by Maple & North
An AI agent flags a legitimate wire transfer as fraudulent and freezes the account.
A triage system deprioritizes a case it should have escalated.
A customer-service agent makes a lending recommendation that later proves discriminatory.
In every case, the first question isn't technical. Engineers can usually determine why the model behaved the way it did.
The first question is human.
Who answers for the decision?
At most Canadian organizations today, the honest answer is still, "It depends who you ask."
The vendor points to the liability clauses in the contract.
IT points to the business unit that requested the solution.
The business unit points to whoever approved the deployment.
Legal points out that nobody anticipated this specific failure because nobody knew it could happen.
This isn't simply an organizational oversight. It's what happens when autonomous decision-making is introduced into organizations built around human accountability.
That's the real subject of this conversation.
Not artificial intelligence.
Not automation.
Not innovation.
Responsibility.
Canada currently has no single law that defines accountability for autonomous AI decisions.
The proposed Artificial Intelligence and Data Act was intended to move Canada in that direction, but it has not become law. Organizations therefore continue operating within a combination of privacy legislation, sector-specific regulation, contractual obligations, and human rights law.
Each framework addresses part of the problem.
None fully answers the central question.
Privacy legislation can determine whether personal information was handled appropriately.
Human rights legislation can investigate discriminatory outcomes.
Sector regulators can examine operational failures.
But none of them can tell an executive, before deployment, exactly who should own the decisions an autonomous AI agent makes every day.
That uncertainty doesn't eliminate liability.
It simply makes accountability harder to define before something goes wrong.
Maple sees the human side of that uncertainty.
Customers don't care whether a mistake originated from an employee, a vendor, or an AI model. They care that somebody can explain what happened and make it right. When organizations cannot answer that question quickly, confidence disappears long before the technical investigation is complete.
Imagine a mid-sized Canadian insurance company deploying an AI agent to prioritize incoming claims.
For months, everything works exactly as expected.
Backlogs shrink.
Adjusters focus on more complicated files.
Processing times improve.
Then one claim arrives containing an unusual combination of information.
The AI agent categorizes it as routine instead of urgent.
The file never reaches the adjuster who would normally recognize the warning signs.
The customer experiences unnecessary delays.
This is an illustrative scenario, but it reflects the types of governance concerns repeatedly highlighted by Canadian cybersecurity and risk guidance. The technical failure matters, but the organizational response matters even more.
Who owns that decision?
The adjuster never saw the file.
The data scientist didn't review the claim.
The manager approved a system that had performed well during testing.
Every person involved acted reasonably within their own responsibilities.
Yet the organization still failed the customer.
That's where responsibility becomes more complicated than blame.
Blame is usually assigned after an incident.
Accountability should exist before the first decision is ever made.
Organizations that discover who is responsible only after receiving a complaint have already missed the opportunity to prevent the problem in the first place.
Responsibility has to be designed into the workflow before deployment.
Someone must own the monitoring.
Someone must have authority to override the AI.
Someone must be accountable if oversight fails.
If those questions cannot be answered before an AI-enabled workflow enters production, the organization has not established governance.
It has simply introduced automation into a process that still assumes human judgment exists somewhere in the background.
Fortunately, organizations don't have to invent governance from scratch.
Existing frameworks already provide much of the foundation.
The NIST AI Risk Management Framework, UNESCO's Recommendation on the Ethics of Artificial Intelligence, and guidance from the Canadian Centre for Cyber Security all arrive at remarkably similar conclusions.
AI systems should be traceable.
Their decisions should be reviewable.
Human oversight should exist before deployment rather than after an incident.
Auditability should be treated as a design requirement rather than a compliance exercise.
Those recommendations aren't particularly controversial.
Applying them consistently is considerably harder.
The counterargument deserves consideration.
Building governance around every AI-enabled workflow requires time, money, and expertise.
Assigning accountable owners.
Documenting decision boundaries.
Maintaining human review.
Performing regular audits.
Testing override procedures.
For organizations moving quickly to deploy AI, these activities can feel like unnecessary friction.
After all, if an AI agent performs correctly 99 percent of the time, why invest heavily in preparing for the remaining one percent?
North would argue that this question misunderstands how organizational risk works.
The value of governance is rarely measured during normal operations.
It becomes visible only when something unexpected happens.
The organizations that appear slow before an incident often recover much faster after one because responsibility, authority, and decision-making were already defined.
Maple would put it differently.
Seatbelts feel unnecessary until the moment you need one.
Good governance works much the same way.
The responsibility for an AI agent's decisions never transfers to the software itself.
It remains with the organization that deployed it.
More importantly, it should remain with a clearly identified individual inside that organization.
Not a committee.
Not a department.
Not "IT."
A person.
Waiting for future legislation to provide that clarity assumes regulation will arrive before the first serious incident.
History suggests organizations shouldn't rely on that assumption.
As AI systems become more capable, they also become more invisible.
The smoother they operate, the easier it becomes to forget that every autonomous decision still exists within a chain of human responsibility.
That's the paradox leaders must understand.
The better the technology becomes, the easier it is to overlook the governance supporting it.
Organizations that succeed won't necessarily be those deploying the most advanced AI.
They'll be the ones that can answer a simple question immediately, without searching through contracts, organizational charts, or incident reports.
Who is responsible when this AI agent makes the wrong decision?
Security and technology leaders should already know that answer before the first autonomous decision is ever made. That means treating AI agents as governed participants within the enterprise, assigning a named owner to every significant AI-enabled workflow, defining clear approval and override authority, maintaining logging and audit trails, regularly testing fallback and incident response procedures, and evaluating jurisdictional risk, availability, and auditability before adopting new AI capabilities.
Because when an AI decision causes harm, the software won't be asked to explain itself.
The organization will.