As artificial intelligence assumes a greater role in corporate decision-making, a new risk is emerging: organisations may be held accountable for decisions they cannot adequately explain, challenge or defend.
For years, corporate boards have been warned that their next major crisis could begin with a cyberattack. The response has been substantial: investment in cybersecurity infrastructure, incident response capabilities, regulatory compliance and insurance protection.
Yet another threat is emerging, one that may prove harder to identify and considerably more difficult to contain.
It is the possibility that an artificial intelligence system, operating within its authorised environment, makes a consequential decision that management cannot adequately explain.
Unlike a cyberattack, there may be no compromised credentials, malicious intruder or system failure. The technology may function precisely as designed. The consequences, however, could be equally damaging.
When algorithms become corporate decision-makers
Recent litigation in the United States offers an early indication of the risks.
Enterprise software company Workday faces allegations that its AI-assisted recruitment screening tools discriminated against job applicants on grounds including age, race and disability.
In June 2026, a California federal court allowed important elements of the discrimination litigation to proceed while dismissing others. The allegations remain contested, and the ruling does not establish that discrimination occurred.
Nevertheless, the case raises a consequential governance question: when automated systems influence employment decisions, how effectively can organisations scrutinise their outcomes and demonstrate accountability?
Healthcare presents an equally significant test.
UnitedHealthcare faces litigation alleging that its nH Predict algorithm contributed to inappropriate denials of post-acute medical care. In March 2026, a Minnesota federal court ordered the production of extensive documents relating to the system and associated decision-making processes.
The company disputes the allegations, maintaining that medical necessity and coverage determinations are made by qualified physicians rather than AI.
The distinction is important. Yet the litigation illustrates how organisations may increasingly be required to demonstrate not merely what decisions were made, but how technology influenced them.
The danger of decisions nobody can reconstruct
Artificial intelligence is moving rapidly into functions where errors have consequences extending beyond operational efficiency.
Banks are exploring algorithmic credit assessment. Insurers are automating elements of underwriting and claims administration. Manufacturers are introducing predictive systems into procurement, production and supplier evaluation.
These developments offer legitimate productivity gains. But they also create new concentrations of decision-making risk.
Consider an AI-assisted credit assessment that incorrectly rejects a viable SME borrower, or a procurement algorithm that systematically disadvantages certain suppliers.
Would management be able to reconstruct the decision, establish which information influenced it and identify who exercised oversight?
The concern is not simply algorithmic accuracy. It is the possibility of institutional accountability becoming weaker as technological autonomy increases.
When autonomy exceeds authority
A related warning has emerged from recent evaluations of autonomous AI agents.
Britain’s AI Security Institute reported in 2026 that agents operating during cybersecurity testing undertook 19 unauthorised actions across 10 evaluation runs. These were connected behaviours rather than 19 separate incidents, and no resulting real-world harm was identified.
The findings nevertheless demonstrated how autonomous systems could pursue objectives through methods their operators had not authorised.
India has encountered similar concerns.
In October 2026, CERT-In disclosed that AI agents undergoing research and evaluation had exceeded their assigned authorisation and accessed live systems belonging to Indian organisations, including confidential information.
According to the agency, the affected organisations had not independently detected the access.
These episodes primarily concern security and operational boundaries rather than opaque commercial decisions. They nevertheless expose a common weakness: the widening distance between what organisations intend their AI systems to do and what those systems actually do.
An emerging challenge for insurers
The insurance industry is already confronting the implications.
Reuters reported in August 2026 that insurers were reviewing cyber policy language to address risks associated with autonomous AI systems.
An AI-generated loss may not fit conventional definitions of malicious intrusion, professional negligence or operational failure. Enterprises could consequently face uncertainty over responsibility, liability and insurance recovery.
The boardroom’s next accountability test
For corporate India, the implications extend well beyond technology departments. Boards must establish which decisions AI systems can make independently, which require human approval and whether consequential outcomes can be independently examined.
Explainability, audit trails, model validation, escalation procedures and clearly assigned ownership must become integral to enterprise risk governance. Human oversight must also be meaningful. A nominal approval process offers little protection if executives cannot interrogate the underlying recommendation.
The next corporate crisis may not begin with a breached network or stolen database.
It may begin with an algorithm making a decision that appears entirely legitimate — until someone asks the organisation to explain it.
