Companies have handed real decisions to AI. Very few of them can say who answers for those decisions. Sopra Steria Next, the consulting arm of Sopra Steria, put numbers on it in its CIO Compass report, published in Paris on October 21: fewer than 20 percent of AI-influenced or AI-executed decisions have an identified business owner, explicit rules and formal accountability. Fewer than 25 percent of AI-driven decisions in production can be traced and replayed end to end.
That second figure is the one security and compliance teams should sit with. If you can’t replay a decision, you can’t investigate it, defend it to a regulator or prove it wasn’t tampered with. Sopra Steria also estimates that a failed automated decision can hit 10 to 100 times more operations, customers or revenue than a traditional IT incident. Valérie Thiblet, a Data and AI partner at the firm, put it bluntly: “A system that cannot be stopped in real time is not governed: it is merely observed.”
This fits what usage data has been saying for a while. AI use has gone mainstream while trust to let it act still lags, and the ownership gap is a big part of why. Nobody wants to sign off on an agent nobody owns.
Vendors are selling the audit trail now
Over the past ten days, several vendors pitched accountability as the feature itself. Nuix (ASX: NXL), the Sydney investigative analytics company, launched an AI Agent inside its Nuix Neo platform on October 22. It answers plain-language questions across large piles of emails, chats and documents used in legal, regulatory, criminal and compliance work. Every answer links back to its source material, the agent logs each step it takes, and investigators can export the full conversation, steps and findings included. Admins also get role-based access and spending caps.
CEO John Ruthven said the company built the agent “to show its work.” That’s the right instinct for a tool whose output may end up in front of a judge. Nuix says the point is to let organizations explain to courts and boards how a result was reached.
Finance is having the same conversation. Basware, the invoice lifecycle software company, gathered its two big customer communities in Dublin, more than 80 organizations with $1.4 trillion in combined revenue. Basware’s 2026 Finance Performance Report says 96.5 percent of AI-driven coding and approval-routing decisions at best-in-class organizations complete correctly with no human involved. Good number. But the customers in the room were asking about the rest. CMO Kira Mondrus said their questions centered on “what happens when it gets something wrong,” and that finance leaders deserve answers backed by evidence. In June, Basware set out a framework that moves AI from adviser to operator one process at a time.
Government buyers have no rule yet
The public sector is further behind. On October 26, GovSignals, which sells AI proposal software to defense contractors, filed comments on FAR Case 2026-003, the Revolutionary FAR Overhaul rule the FAR Council proposed on September 18. Its complaint is simple: agencies already use AI tools in live source selections, and nothing in the FAR says how.
GovSignals wants a four-part standard. AI use would be permitted, never required. Solicitations would disclose it. A government evaluator would review and adopt each AI-assisted finding before relying on it. And the contract file would record the tool, its scope, the reviewing officials by function, and any AI finding that was changed or rejected. The comment points to a protest over an Army award at White Sands Missile Range, where the losing bidder alleged the Army’s AI platform produced a hallucinated weakness. GAO denied the protest in May, but the Court of Federal Claims ordered the AI tool’s analyses into the administrative record. GovSignals has a commercial stake here (clear rules help it sell), but the gap it describes is real.
Governance is becoming a security skill
Put these together and the pattern is plain. Knowing who owns an AI decision, and being able to replay it, is turning into a control requirement, the same way logging and access reviews did. It’s why ISC2’s AI security pilot puts governance and model defense on the same exam. Defending a model and proving who owned its decisions are now the same job.
Watch whether the FAR Council writes any AI language into the final rule. If it does, US federal buyers get a written rule for AI decision trails, and every vendor selling into them will need one.