Decide, Monitor, Adjust: The Governance Loop That Makes AI Ethics Operational

Most organizations now have some version of an AI ethics initiative. Fewer have changed a single decision because of one. The gap between ethical intention and operational accountability is where enterprise AI governance keeps breaking down: committees meet, principles get published, and the systems underneath continue running on the same assumptions they always have. The risk is that AI scales those assumptions faster and further than any human process ever could.

Caroline Carruthers is Co-founder and Chief Executive of Carruthers and Jackson, a London-based data consultancy. One of the UK's first Chief Data Officers, she held the role at Network Rail before co-founding the firm, and is co-author of The Chief Data Officer's Playbook and Data Driven Business Transformation. Her focus is the behavioral side of AI governance: what has to change in how organizations actually govern the ethics of their data and their AI systems.

"If you are waiting on legislation or a law to tell you what is right and wrong, then you are fundamentally not doing this right," said Carruthers. "That is your backstop, your 'thou shalt not cross.' There should be so many shades of grey between what is the right thing to do and hitting legislation that you have plenty of room to act in." Organizations that treat regulation as the starting line rather than the boundary, she argued, have already ceded the ground where meaningful governance should operate.

That view came with a sharper edge when she described how AI ethics programs tend to present inside large enterprises. Policies exist. Value statements sit on walls. Ethics committees convene. And the conversations often stay exactly there.

• Posters and paralysis: "Ethics isn't a poster. It isn't a value that you shove on the wall. It only matters if it changes what people actually do," said Carruthers. "And if it doesn't have an impact there, then it doesn't matter what you say or what you have on a wall or how many conversations you have." In her consulting work, the organizations taking ethics most seriously are often the same ones struggling to turn conversations into enforceable decisions. Committees exist, cross-functional representation is there, but the output stalls at discussion. "Where I saw them falling down was that the conversations stayed as conversations. There has to be a limit to the conversation, a point where you say, 'We may not be perfect, but we are going with this decision, and this is the action that will follow.'"

• Waiting for the floor: She was equally direct about organizations that frame inaction as prudence, waiting for legislation to tell them where to stand. "I am sick to death of hearing that," she said. In her view, regulation should function as a floor, and organizations that cannot articulate their own ethical position above that floor are not governing AI at all. She also noted that neither regulators nor technologists can carry the ethical load alone. Many of the people drafting AI policy lack deep technical fluency, while some technical experts are so focused on capability that they lose sight of restraint. "Some of the experts in the field, I don't think you should let them touch the ethics, because they're so far into 'oh, we could do all of this stuff.' You could, but you shouldn't."

Ethics cannot be a fixed document, Carruthers argued, because what a society considers acceptable shifts over time. She pointed to mainstream advertising in the 1970s as a case study in how drastically norms shift. Campaigns that depicted women as subservient props or punchlines ran in prime-time slots and glossy magazines, and audiences found them funny. Less than 50 years later, the same material would be considered indefensible.

That matters for enterprise AI because organizations are still training systems on data collected under those older norms. Legacy datasets carry the biases of the era that produced them, and an AI system optimizing on that data will replicate those biases at speed and scale unless governance controls are in place to catch them.

• Bias at speed: "We're still using data from the '70s and the '60s and the '50s and before that. All that bias is built into that data," Carruthers said. "It doesn't mean that data isn't useful and helpful and that we can't learn from it. It just means we have to be aware of what we were dealing with at the time." She pointed to examples of banks making loan decisions where a far higher proportion of white applicants were approved than Black applicants, because the underlying data reflected decades of institutional discrimination. "The system was effectively concluding that it should approve nine white people for every one Black person. It was replicating that without us putting in the right kind of safety caveats." That kind of inherited bias is precisely why ethics can never be treated as a one-time assessment. "Anybody who treats ethics like a tick-box, as if they can just say they're done, is on a hiding to nothing. You have to be constantly doing that temperature check: is this still where we are?" For organizations running AI-driven decision systems, that means building review cycles into the operating model rather than treating an initial ethics clearance as permanent.

• Decide, then watch: From there, Carruthers moved to the operating discipline she saw as missing: monitoring and course correction as standard practice, not crisis response. "You make a decision, you monitor, you check the consequences and the unintended consequences, and then you course correct," she said. "You either roll back because it's like, 'Oh no, that is not what I wanted to happen,' or you go, 'Yeah, that was heading in the right direction, but not quite. How can we tweak it?'" The expectation of iteration, she argued, has to be baked into the governance structure from the start rather than triggered by failure. She applied the same standard to transparency, drawing a line between legalistic disclosure and genuine clarity. "True transparency was ten short lines that clearly spelled out how your data would be used. You could still have all the detail in the T&Cs if you wanted, but being upfront about exactly what you were going to do was what made it ethical."

Accountability, in her framing, does not shift just because a system is involved in the decision. Even as organizations move into more agentic AI workflows, where automated systems act with a degree of autonomy, she maintained that a clear human line of responsibility has to remain intact. Her test is simple: could the person responsible explain the outcome to their mother or grandmother without flinching?

That question raises a structural one inside enterprises: whose name goes on the explanation when something goes wrong? Carruthers argued that accountability for AI works best when it mirrors the distinction between data ethics and AI ethics, with tight collaboration between the CIO and CDO so nothing falls through the cracks.

• Shared ownership, clear lines: "There's no hole for AI accountability to fall through," she said of the CIO-CDO relationship. "It might be a shared accountability, as in there's this bridge between the two and that is where the accountability lies." Below that bridge, she expects to see clear data domains with named owners accountable for the information in their area. If a problem traces back to the data, accountability shifts to the domain owner. If it traces to the type of AI deployed, it shifts toward the technology leader. She likened the discipline to decision-making in emergency situations, where personnel are trained to answer one question for every choice: why did you do that? When those questions land in ethics committees and the discussion drifts into abstraction, she found that grounding it in a specific, fictional person helps cut through. "Imagine Carl, a 40-year-old man with a wife and a young child, using this product," she said. "When you make it that personal, it's so much easier for us as human beings to think about a person and what happens to them than to wrestle with really abstract situations."

Beyond leadership structures, Carruthers argued that a significant share of AI risk and opportunity sits with individual employees making daily judgment calls. They're deciding what data to share, which outputs to trust, and when to intervene. Declaring a "human in the loop" does not guarantee that the human is equipped to question what they see. The missing skill, in her view, is critical thinking, and the way society relates to authority and automated outputs makes the gap more urgent.

• Screen trust: "People my dad's age, 80-odd-year-old people, would trust it if a doctor said it, if a teacher said it. If it was in a book, it was right," she said. "We'd kind of changed a little bit. We question the teachers and the doctors, but if Google told us it was right, then it must be. If it was written on a computer screen, we must believe that." She argued that the same pattern is now repeating with AI outputs, where the appearance of authority on a screen substitutes for actual verification. "Critical thinking is important. This was why trust is the new currency. We need to earn people's trust. We don't want to get it just because we provided them something on a computer monitor."

For organizations that want to act on that insight, Carruthers suggested investing in critical thinking training for employees who use AI systems, not just technical teams. She also noted that enterprise AI gateways that log and constrain data flows can help slow people down enough to check context and sources. But she stressed that none of these controls replace the fundamental question every employee should be asking: does this output make sense? At the same time, she worried that risk aversion has become its own governance failure. In some organizations, the fear of making a wrong call has made people afraid to experiment at all, which undermines the agility she sees as essential to responsible AI at scale.

"We'd made everybody so risk averse because they were frightened of doing the wrong thing that we didn't experiment enough, and we'd forgotten how to experiment safely and celebrate failure," she said. She compared it to the invention of the light bulb: Edison didn't fail 2,000 times; he learned 2,000 ways of not building one. The same scientific discipline, she argued, belongs at the center of how organizations use data and AI. "We'd gotten ourselves to this point where we'd forgotten the science part of data science," she said. "You put forward a hypothesis, you do an experiment, you check it. Did it work? Fantastic. Could you have done it better? It didn't work? Brilliant. Now we know what doesn't work. Let's go back and redesign the experiment. We need to get better at doing that with the way that we're using data and AI."