Short answer
After AI supplies an answer, people remain responsible for defining the purpose, having the right to use the input, checking consequential claims, deciding whether to adopt the output, explaining AI's role to affected people, and correcting harm. A model can produce text, a score or a recommendation. It does not automatically acquire your duty of care, professional obligation or responsibility to another person. When a person or organisation uses the output in the real world, responsibility has not been transferred through the prompt box.
Separate generating an answer from adopting it
A sentence generated by a model is initially an output inside a computing system. It gains practical force when someone copies it into a report, sends it to a customer, enters it in a medical record or uses it as the reason to refuse an application. That boundary matters. The generator may be a machine; the adopter is still the person or organisation that acts.
“The AI said it” is therefore not an account of responsibility. At most, it identifies one source of material. It does not explain why the output was suitable for this purpose, whether the evidence was sufficient, who checked it, or how an affected person can challenge it. A calculator does not relieve an accountant of checking units and inputs. Translation software does not relieve a contracting party of confirming legal meaning.
Australia's National AI Centre makes “decide who is accountable” the first essential practice in its adoption guidance and calls for end-to-end accountability at organisational and system levels. Australian Government: Guidance for AI Adoption—Implementation Practices This is not about giving the AI a nominal owner. It means someone has the authority to pause, investigate, correct and report each use.
The person asking is responsible for defining the use
Whether the same output is adequate depends on its purpose. Asking AI to list themes in a public report may produce a reading guide. Using the same summary as the board's only account of every risk changes the task. The requester must specify whether the system is creating ideas, a draft, a retrieval result, a classification or a final decision. The requester must also identify missing information and inferences the model is not permitted to make.
Vague tasks delegate unstated values. “Find the best candidate” does not define whether best means experience, potential, availability or contribution to a diverse team. “Make this complaint more professional” may remove facts carried by the complainant's anger. A person cannot omit the objective and then treat the objective improvised by a model as neutral.
Defining use includes selecting the audience. A rough private note can contain uncertainty and placeholders that would be unacceptable in published advice. A model may be invited to challenge an internal assumption but should not be presented as an independent expert to a client. The person creating the task owns this context even when the interface makes every request look like the same chat.
The person providing material is responsible for rights and necessity
Entering material into AI is not neutral transport. Inputs may contain client identities, health information, trade secrets, access tokens, unpublished decisions or copyright material. The user needs to know whether they may provide it, whether the provider retains it or uses it for training, whether processing crosses borders, and whether names can be removed or the scope reduced.
The Office of the Australian Information Commissioner advises organisations adopting commercial AI to understand data flows, third-party access, settings and retention. As a matter of best practice, it recommends not putting personal information, particularly sensitive information, into publicly available generative tools. OAIC: Guidance on privacy and the use of commercially available AI products An employee choosing to paste information does not erase the organisation's privacy obligations.
The duty extends to minimisation. Having permission to use a full case file does not mean the model needs every page. Supply the paragraph, de-identified table or synthetic example sufficient for the task. Minimisation reduces the effect of a compromised account, a mistaken share setting and an unexpected provider feature.
The reviewer is responsible for checks proportionate to consequence
Review is not reading an answer once and finding it fluent. Factual output should be checked against original sources. Calculations should be recomputed independently or verified by deterministic tools. Professional advice should be assessed by someone with the relevant competence. Classifications affecting a population should be tested for concentrated errors. Depth of review should follow the consequence of error, not the number of words.
The reviewer is also responsible for omissions. AI can produce an apparently complete answer without visibly identifying an attachment it did not receive, an expired policy, oral context or a counterexample. A summary with no obvious false sentence may still cause a wrong decision because it left out a decisive limitation.
If an organisation gives a reviewer one minute to approve material that requires thirty minutes to verify, the failure is not simply insufficient care by that reviewer. The process has manufactured a rubber stamp. Responsibility cannot be pushed entirely to the last employee in a chain. Managers own workload, training, access to evidence and authority to stop.
The decision-maker owns the choice to create an effect
A final decision-maker should be able to answer three questions: which part of the result depended on AI; what independent evidence supports it; and whether the decision can still be explained if the AI portion is removed. This test exposes situations where a person formally approves but substantively follows the system.
For decisions affecting rights or opportunities, retaining a human click is usually insufficient. An affected person may need to know that AI participated, what types of information were used, how to request correction and whether a person with genuine discretion can reconsider. Australian guidance separately identifies transparency, testing and monitoring, and maintaining human control as essential practices. Accountability is a testable process, not a signature. Australian Government: Guidance for AI Adoption
Decision ownership also means resisting the false comfort of probability. A system reporting an 82 per cent score has not decided the threshold, the acceptable trade-off between errors, or how exceptions should be treated. People set those rules and must justify them.
A supplier owns product promises, but a buyer cannot outsource everything
The supplier of a model or application is responsible for matters within its control: security design, documentation, known limitations, service commitments, data handling and non-misleading marketing. The purchasing organisation is responsible for selection, configuration, connected data, permissions and the local use case. A product that performs well in its documented environment is not thereby suitable for recruitment, healthcare or credit decisions.
Contracts can allocate support and indemnity, but they do not automatically give an affected person timely correction. If a supplier updates the model and the organisation continues without retesting, if an administrator gives an agent excessive permissions, or if staff are encouraged to use public tools without training, the local deployer cannot point only to the vendor.
A practical allocation follows control. Whoever chooses the objective owns the objective. Whoever provides data owns authority and quality. Whoever designs the process owns checkpoints and permissions. Whoever approves the decision owns adoption. Whoever operates the service owns its security controls and promises. Shared responsibility is not the same as absent responsibility.
Transparency requires more than an “AI-generated” label
A label alerts a reader but does not explain AI's role. One report may use AI only for grammar; another may use it to select evidence and form conclusions. Calling both “AI assisted” conceals a material difference. A useful disclosure says which steps used AI, which material a person verified, who made the final decision and how to request correction.
Disclosure should follow impact. Private brainstorming does not require a public notice. An automated message affecting a customer's contract or rights requires more direct explanation. The purpose of transparency is not to disclaim responsibility. It is to let another person understand, assess and challenge the process.
Transparency also needs restraint. Publishing a complete prompt may expose personal or confidential material. The right level describes role, source categories, controls and limitations without creating a new privacy or security problem.
Records make responsibility real
Accountability without records often exists only as memory after an incident. Consequential workflows should preserve purpose, source of inputs, system or model version, important instructions and settings, output, human edits, approver and date. A complete audit log is unnecessary for every private writing aid, but reconstructability should rise with consequence.
Records protect careful users as well. If a system later changes or a source is updated, the record shows what evidence and limitations existed at the time. When a customer challenges a decision, the organisation can demonstrate what actually happened instead of asserting that a human was somewhere in the loop.
Good records distinguish machine output from adopted content. Track which passages were accepted, changed or rejected. Record significant disagreement and the reason for override. Otherwise an archive may preserve the final document while losing the most useful evidence about how judgment was exercised.
After an error, responsibility means repair
Real responsibility includes stopping propagation, notifying affected people, reversing actions, restoring data, compensating loss, investigating causes and changing the process. Editing the prompt without helping people already affected is not complete correction. Punishing the final person who clicked approve without examining workload, interface and management targets will not prevent repetition.
Existing Australian law may still apply to AI-related misleading statements, privacy failures, discrimination, defective products or failure to take reasonable care. AI use is not itself a legal vacuum. Australian Government: The legal landscape for AI in Australia The legal allocation depends on facts and applicable law, but the operational starting point is clear: do not treat the system as a box that absorbs responsibility.
My assessment: retain three kinds of ownership
A healthy AI workflow has three explicit owners. Content ownership identifies who confirms facts and expression. Decision ownership identifies who decides whether the output should affect the world. System ownership identifies who monitors permissions, versions, incidents and improvement. One person may hold all three in a small team; a large institution may separate them. None can remain vacant.
This division also avoids putting all pressure on an ordinary user. An employee can be responsible for whether they checked a claim but may be unable to select the vendor, change retention or obtain more review time. Management owns those structural conditions. Accountability is not the search for someone to blame. It is making sure every control belongs to someone able to act.
Checklist before adopting an output
- Is the output intended as a draft, recommendation or final decision?
- Was the input necessary and accurate, and did we have authority to provide it?
- Which claims were checked against independent sources?
- Does the reviewer have time, competence and power to reject the result?
- Do affected people need disclosure, explanation or a route to challenge?
- Have the system version, sources, human edits and approver been recorded?
- If the result is wrong, who can stop, reverse, notify and repair immediately?
- What is controlled by the vendor, organisation, manager, reviewer and decision-maker?
Conclusion
AI can generate content. It cannot decide why the system should be used, whether the data may be supplied, whether evidence is sufficient, whether an outcome should take effect, or how a wrong outcome will be repaired. People and institutions adopting AI output retain choice and control, and therefore retain corresponding responsibility. Trustworthy use is not a disclaimer in the footer. It is a workflow in which purpose, data, review, decision, records and remedy each have an identified owner.
Related questions
Continue reading: All articles in How Far Should You Trust AI?
Discover more from Geoffrey Chen
Subscribe to get the latest posts sent to your email.