Overview

Lenka Blahova spent eighteen months building what looked like a model AI ethics program at a Slovak financial services firm. There was a committee, a set of principles, a review process for new AI applications, and a training module that every employee completed. Then a journalist called to ask about a pattern of loan rejections that appeared to discriminate by neighborhood. The ethics program had reviewed and approved the algorithm in question. The committee had not spotted the problem. "We had the governance," Lenka said. "What we did not have was the culture. People were treating the ethics review like a compliance checkbox. They were not asking the hard questions."

Governance structures - committees, policies, review processes - are necessary but insufficient. They catch the problems people think to look for. Culture is what determines whether people look hard enough, ask uncomfortable questions, and escalate concerns when they find them. A program without governance is chaotic. A program without culture is theatrical.

Building both requires understanding what each contributes and how they reinforce each other.

What Ethical AI Governance Actually Requires

Ethical AI governance is the formal infrastructure through which an organization makes and enforces decisions about how AI is developed and deployed. Its core components are:

Principles that are specific enough to guide decisions. "We will be fair" is not an actionable principle. "Before deploying any model that affects employment decisions, we will test for disparate impact across gender, age, and ethnicity and will not deploy a model where the false positive rate for any group exceeds the overall false positive rate by more than 5 percentage points" is an actionable principle. The test of a good principle is whether two reasonable people, applying it to a specific situation, would reach the same conclusion most of the time.

A review process with real authority. Ethics review should not be advisory. A committee that can flag concerns but cannot block deployment will see its concerns routinely outweighed by business pressure and timeline urgency. The review body needs authority to require modification or delay deployment when an ethical concern is not resolved.

This creates organizational friction. That friction is the point. Ethical governance that never slows anything down is governance that is not catching anything.

Clear accountability assignment. For each AI system in production, one named person is responsible for its ethical performance on an ongoing basis. Not the team. Not the project. One person. When Lenka's algorithm was reviewed, accountability had been distributed across a product manager, a data scientist, and a legal reviewer, each of whom assumed the others were responsible for the bias evaluation. No one was.

Documentation requirements. The decisions made during AI development - what use cases to pursue, what data to use, what tradeoffs to accept - should be documented in a form that can be reviewed later. This is not primarily for regulatory compliance. It is for organizational learning. When something goes wrong, documentation lets you understand what was known, what was considered, and what was missed. That understanding is what drives improvement.

What Culture Adds That Governance Cannot

Governance creates the structures. Culture determines whether people use them honestly.

An ethics review process is only as good as the quality of questions being asked in it. If the culture treats the review as a box to be checked, reviewers will confirm that obvious problems have been addressed and approve the rest. If the culture genuinely values ethical scrutiny, reviewers will ask the uncomfortable questions that do not appear on any checklist - the ones that require imagination and moral seriousness to even formulate.

Three cultural conditions distinguish organizations where ethics governance works from organizations where it is ceremonial:

Psychological safety for raising concerns. People will not surface ethical concerns if doing so marks them as obstacles, delays projects, or creates friction with senior sponsors. The organization needs a visible track record of concerns being received seriously, investigated genuinely, and - where warranted - acted upon. If the only publicly visible outcome of raising an ethics concern is a difficult meeting followed by approval anyway, the incentive to raise future concerns disappears.

Ethics questions woven into normal work. In organizations with strong ethics cultures, people ask ethical questions at the beginning of AI projects, not as a final gate before launch. "Who could be harmed by this system, and how?" is a design question, not an audit question. Embedding that question in project kick-off templates, design reviews, and sprint retrospectives makes it routine rather than exceptional.

Leadership behavior, not leadership statements. Cultures are shaped by what leaders do, not what they say. If a senior executive overrides an ethics committee recommendation to meet a launch deadline, the message that sends to the rest of the organization is unmistakable. If the same executive delays a launch to resolve an ethical concern, the message is equally clear. People watch closely and calibrate their behavior accordingly.

From Principles to Practice: The Ethics Review

The ethics review is the moment where governance and culture meet. A well-designed review process covers four areas:

Purpose and proportionality. Is this AI application solving a genuine problem, in a way that is proportionate to the risks it creates? Some applications are high-value but also high-risk. The ethics review should surface the risk-value tradeoff explicitly, not assume that business value justifies any level of risk.

Affected population analysis. Who is affected by this system? Are any affected groups particularly vulnerable? Have any of them been consulted? Systems that affect people who have limited power to contest or respond to the decisions being made carry greater ethical weight than systems affecting parties who can advocate effectively for themselves.

Failure mode analysis. What are the ways this system can go wrong? What is the worst realistic failure? What is the worst plausible failure? How would each failure be detected? How would it be remediated? Lenka's committee had not explicitly asked what the worst realistic failure of the loan algorithm was. If they had, they might have identified the neighborhood-based disparate impact as a plausible outcome and designed a monitoring mechanism to catch it.

Ongoing oversight design. How will this system be monitored for ethical compliance after deployment? Who is responsible? What triggers a review or suspension? Ethics governance does not end at launch. It begins there.

Rebuilding After a Failure

Lenka's firm had to rebuild its ethics program after the loan algorithm story became public. The technical remediation was straightforward: rebuild the model with bias controls, re-evaluate affected decisions, implement continuous monitoring. The cultural rebuilding was harder and took longer.

What worked: a CEO message that explicitly named the failure as a governance and culture failure, not just a technical one. A series of small-group conversations where employees could ask questions and raise concerns about the program - not town halls, but groups of eight to twelve people with a facilitator. Three publicly visible cases where ethics concerns delayed or modified AI deployments. And a change to the performance review process that included an explicit criterion around raising and responding to ethical concerns.

>
An ethics program earns credibility in the specific moments when it is inconvenient. Any process looks good when there is nothing hard to surface.

Key Takeaways

• Governance and culture are both required. Governance without culture is theatrical. Culture without governance is chaotic. Each reinforces the other.
  - Principles must be specific enough to guide decisions. Vague values do not prevent specific harms. Testable, operationally defined principles do.
  - Ethics review bodies need real authority. A committee that cannot block deployment catches nothing. Friction is a feature, not a bug.
  - Assign one named accountable owner per AI system. Distributed accountability is a mechanism for avoiding accountability.
  - Psychological safety is a prerequisite for honest review. If raising concerns has visible negative consequences, people will stop raising them.
  - Leadership behavior shapes culture more than any policy document. The moments when ethics creates inconvenience are the moments that define what the organization actually values.
  - Post-deployment oversight is where ethics governance is most often skipped and most often needed. Design the ongoing monitoring at launch, not in response to the first failure.