CoChat
Sign Up
Cited by 0Ethics and Social Impacts of AIDigitalization, Law, and RegulationInformation Technology Governance and Strategy

Who Owns AI When It Breaks? The Convergence of AI Governance and Cybersecurity Accountability

Open access
Montgomery, Jess, Copeland, Joshua·2026·The Pinnacle: A Journal by Scholar-Practitioners
DOI 10.61643/c79060
Open this paper in CoChat — free account

Abstract

Artificial intelligence (AI) system failures are often silent. Applications may remain operational and continue to generate polished outputs even as recommendations degrade, manipulated inputs alter behavior, or automated agents exceed their intended authority. This lack of transparency creates a governance vacuum, obscuring responsibility when AI systems malfunction. The primary concern is not ownership of the AI system itself, but ownership of the consequential decisions the system informs or executes. Drawing on cybersecurity incident research, AI governance literature, and legal case studies, including Robodebt and SyRI, this paper distinguishes system ownership, which concerns maintenance and operation, from decision ownership, which concerns accountability for outcomes. Further, this discussion addresses three structural failures that undermine AI accountability: capability without authority, inclusion without operational integration, and detection without execution. The common assumption that human-in-the-loop oversight provides meaningful control also is challenged, as automation bias frequently renders this safeguard ineffective. As agentic AI systems acquire greater autonomous authority, these accountability gaps become increasingly consequential. This paper proposes an AI Decision Authority Charter for each significant AI use case. The charter assigns decision rights by domain, identifies a single accountable owner for each consequential decision, defines required cross-functional participation and concurrence, and establishes escalation and containment authority before deployment. Within this distributed governance model, the Chief Information Security Officer (CISO) should possess bounded preauthorized stop-work authority when defined security conditions are exceeded. This authority does not make the CISO the owner of enterprise AI or its business outcomes; it provides the authority necessary to contain systems during security events.

Integrity signals

Registry

Crossref · 10.61643/c79060

Cites

24 of 24 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Claims the paper makes

The text we found for this paper looks like another document, so its claims and self-check weren’t run. The registry and citation checks still apply.

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The text we found for this paper looks like another document, so the self-check wasn’t run.

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. Kroll, J. A., Huey, J., Barocas, S., Felten, E. W., Reidenberg, J. R., Robinson, D. G., & Yu, H. (2017). Accountable algorithms. University of Pennsylvania Law Review, 165(3), 633-705. https://scholarship.law.upenn.edu/penn_law_review/vol165/iss3/3/

Related

Authors
Montgomery, J., & Copeland, J.
Affiliations
  • Colorado Technical University
  • Colorado Technical University (US)
ORCID
Copeland, Joshua
Venue
The Pinnacle: A Journal by Scholar-Practitioners
Publisher
Colorado Technical University
Published
2026-09-17
Volume
4
Issue
2
ISSN
2994-7502 (ISSN-L)
DOI
10.61643/c79060
OpenAlex
W7213471485
Cited by
0
References
23
FWCI
0.00
Type
journal article
Language
en
Open access
Licence
cc-by-nd
Locations
  • The Pinnacle A Journal by Scholar-Practitioners (publishedVersion, cc-by-nd)
  • DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion)
Topics
  • Social Sciences › Safety Research › Ethics and Social Impacts of AI
  • Social Sciences › Law › Digitalization, Law, and Regulation
  • Social Sciences › Business, Management and Accounting › Management Information Systems › Information Technology Governance and Strategy
Keywords
AI governance, AI accountability, automation bias, human-in-the-loop oversight, agentic AI, chief information security officer, Robodebt, SyRI

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-30.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review