Page 359 - CyberSecurityEssentialsEnglish

Chapter Eight

Responsible Institutional Adoption and the Human

Advantage

From experiment to institutional capability
Governance, risk, people, and sustainability
Chapter question: who bears responsibility when an AI system proposes a wrong decision or

carries out an unsuitable action, the vendor, the employee, the manager, or the
organization?

The practical answer is that responsibility is distributed, but it is never delegated to the

machine.

Story: When the Bot Got It Wrong, the Organization Was Still Responsible
In 2024 a civil resolution tribunal in British Columbia, Canada, heard the case of a customer
who relied on information given by a chatbot on an airline’s website about bereavement
fares. The bot told him he could request a reduced fare after traveling, within a defined

period, while the policy published on another page said the opposite. The customer made
his decision and paid the full price, and the company later refused his request. When the

case reached the tribunal, the company attempted to separate itself from what the bot had
said, but the decision affirmed that the system is part of the organization’s website and that
the organization is responsible for the accuracy of the information its digital channels
provide [1].

The story matters neither for the sum of money nor for the type of bot, but for the question
it exposed: can an organization take the benefit of speed and automation, and then treat
the system as a separate entity when harm occurs? Practically, legally, and ethically,

responsibility does not vanish when AI enters a process. The organization remains
responsible for choosing the use, defining the data and the permissions, testing the system,
monitoring performance, enabling a human being to intervene, and remedying an error

when it happens.

This chapter therefore treats governance not as a set of constraints written after a project
is finished, but as the capability that lets an organization benefit from AI faster and with
greater confidence. Good governance reduces rework, surfaces problems early, prevents

the purchase of tools that serve no clear objective, and helps staff know what they may do
and what needs approval or review.

“An organization can adopt automation, but it cannot delegate its responsibility to an
interface.”

358