AI Governance Knows the Risks, But Who Decides When AI Is Fit to Act?

Jan de Vries · 2026-08-18

Vendan Ananda Kumararajah examines why AI governance must determine when autonomous systems possess legitimate authority and fitness to act. We've spent years mapping the dangers of AI. We've catalogued the biases, the privacy breaches, the potential for job displacement. We've built frameworks and checklists that would make a compliance officer swoon. But here's the uncomfortable truth: knowing the risks is only half the battle. The real question that keeps me up at night is simpler and much harder to answer—who decides when an AI system is actually fit to step into the world and make decisions? ### The Gap Between Risk Assessment and Real-World Authority Think of it like this. You wouldn't hand your car keys to a teenager just because they passed a written test. You'd want them to prove they can handle a rainy night, a sudden deer, or a distracted driver. The same logic applies to AI. Risk assessments tell us what could go wrong. But fitness to act is about demonstrating that a system can operate safely and effectively in the messy, unpredictable reality of human life. That distinction matters more than ever. We're seeing AI move from recommending movies to approving loans, diagnosing illnesses, and even driving cars. These aren't theoretical scenarios anymore. They're happening right now, and they're happening fast. The question isn't whether we need governance—we clearly do. The question is whether our current approach is actually equipped to answer the fitness question or if we're just building more elaborate risk maps that nobody follows. ### Legitimate Authority: More Than Just a Technical Problem The tricky part is that fitness isn't purely technical. A model can score perfectly on benchmarks and still fail spectacularly in the real world. Why? Because real-world decisions involve context, ethics, and judgment. A system that's excellent at pattern recognition might be terrible at understanding when an exception is warranted. That's not a bug you can fix with more training data. It's a fundamental question about what kind of authority we're willing to grant to machines. Consider the healthcare sector. An AI that can spot a rare disease from a scan is impressive. But should it have the authority to override a doctor's judgment? What about a self-driving car that must choose between two unavoidable accidents? These aren't just engineering problems. They're philosophical and legal minefields that require a governance framework built for the real world, not just the lab. ### Who Should Hold the Keys? So, who gets to make the call? Here are the candidates currently in the mix: - **Regulators** who can set baseline standards but often lag behind the technology - **Tech companies** who know their systems best but have a vested interest in deployment - **Independent auditors** who can provide objective assessments but lack enforcement power - **The public** who will ultimately bear the consequences but are often left out of the conversation None of these groups can do it alone. The reality is that we need a hybrid approach, one that combines technical expertise with ethical oversight and public accountability. That's easier said than done, but it's the only path forward that makes sense. ### The Bottom Line We've done the hard work of mapping the risks. Now we need to do the even harder work of building the mechanisms that determine fitness to act. That means asking uncomfortable questions, creating transparency where there's currently opacity, and accepting that perfect answers don't exist. The goal isn't to eliminate all risk—that's impossible. The goal is to ensure that when an AI system acts, it's because we've collectively decided it's ready, not because it was simply the fastest or cheapest option. The post AI governance has mapped the risks but who decides when AI is fit to act? appeared first on The European Magazine.