You Can Outsource AI Technology. You Cannot Outsource AI Accountability.
Example Case Study: AI-Powered Hiring Model
Consider this scenario.
An AI Provider develops an AI-powered hiring model. An HR department in the organization integrates the model into its recruitment process, and recruiters use AI-generated scores to evaluate candidates.
Several months after deployment, the AI developer (organization) discovers that the system consistently disadvantages certain groups of applicants.
Who should be accountable?
The AI Provider who developed the model?
Or the AI Deployer who chose to implement it?
From my experience, many people instinctively point to the AI Provider.
However, one of the key concepts in AI Governance is that accountability follows decision-making authority.
In many cases, this translates into operational accountability resting with the AI Deployer.
While the AI Provider developed the model, the AI Deployer decided how the model would be used, integrated it into business processes, determined the influence of AI scores on hiring decisions, and accepted the operational risks associated with deployment.
A common misconception is:
"If the AI comes from a third-party provider, the risk belongs to the provider."
In practice, regulators, employees, customers, and other stakeholders rarely see it that way.
When AI influences decisions that affect people, the AI Deployer remains responsible for ensuring appropriate governance, human oversight, fairness, and post-deployment monitoring.
This is also reflected in governance frameworks such as ISO/IEC 42001, which emphasizes continual improvement through the Plan-Do-Check-Act (PDCA) cycle, including ongoing monitoring and evaluation after deployment.
The critical questions are not only:
• Was the model tested?
• Was the AI Provider reputable?
• Did the procurement process include appropriate due diligence?
But also:
• How is the model being used in real-world decisions?
• What level of human oversight exists?
• How are outcomes monitored after deployment?
As organizations move from AI experimentation to enterprise AI adoption, they must shift their mindset from AI procurement to AI accountability.
Throughout my legal and governance experience, one lesson has remained consistent:
Organizations may outsource AI technology, but they cannot outsource AI accountability.
