Skip to content

For risk, compliance and governance leaders

AI governance without bureaucracy

When something goes wrong — a breach, a wrong report, an audit finding — the usual response is another control, another forum, another approval. The book argues that this produces paralysis rather than safety, and that as AI starts making or shaping decisions, governance’s real job is to make accountability explicit. For risk and compliance leaders, it offers a simple test for telling governance that protects from governance that only adds process.

Run the AI-Readiness ScorecardGet the book on Amazon

Kindle edition · 99 pages · a 90-minute readRead a free sample on Amazon

From the book

What the book shows

  1. 01

    More layers, less accountability

    Each new layer feels reasonable on its own. Together, the book argues, they leave everyone responsible for complying and no one empowered to decide. Its test for any piece of governance: does it make the right decision easier or harder to make?

    “Most governance models are born out of failure.”
    Chapter 13Governance Without Bureaucracy
  2. 02

    With AI, accountability must be explicit

    As decisions become more automated, the book says, governance should establish who is accountable rather than add another round of review. Bureaucratic governance, in its view, cannot keep up with AI; clear governance can.

    “When decisions are automated or augmented by machines, accountability must be explicit, escalation paths must exist, and oversight must be human rather than purely procedural.”
    Chapter 13Governance Without Bureaucracy
  3. 03

    “The model decided” is not an answer

    Ownership means a named person who can be asked to explain a result, decide, escalate and answer for it. That is what makes a model’s output open to challenge; without it, the book warns, accountability disappears into the automation.

    “Without clear ownership, bias goes unchecked, recommendations cannot be challenged, and responsibility disappears behind the phrase ‘the model decided.’”
    Chapter 11Ownership Is a Leadership Role

Where risk sits in a hub-and-spoke enterprise

In the book’s Hub-and-Spoke model, the center carries shared risk — regulatory exposure, ethical boundaries and enterprise reporting — while local units keep control of execution. Governance breaks down, the book says, when the center starts approving local decisions, or when local units redefine shared concepts on their own. Its principle: as strong as necessary, as light as possible.

Questions to ask

Questions for risk, compliance and governance teams:

  1. 1For each automated or AI-assisted decision, who is the named accountable owner?
  2. 2Are escalation paths for AI recommendations defined — and actually used?
  3. 3Can every forum we run say what it decides? If not, should it exist?
  4. 4Is our governance judged by the ambiguity it removes, or by its activity?
  5. 5Are the boundaries of acceptable AI use defined, and owned by someone?
  6. 6Do we rely on audits to catch data problems that should be owned where the data is created?

Where to start in the book

  • Chapter 13

    Governance Without Bureaucracy — Governance Without Bureaucracy.

  • Chapter 11

    Ownership Is a Leadership Role — why ownership must sit with a named person.

  • Chapter 12

    The Hub-and-Spoke Enterprise — what the center governs, and what it leaves to local units.

Get the book on Amazon

Kindle edition · 99 pages · a 90-minute readRead a free sample on Amazon

Book cover: Your data isn't broken. Your operating model is.

Also see

All roles: who the book is for →

About this page: our reading of Your data isn’t broken. Your operating model is. by Adam Ayres and Behrang Karimi, for risk, compliance and governance leaders. The book itself is written for the leadership teams of complex enterprises. Quotes are word for word from the book; its case studies describe anonymized companies, and their results are not benchmarks.