Who owns AI in day-to-day operations?

Artificial intelligence is introduced as a question about tools and lands as a change to the working environment. For that category the rules already exist — it is just that very few rollouts go through them.

Responsibility is usually split four ways. Strategy sits with the leadership team, the tools with IT, data protection with the lawyer. Everyday use sits with everyone.

The first three have a person with a name. The fourth is where the work actually happens.

It is already going wrong

In Glean’s survey of 6,000 full-time workers, 69 per cent report at least one of the behaviours the report calls botshitting: sending on machine-generated work they have not checked, do not fully understand, or cannot stand behind. 41 per cent say they sometimes deliver AI-generated work they could not explain if asked. The source is a vendor of such tools, so the numbers should be read accordingly.

The pattern is familiar all the same to anyone who has worked with workload. When the checking has been given no time and the delivery has been given a deadline, the deadline wins. That is not an attitude problem but an organisational one.

Three requirements that already applied

The usual answer is that regulation has not caught up with the technology. That holds up poorly.

The internal-control regulations require written documentation of how responsibility, tasks and authority for work-environment matters are distributed, and of risk having been mapped and followed up with plans. The requirement applies to every business. A new way of working with no owner meets it head-on.

The safety representative — the verneombud — must be consulted on changes that matter to the working environment. Since 1 January 2024 the duty to have one applies from five employees, down from ten. More organisations have the arrangement than ever before — and almost none of them use it on AI.

Section 4-3 of the Working Environment Act has, since 1 January this year, named four psychosocial work-environment factors the employer must take into account. The first is unclear or conflicting demands and expectations at work. That is a precise description of what an AI rollout without ownership produces.

The Labour Inspection Authority was clear about what the amendment was when it came: «a clarification of rules that have already existed for many years». The employer’s responsibility was not widened. The duty is not nine months old, then — it is nine months clearer.

There is no regulatory gap here. There is a gap in practice.

The objection

It is too early to formalise something that is changing this fast, and organisations that have written detailed AI guidelines have often ended up with documents nobody reads.

The objection lands at the wrong level. What is needed is not a procedure per tool. What is needed is for someone to hold the task, with time and a mandate: to know what is actually in use, to set thresholds for when a human must look at something before it leaves the building, and to be told when the tool gets it wrong.

It is a role, not a binder. Nor is it exotic any more: in five of the six countries Indeed examined, more than half of the job titles that mention AI now sit outside tech occupations. In a Norwegian organisation of 300, a defined portion of an existing post is usually enough — something the internal-control regulations assume has been written down in any case.

It should probably not sit with IT. The questions that arise in daily use are about professional standards and accountability, not about licences. IT should own the tool. IT should not own the question of how carefully something is read before it goes to a client.

The test

On 1 September, Digital Norway and Styreinstituttet launched Styrekompasset for KI — four modules, free, aimed at the boardroom. It is a good place for a board to start.

The question that settles whether the matter is resolved where the work is done is more concrete:

Who does an employee ring when they discover the tool got something wrong in work that has already gone out?

In most organisations there is no good answer. Not because nobody has thought about it, but because it has not been anybody’s job to think about it. The duty to have assessed it is not new. Since the new year it is simply spelled out in the Act.