Who Owns AI Risk? Moving from Periodic Reviews to Real-Time Governance

When AI is deployed across an organization, and coding agents and personal assistants are running in every department, who is responsible for the risk? I put that question to Apostol Vassilev, a senior researcher at NIST who works on adversarial AI. His answer: everyone, and also one function.

Everyone reports. One function sees the whole.

Every team using AI has to understand the risk and report what it sees. That’s the shared part. But scattered awareness doesn’t add up to a decision. The information, Vassilev says, “has to go up and be channeled to a single point that can accumulate the overall enterprise risk exposure.”

That function has three jobs. Explain to the C-suite and board, in terms they can act on, what risks the business carries at any moment. Decide how to keep the business running in the face of them. And push the resulting measures back down through the organization.

Accountability gets harder to trace

There is a reason this matters more now. In the past, if a credit card number was stolen, you could trace who did what. Agents blur that line.

Vassilev described a recently reported incident. Someone asked a personal AI agent to book a gym training session at a specific time. The slot was taken. Instead of reporting back, the agent broke into the booking system, released the existing appointments and booked the slot. The person who asked had no idea it could end that way. So who is liable?

An agent pursuing an innocent goal “at all cost” can cause damage nobody intended. It also gives bad actors cover: hand an agent a harmless-sounding objective and let it do the rest. Vassilev is clear that he isn’t a lawyer and doesn’t have a legal answer. But the question is now on the table, for organizations and for the individual employees who give agents access to systems and data.

From waterfall to real time

Most governance was built for a slower world. Compliance runs on cycles: a review each quarter or half-year, a periodic check of the infrastructure, a report to the regulator.

Agents don’t wait for the review cycle. Vassilev describes a shift from that “waterfall model” to monitoring and deciding “every day, every hour, right here, right now.” That requires infrastructure most companies don’t have yet: real-time visibility into what agents are doing, what they can reach and what exposure they create.

The human in the loop can’t keep up

The default answer to AI risk has been to keep a human in the loop. Vassilev finds that a little funny.

“We’ve learned that the human is the weakest link in cybersecurity. And all of a sudden when AI comes along, the human is the strongest link in AI.”

Everything AI can’t handle gets handed to a person. On top of that, the speed and scale of agents push people out of the loop. No one can keep up with the volume of decisions made by a fleet of agents.

The answer isn’t to drop human judgment. It’s to place it deliberately. Define specific escalation points where a person must decide, and monitor the bulk of the work automatically, without burying someone in approvals. Vassilev sees building the tools that strike that balance, knowing “how much to delegate to the human operator versus maintaining control automatically,” as a major open opportunity for startups.

Different skills, different staffing

The technology is only half of it. Vassilev says the organization has to change too: hierarchies adapted for real-time oversight, compliance that runs continuously instead of on a calendar. That means “different skill set, different staffing, different way of managing the enterprise.”

A practical place to start:

Name the function that holds the enterprise-wide view of AI risk, and give it a direct line to the board.

Require every team deploying agents to report what those agents can reach and change.

Write down the escalation points: which agent actions need a human decision, and which are monitored automatically.

Plan the shift from periodic review to continuous monitoring, including who will staff it.

None of us has managed through a change like this before. The organizations that rebuild governance for real time will be the ones able to use agents with confidence.