Who Is Accountable When an AI-Drafted Strategy Goes Wrong?

When an AI-drafted strategy recommendation proves wrong, the accountability sits with named humans in the decision chain – not the tool. The question is which humans, and the honest answer is: three roles that are often blurred together or held by the same person, which is where the risk concentrates.

This article covers the three roles and why conflating them creates risk; the written governance document that assigns accountability before a decision is taken; the EU AI Act's obligations on human oversight; and the minimum five-field sign-off record that makes a decision trail reconstructable when it needs to be examined later.

• The three accountability roles: brief-writer or prompt owner, reviewer or sign-off authority, decision-maker.
• The written governance document: what it must contain and why ISO/IEC 42001 treats traceability as a design requirement.
• EU AI Act Article 14: the human-oversight obligations for high-risk AI systems.
• UK Corporate Governance Code Provision 29: board declarations on material internal controls from financial years beginning on or after 1 January 2026.

A strategy recommendation drafted with AI assistance has no single human author. One person frames the question, another supplies the data room, a third shapes the prompt, a fourth reviews the output and a fifth takes the decision to the board. When the recommendation later proves wrong, each of them can point to someone else. This is the classic many-hands problem, made sharper by AI, because the drafting step that used to leave a visible trail of working papers now happens inside a tool that leaves none by default.

The forensic view is blunt. EY's forensic and integrity services teams note that in many AI deployments documentation is limited and decision pathways are not designed to be reconstructed after the fact, which makes it difficult to explain, audit or investigate AI-driven outcomes when they are challenged.^[1]

The Stanford HAI AI Index reports the AI Incident Database recorded 362 documented AI incidents in 2025, up from 233 in 2024.^[2] The share of businesses with no responsible AI policies fell from 24% to 11%. The gap that remains is between policy and practice.

What goes missing when the trail is not written down

• The question: no one can show which version of the brief or prompt produced the analysis, or who approved that framing.
• The inputs: documents and data the AI drew on are scattered across uploads, chats and personal folders.
• The review: what the reviewer challenged, corrected or accepted is often invisible.
• The decision: the moment of choice, and the person who made it, are buried in a meeting or email thread.
• The tool state: the platform version, model and settings used are not captured.

None of this is solved by asking people to be more careful. It is solved by a written artefact that assigns each element to a named human before the decision is taken.

Accountability for an AI-assisted strategy recommendation is shared across three distinct roles. Conflating them – for instance, having the same person write the brief, review the output and take the decision – concentrates risk and makes independent challenge structurally impossible.

• The brief-writer or prompt owner owns the question asked and the inputs supplied. Accountability includes ensuring the framing is complete, unbiased and represents the decision the organisation actually needs to make.
• The reviewer or sign-off authority owns challenge and validation of the analysis. Accountability includes interrogating the output, checking sources, identifying gaps and escalating if the analysis cannot be substantiated.
• The decision-maker owns the choice and its consequences. Accountability includes weighing the recommendation against context the analysis may not have captured, and accepting responsibility for the outcome.

Separating roles does not require new headcount. It requires the governance document to state who holds each role for each significant decision. This mirrors the shared-responsibility model used in AI governance frameworks: developer, deploying organisation, user. Each layer carries accountability for what it contributes; none can discharge its own by pointing to another.

Failure modes appear when one person holds two or three of these roles. The most common conflation is the brief-writer who also conducts the review – there is no independent challenge, and no one with a different perspective looking at whether the question was asked in a way that could only produce one answer.

A defensible AI governance document for strategy decisions has two parts: a standing policy that describes the three roles and the escalation path, and a per-decision sign-off record that documents, for each significant decision, who held each role and what each one did.

ISO/IEC 42001 requires defined roles and responsibilities for AI systems, maintained documentation of AI lifecycle decisions, and decision traceability.^[3] The minimum the standing policy must cover:

1. Named individuals per decision tier – specific people, not job titles, so accountability is personal and cannot be deflected to a role that has since changed hands.
2. An escalation path – what happens when the reviewer is unavailable, or when the brief-writer and reviewer are the same person.
3. The analysis version attached – the date, platform and version used, and the brief or prompt as submitted.
4. The sign-off date and method – minuted meeting, e-signature, or written approval.

Why version attachment matters

The version attachment is the field most teams skip and most investigations need. The same brief run on a different platform version, model or configuration can yield a materially different recommendation. Without the version on record, nobody can reconstruct what the decision was actually made on. ISO/IEC 42001's traceability requirement covers exactly this.

What the escalation path looks like in practice

The escalation path answers three questions in advance: (1) If the designated reviewer cannot complete the review before the deadline, who is the deputy? (2) If the analysis supports an option the brief-writer clearly favoured, the review must be completed by someone who did not shape the brief. (3) If the decision tier rises – from team recommendation to board paper – sign-off must move up with it.

The most useful distinction in AI governance is between AI-assisted – where a human decides on the basis of the analysis – and AI-decided – where the system's output is actioned without meaningful human review. The second is where accountability collapses into the tool, which under current law has no legal personality and cannot be held responsible.

The EU AI Act's human-oversight obligations sit in Article 14.^[4] For high-risk AI systems under Annex III, Article 14 requires that natural persons overseeing the system:

• Properly understand the system's capacities and limitations.
• Remain aware of automation bias – the tendency to over-rely on the system's output.
• Correctly interpret the system's output.
• Be able to decide, in any particular situation, not to use the system or to override or reverse its output.

For high-risk systems under Annex III, these obligations apply from 2 December 2027. Firms that build governance structures now – while the obligations are still anticipated rather than enforced – have the advantage of getting the documentation right before scrutiny increases.

The AI-assisted versus AI-decided classification belongs in the sign-off record. It forces the organisation to confront the line at the moment of decision, when it can still be corrected, rather than in a later investigation when the distinction matters and the evidence is gone.

The UK Corporate Governance Code 2024 applies to premium-listed companies for financial years beginning on or after 1 January 2025, on a comply-or-explain basis.^[5]

Provision 29, which applies from financial years beginning on or after 1 January 2026, requires boards to make a declaration on the effectiveness of their material internal controls. An AI-informed strategy process – where recommendations that go to the board are produced with AI assistance – is exactly the kind of material internal control a board must be able to declare on.

What the declaration implies in evidence

• A documented process: the accountability policy exists, is current, and names owners.
• Per-decision records: sign-off records exist for significant AI-assisted analyses, with the analysis version attached.
• Oversight evidence: the record shows genuine challenge, including cases where the reviewer overrode or escalated.
• Board visibility: the board or its committees can describe how it monitors the framework.

The comply-or-explain mechanism provides a safety valve: a company that has not yet built the trail can explain what it does instead and why. But the explanation must be meaningful. Explanations that amount to "we trust the team" are unlikely to satisfy regulators or shareholders if a wrong AI-assisted recommendation becomes a governance incident.

A defensible sign-off record needs five fields. The first four ensure the trail is reconstructable; the fifth is the classification that makes accountability explicit at the moment it matters.

The fifth field is the one most teams find uncomfortable, because it forces a public answer to a question most prefer to leave ambiguous. But it is the field that, more than any other, creates the accountability the governance structure is supposed to deliver.

This example is illustrative. A corporate strategy team prepares a recommendation on entering a Southeast Asian market using an AI-native strategy platform.

1. Brief and inputs: the analyst submits a brief and uploads market studies and internal financials. The sign-off record carries the brief text, the document list and the date submitted.
2. Analysis version: the platform returns a recommendation with cited sources. The record attaches the analysis version – platform name, model version and date of generation.
3. Review: the group director of corporate development acts as reviewer. She challenges market-size assumptions, verifies cited sources and asks for a rerun with a broader option set. She signs off by e-signature, with a date recorded.
4. Decision classification: the chief strategy officer classifies the decision as AI-assisted. The classification is recorded before the recommendation moves upstream.
5. Board paper: the recommendation goes to the board with a provenance note. The sign-off record is filed with the paper.

Eighteen months later the market entry underperforms. The trail shows: who decided, on what evidence, and with what oversight. Not that the recommendation was right – it was not – but that the accountability for it was never in doubt, and the organisation can examine what happened without a dispute about who was responsible for what.

Decisity is an AI-native strategy consulting platform that attaches source citations to every claim and keeps the analysis traceable to its inputs, making the version attachment and the claim-to-source map part of the standard workflow rather than an additional documentation burden.

Related reading:

• AI Governance Framework for Boards
• AI Risk Management for Boards: A Framework for Directors
• AI Model Version Disclosure: What Your Board Needs to Know
• Why AI Strategy Decks Get an Easy Review: The Governance Fix

• EY Forensic & Integrity Services: The governance and accountability gap in AI adoption
• Stanford HAI AI Index 2026: Responsible AI
• ISO/IEC 42001: AI Management Systems Standard explained
• EU Artificial Intelligence Act: Article 14, Human oversight measures
• Financial Reporting Council: UK Corporate Governance Code 2024