The Last Human in the Room: Boards Must Designate AI Accountability to Prevent Catastrophe

The Imperative for a Designated AI Survivor

The rapid deployment of AI agents introduces a critical governance challenge: pinpointing accountability when these autonomous systems cause harm. The article draws a parallel to the "Designated Survivor" concept in government, where a named individual is pre-assigned to assume leadership in a catastrophic event. Similarly, boards must proactively identify a specific human, not a team or system, who is ultimately responsible for the actions of AI agents. This foresight is crucial because AI agents do not bear accountability; they transfer it up the organizational chain until it lands on the last human who authorized the system to act. Without this clear designation, organizations face significant risks from regulatory scrutiny, litigation, and even impacts on valuation during due diligence.

Closing the Accountability Gap: Board Responsibilities

The article highlights a significant "accountability gap" that current AI governance frameworks often fail to address. While boards may approve systems and review policies, they frequently neglect to name the individual accountable for an AI agent's harmful actions. This oversight is not merely theoretical; it has tangible consequences, as evidenced by increasing scrutiny from acquirers, potential litigation, and D&O insurance considerations. The author emphasizes that the responsibility for closing this gap falls squarely on the board. They must move beyond general awareness of AI risk to establish clear names, roles, and decision points, ensuring that the "last human in the room" for AI accountability is not an empty seat.

Operationalizing AI Accountability: The Traceability Test

To effectively implement AI governance, the article proposes a "Traceability Test" for management, which internal audit professionals can leverage. This test comprises several key operational questions:

• Is there a real-time register of all AI agents, including shadow agents, with their platform, owner, access scope, and integration context?
• Who specifically authorized each agent's scope of action, and does this align with its actual operations?
• Does each agent possess only the necessary permissions for its task, with over-permissioned agents flagged for remediation?
• Who is notified in real-time when an agent acts outside its authorized scope?
• Who is the named individual responsible for remediation when something goes wrong?
• Has the board reviewed a comprehensive map of AI agent authority, detailing what each agent can do, who authorized it, its permissions, and who is accountable for its outputs?

The ability to answer these questions definitively indicates robust AI governance, moving beyond mere deployment to genuine accountability. Internal auditors can play a vital role in assessing management's capacity to meet these criteria and report findings to the board.

Board-Level Oversight and the Navigator Questions

For boards, the article introduces "The Navigator" – three critical questions to ask during meetings to ensure accountability:

1. Can management provide the name of the person accountable for each AI agent's actions and demonstrate a live inventory of authorized activities?
2. If an AI agent causes harm, who is the first call management makes, and is there real-time monitoring by a named human?
3. Has any board member reviewed the specific decisions AI agents can make autonomously and confirmed their permissions align with their tasks?

A board that receives clear, confident answers to these questions has successfully named its Designated Survivor for AI. Conversely, a lack of specific answers signals an urgent governance problem. Internal audit can facilitate these discussions, providing the board with the necessary insights and assurance that these critical questions are being addressed, thereby helping the organization proactively manage AI risks and establish a robust accountability framework before external pressures dictate the terms.