outputs were reviewed and acted upon.
None of these controls guarantee that AI failures will never occur.
Ultimately, the Board and Senior Management remain accountable for ensuring that appropriate AI governance structures are established and effectively overseen.
Good AI Governance is not only about reducing AI failures.
It is about demonstrating that appropriate governance, oversight, and evidence existed before the failure occurred.
AI can generate outputs.
Organizations generate accountability.
Good AI Governance helps demonstrate that accountability when it matters most.
