Build Programs That Actually Stick

Leading Responsible AI Programs

When the AI Does Something No One Planned For

In 2023, a mid-sized financial services firm in the UK deployed an AI-powered hiring tool to screen CVs for its graduate recruitment program. The tool had been selected by HR leadership, approved by legal, and signed off by the CISO. Six weeks in, the Head of Talent noticed something troubling: candidates from certain universities, predominantly attended by students from lower-income backgrounds, were being systematically ranked lower, even when their qualifications matched or exceeded those of higher-ranked applicants. No single person had told the AI to do this. The training data, drawn from ten years of successful hires, simply reflected a historical bias that had never been examined. The AI learned it, amplified it, and packaged it as objective scoring.

The firm paused the tool immediately. But the pause created its own crisis. Recruiters had already deprogrammed their manual screening workflows. Hiring managers expected shortlists from the system. Candidates were waiting. The Head of HR, who had championed the tool to the board just two months earlier, now had to explain what went wrong, not to a technical committee, but to the CEO, the diversity and inclusion lead, and eventually the press. The problem was never that someone had made a reckless decision. Every individual step had seemed reasonable. The failure was structural: no one owned the question of what the AI should and shouldn't do once it was running.

This is the defining challenge of responsible AI leadership. It is not primarily about choosing the right tool or writing the right policy document. It is about building the organizational muscle to catch problems before they escalate, and having the authority, processes, and culture in place to act decisively when they do. The UK firm eventually redesigned its program with a human-in-the-loop review for every shortlist and a quarterly audit of AI outputs against diversity metrics. But those safeguards came after the damage. The lesson for any leader running or overseeing AI programs is clear: governance cannot be an afterthought bolted on when something breaks.

The Principle: Accountability Doesn't Ship With the Software

The UK hiring case illustrates a principle that shows up repeatedly across industries: AI vendors sell tools, not accountability. When a hospital system in Ohio deployed an AI scheduling assistant to optimize nurse shift allocations in 2022, the vendor provided training, documentation, and a dashboard. What the vendor did not provide was a process for escalating concerns when nurses flagged that the system was consistently scheduling less experienced staff on the highest-acuity wards on Friday nights. The nurses raised it informally. Their managers assumed the AI had been validated. The vendor said the outputs were within normal parameters. Six months passed before a formal review was triggered, by a near-miss incident, not by the governance system.

That hospital's experience points to a structural gap that affects organizations of every size. Most teams adopt AI tools the same way they adopt any software: procurement evaluates cost and features, IT checks security, legal reviews the contract, and then the tool goes live. What this process rarely includes is a structured answer to the question: who is responsible for monitoring what this AI actually does, and what do they do when they don't like what they see? Without that answer baked in before launch, accountability defaults to no one, or to whoever happens to notice the problem first, which is often the least empowered person in the room.

Building that accountability structure is the core job of responsible AI leadership. It does not require a team of data scientists. It requires clear role definitions, a monitoring cadence, and a culture where raising concerns about AI outputs is treated as professional diligence rather than obstructionism. The hospital eventually appointed a Clinical AI Lead, a senior nurse with no technical background but deep operational knowledge, who now chairs a monthly review of all AI-assisted scheduling decisions. Incident rates on high-acuity wards on weekends have dropped 34% in the 18 months since. The fix was organizational, not technical.

Click to enlarge

A Different Industry, The Same Gap

Retail is a world away from healthcare, but the accountability gap looks identical. In 2023, a major UK grocery chain rolled out an AI-powered customer communication tool that used purchase history and browsing data to personalize promotional emails. The marketing team loved it, open rates climbed 22% in the first quarter. Then a customer complained that she had received a promotion for baby products shortly after a miscarriage. She had browsed those products briefly during her pregnancy. The AI had no way to know what had happened. The marketing manager who received the complaint had no protocol for it. There was no escalation path. The response was improvised, slow, and inadequate.

The incident cost the chain real reputational damage and triggered an internal review that found the personalization tool had no documented ethical guardrails at all. The vendor contract said nothing about sensitive product categories. No one had asked. The marketing director subsequently built what she now calls a 'sensitivity register', a maintained list of product categories, life events, and customer signals that the AI is explicitly instructed never to use for targeting, regardless of what the data suggests. That register is reviewed every quarter by a small cross-functional group: marketing, legal, customer experience, and a consumer advocate. It takes about 90 minutes per quarter. It is now considered one of the most important governance meetings on the calendar.

Three Approaches to AI Program Leadership: A Comparison

Click to enlarge

The Teacher Who Built a Policy Before Her District Did

In early 2024, a high school department head in Melbourne, Australia, faced a problem that school administrators across the world were still debating: students were using ChatGPT to write essays, and no one had agreed on what to do about it. Rather than wait for district policy, which, nine months later, still hadn't arrived, she convened a working group of six teachers from her department and spent four sessions building a practical framework. They defined three categories of AI use: prohibited (AI writes the assessed work), permitted with disclosure (AI used for brainstorming, feedback, or research, declared in a footnote), and encouraged (AI used as a revision tool under teacher supervision in class). They didn't need a technologist. They needed professional judgment and a structured conversation.

What made her approach notable was not the framework itself, similar ones emerged in schools globally, but how she operationalized it. Every student received a one-page explanation of the categories in plain language. Every teacher in the department got a 30-minute briefing. She created a shared document where teachers could log ambiguous cases and collectively decide how to classify them, building precedent over time. When the district finally issued guidance eight months later, her department's framework was adopted almost verbatim as the school-wide standard. She had no mandate to lead AI governance. She had a problem, a group of willing colleagues, and a bias toward action. That combination, it turns out, is exactly what responsible AI leadership looks like at the team level.

Turning Principles Into a Program That Actually Runs

Every leader who has built a functional responsible AI program, regardless of industry or organizational size, has done three things consistently. First, they created a live inventory of AI tools in use, not a one-time audit but a maintained list that gets updated whenever a new tool is adopted. This sounds mundane until you realize that most organizations have no reliable count of how many AI features are active across their software stack. Microsoft 365 Copilot alone embeds AI into Word, Excel, Outlook, Teams, and PowerPoint simultaneously. Notion AI, Grammarly Business, and Canva AI each make decisions that affect outputs employees send to clients. If you don't know what's running, you can't govern it.

Second, effective programs define impact tiers before they define policies. Not all AI use carries the same risk. An AI tool that suggests subject lines for internal newsletters sits in a fundamentally different category from one that scores job applicants or flags customer accounts for fraud review. The EU AI Act formalizes this logic with its four-tier risk classification, but you don't need to wait for regulation to apply the same thinking. A simple three-column table, tool name, what decision it influences, who is affected, is enough to start separating low-stakes automation from high-stakes AI-assisted decisions that need human review.

Third, the programs that sustain themselves have a named human accountable for each AI tool in the inventory, not a team, not a department, but a person. That person is responsible for monitoring outputs, fielding concerns, and triggering a review if something looks wrong. This doesn't mean they check every output manually. It means they own the question of whether the tool is performing as expected and whether that performance is acceptable. In organizations where this role is clearly assigned, problems surface faster, get resolved more cleanly, and rarely become the kind of crisis that ends up in the press. In organizations where it isn't, the default is the UK firm's experience: everyone assumed someone else was watching.

Click to enlarge

Key Lessons From Part 1

1. AI vendors provide tools, not accountability. The moment a tool goes live in your organization, the responsibility for its outcomes transfers to you.
2. Governance failures are almost always organizational, not technical. The UK hiring case, the Ohio hospital, and the grocery chain all failed at the same point: no named human owned what the AI was doing after launch.
3. Impact tiers matter more than blanket policies. Treat AI that influences decisions about people, hiring, scheduling, customer targeting, as categorically higher risk than AI that assists internal work.
4. Embedded governance outperforms reactive governance. Building oversight processes before deployment is always cheaper than building them after an incident.
5. You don't need a formal mandate to start. The Melbourne teacher and the grocery chain marketing director built effective governance from within their existing roles, using judgment and structured conversations rather than authority.
6. A live inventory is the minimum viable governance artifact. If you don't know which AI tools are running and what they're influencing, no other governance measure will be effective.
7. Named accountability, one person per tool, is the single structural change that most reliably closes the gap between policy and practice.

When Governance Meets Reality: The Hard Choices Leaders Actually Face

Unilever's response became a reference point in responsible AI circles. Rather than quietly patching the model, the team paused the deployment, commissioned an independent bias audit, published their findings internally, and rebuilt the screening criteria with explicit fairness constraints. The process took four months and cost more than continuing would have. But it established something more valuable than efficiency: it established that governance at Unilever meant something. Employees, candidates, and regulators noticed. The company's talent acquisition lead later described the decision as the moment their AI policy stopped being a document and started being a culture.

The principle embedded in that story is one every AI program leader needs to internalize early. Governance is not primarily a technical problem, it is a leadership problem. The question is never just 'does our AI work?' The question is 'does our AI work for everyone it affects, and do we have the structures in place to find out when it doesn't?' Unilever had the structures. That is why they caught it. Organizations without those structures are almost certainly running tools with similar issues right now, simply without knowing.

Building the Infrastructure of Accountability

Accountability in an AI program is not a single role or a single meeting. It is a set of interlocking structures that ensure someone always knows what AI tools are running, who approved them, and what the escalation path looks like when something goes wrong. Think of it like a building's fire safety system, you hope you never need it, but its existence changes how safely everyone operates every day. The organizations that handle AI incidents well are not necessarily the ones with the smartest teams. They are the ones that built the infrastructure before they needed it.

The core infrastructure has three layers. The first is an AI inventory, a simple, maintained list of every AI tool in use across the organization, who owns it, what it does, and what data it touches. This sounds obvious. Most organizations do not have one. When the EU AI Act compliance deadlines hit, the first crisis for many companies will not be a banned tool, it will be that nobody can produce a complete list of what they are running. The second layer is a use-case approval process: a lightweight gate that any new AI deployment must pass through before going live. Not a bureaucratic wall, but a structured check.

The third layer is incident response. When an AI tool produces a harmful or embarrassing output, and eventually, one will, the organization needs a pre-agreed protocol. Who gets notified? Who has authority to suspend the tool? Who communicates with affected stakeholders? These decisions made under pressure, without a playbook, tend to go badly. The organizations that navigate AI incidents with minimal reputational damage are almost always the ones that rehearsed this scenario in calmer moments. A quarterly tabletop exercise, where a leadership team walks through a hypothetical AI failure, is one of the highest-return governance investments available.

Click to enlarge

A Different Industry, The Same Pattern: Healthcare's Governance Lessons

The healthcare sector has been wrestling with AI governance longer and more publicly than most industries, which makes it a useful source of hard-won lessons. In 2021, the University of Michigan Health system began deploying an AI tool to predict patient deterioration in ICUs, flagging patients at risk of sepsis or cardiac events before clinical signs became obvious. The tool performed well in trials. But when it went live at scale, nursing staff started ignoring its alerts. Not because the alerts were wrong, but because no one had trained nurses on how the tool worked, why it flagged what it flagged, or how to weigh its recommendations against their own clinical judgment. Adoption collapsed.

The University of Michigan's subsequent intervention was not technical. They created a structured onboarding program where nurses spent time with the AI tool in simulated scenarios, understanding its logic and its limitations. They gave clinical staff a formal feedback channel to report when alerts seemed wrong. And critically, they made clear that the AI was a support tool, the nurse retained clinical authority, full stop. Within a year, alert adherence had recovered significantly. The lesson for any program leader outside healthcare is direct: the human layer of your AI governance is as important as the technical layer. People need to trust the tool, understand its role, and feel genuinely empowered to override it.

Governance Models: What Different Organizations Actually Build

Click to enlarge

The Marketing Director Who Rewrote Her Team's AI Policy

Sarah Chen is not a technologist. She is the VP of Marketing at a mid-sized financial services firm in Singapore, and in early 2024 she became, by accident, her organization's most effective AI governance leader. It started when her team began using AI content tools to draft social media posts and client newsletters, a sensible productivity move. Then a compliance officer flagged that several AI-drafted posts had included investment return figures that were technically accurate but presented without required regulatory disclaimers. No one had thought to include 'always add compliance-required disclaimers' in the prompts. The posts went out. Regulators noticed.

Chen's response was to build what she calls a 'content governance layer', a one-page checklist that every AI-generated piece of external content must pass before publishing. The checklist covers regulatory language requirements, factual claim verification steps, brand tone standards, and a mandatory human review sign-off. She also created a prompt library: pre-approved starting prompts for common content types, already including the compliance language and brand guidelines her team had previously been forgetting. Her solution cost nothing, required no technical expertise, and eliminated the compliance exposure within a month. It also became a template that three other departments in her firm adopted. Governance at the team level does not require a committee. It requires one person deciding to build the guardrails.

Turning Policy Into Practice: What Program Leaders Do Differently

The gap between organizations with AI policies and organizations with functioning AI governance is almost always a leadership behavior gap, not a document gap. The leaders who successfully translate policy into practice share a set of habits that are worth naming directly. They talk about AI governance in regular team meetings, not as a compliance lecture, but as a practical topic. 'What AI tools did we use this week, and did anything feel off?' is a question that, asked consistently, creates a culture of reflection. It signals that these conversations are normal, expected, and safe to have.

Effective program leaders also model the behavior they want from their teams. If you want people to disclose when AI produced a problematic output, you need to be the first person who says 'I used AI for this and I want to flag something I noticed.' Psychological safety around AI errors is not automatic, in many workplace cultures, admitting a tool you used made a mistake feels like admitting your own mistake. Breaking that pattern requires explicit leadership. It requires treating AI failures as learning events rather than performance events. The organizations that improve fastest at AI governance are the ones where reporting an AI problem is quietly celebrated rather than quietly career-limiting.

Finally, effective program leaders connect governance to outcomes that their teams actually care about. Compliance and risk reduction are real motivations for senior leadership, but they do not move a marketing manager or an HR coordinator. What moves those people is: 'this governance process will stop you from accidentally sending a client the wrong data,' or 'this checklist will protect you personally if something goes wrong.' Frame governance as professional protection, not bureaucratic obligation, and adoption rates change dramatically. People follow policies that they understand protect them. They work around policies that feel like they only protect the organization.

Key Lessons From This Section

1. Governance failures are usually invisible until they are not, the organizations that catch problems early built detection infrastructure before they needed it.
2. An AI inventory is the foundation of every other governance activity. You cannot govern what you cannot see.
3. The human layer of governance, training, trust, feedback channels, override authority, is as important as any technical control.
4. Governance model choice depends on your organization's size, sector, and risk profile. No single structure works for everyone.
5. Team-level governance does not require a committee or a budget. A prompt library and a one-page checklist can eliminate significant compliance risk.
6. Psychological safety around AI errors is a leadership responsibility. People need to feel that reporting problems protects them, not exposes them.
7. Framing governance as professional protection, not bureaucratic obligation, is the fastest way to improve adoption among non-technical teams.
8. Incident response protocols should be built and rehearsed before an incident happens. Decisions made under pressure without a playbook consistently go wrong.

Building a Culture Where Responsible AI Actually Sticks

In 2023, Salesforce launched its Office of Ethical and Humane Use of Technology, not as a legal compliance function, but as a team embedded inside product decisions. The tension was immediate. Engineers wanted to ship fast. The ethics team wanted to slow down and ask harder questions about bias in AI-assisted sales recommendations. What happened next is instructive: instead of treating ethics reviews as a blocker, Salesforce built a 'responsible AI scorecard' that product teams completed before launch. Friction became structure. The ethics team stopped being the people who said no and started being the people who helped teams say yes, with documentation to back it up.

The principle extracted from Salesforce's approach is deceptively simple: responsible AI programs fail when they live outside the workflow and succeed when they live inside it. Most organizations make the mistake of treating AI governance like an audit, something that happens after decisions are made. Salesforce flipped this. The scorecard meant that accountability was baked into the development process, not bolted on afterward. Every team touched the governance process, which meant every team owned a piece of the outcome.

This is the hardest cultural shift for leaders to make. Governance feels like overhead. It feels like slowing down to fill out forms while competitors sprint ahead. But the data tells a different story: organizations with mature AI governance programs report fewer costly rollbacks, less legal exposure, and higher employee trust in the tools they're asked to use. Culture is just the sum of repeated behaviors, and when responsible AI behaviors are built into daily work, culture follows.

Click to enlarge

When the Pressure Comes From the Top

In healthcare, the stakes for irresponsible AI are clinical. When Epic Systems integrated AI-generated care suggestions into its electronic health record platform, hospital administrators faced a specific leadership challenge: physicians were either over-trusting the AI's recommendations or dismissing them entirely. Neither response was safe. The administrators who navigated this best didn't just issue policy memos. They ran structured 'AI rounds', brief weekly discussions where clinical teams shared cases where AI output helped, confused, or nearly caused harm. The conversation was the governance mechanism.

What Epic's hospital partners discovered was that psychological safety and AI governance are inseparable. If staff are afraid to report that an AI tool gave a bad recommendation, because reporting it implies they almost made an error, the organization loses its most valuable feedback signal. Leaders who created safe reporting channels got better data, caught model drift earlier, and built teams that were genuinely more capable of using AI well. The governance program worked because the culture made honesty cheap.

The lesson scales beyond healthcare. Whether you're running a marketing team using Gemini to draft campaigns or an HR department using AI to screen resumes, the same dynamic applies. People need to feel safe saying 'this output looked wrong to me.' Leaders who reward that kind of observation, rather than treating it as a slowdown, build organizations that catch problems before they become incidents.

A School District That Got It Right

Los Angeles unifyd School District faced a very different AI governance challenge in 2023. After rolling out an AI-powered student mental health app called 'Bark,' administrators had to decide: how transparent should they be with parents about what the AI monitored and flagged? Some board members argued for minimal disclosure to avoid panic. Others argued that parents had a right to know exactly what signals the system used to identify at-risk students. The superintendent who led the decision chose radical transparency, publishing a plain-language explainer document for families that described how the AI worked, what it could and couldn't detect, and how human counselors reviewed every flag.

Parent trust scores in the district's technology programs increased after the disclosure, not decreased. This runs counter to the instinct many leaders have, that explaining how AI works will frighten stakeholders. The LAUSD experience suggests the opposite: people are more afraid of not knowing than of knowing. A responsible AI culture extends to external stakeholders too. Parents, customers, clients, and community members are affected by the AI decisions organizations make, and transparency with them is not just ethical, it's strategically smart.

Click to enlarge

The Manager Who Changed How Her Team Thinks About AI

A procurement manager at Unilever described her approach to AI governance in a way that stuck: 'I don't ask my team to trust the AI. I ask them to verify it.' When her team started using Microsoft Copilot to draft supplier evaluation summaries, she introduced a single rule, before any AI-generated summary was shared with a vendor or used in a decision, one team member had to read the original source documents and confirm the summary was accurate. This took fifteen extra minutes. It caught three significant errors in the first month. The team stopped seeing the AI as infallible. They became better evaluators, not more dependent ones.

What this manager built was a micro-governance process. She didn't need a policy committee or a budget line for AI ethics. She needed one rule, applied consistently, with visible consequences when it wasn't followed. This is how responsible AI culture spreads at the team level, not from the top down through mandates, but from the middle out through managers who make one good habit contagious.

Putting Responsible AI Leadership Into Practice

Responsible AI leadership is not a title or a committee. It's a set of behaviors that leaders model, reinforce, and reward. Start with visibility: talk publicly about AI decisions your team is making, including the ones that were hard. When employees see a manager say 'we almost used that AI output and we caught an error, here's how,' they learn that catching errors is valued. Silence about AI decision-making creates a culture where people assume everything is fine and stop looking critically.

Next, formalize the informal. Most teams already have informal AI norms, some people always double-check outputs, others never do. Your job as a leader is to surface the good habits and make them official. A one-paragraph team agreement about how AI tools are used, written collaboratively, not handed down, creates shared ownership. It also gives you something concrete to revisit when new tools are introduced or when something goes wrong.

Finally, connect responsible AI behavior to outcomes your team already cares about. Don't frame it as ethics for its own sake, frame it as quality control, client trust, legal protection, or competitive advantage. The Salesforce scorecard didn't succeed because engineers suddenly cared about ethics. It succeeded because it was connected to shipping products that didn't get pulled back. When responsible AI is in the same sentence as 'how we protect our work and our clients,' adoption follows.

1. Governance programs fail when they live outside workflows and succeed when they're built into daily decisions, the Salesforce scorecard is the model.
2. Psychological safety is a governance tool. If staff can't safely report AI errors, organizations lose their most important feedback signal.
3. Transparency with external stakeholders, parents, clients, customers, builds trust rather than eroding it, as LAUSD demonstrated.
4. Micro-governance at the team level, one verification rule, applied consistently, changes AI culture without requiring policy committees or budgets.
5. Responsible AI leadership means modeling, rewarding, and talking openly about AI decisions, including the difficult ones.
6. Connect responsible AI behavior to outcomes teams already care about: quality, client trust, legal protection. Ethics framing alone rarely drives adoption.
7. A collaboratively written team AI use agreement creates shared ownership and gives you a concrete reference point when new tools arrive or incidents occur.