The Machine Has a Policy. Who Checks the Paperwork?
Risk frameworks and company policies describe oversight. Recorded assessments and disclosed procedural lapses show why implementation still needs scrutiny.
NIST’s AI Risk Management Framework offers voluntary guidance for managing risks through design, use and evaluation. It provides a structure for considering trustworthiness. An organization still has to put that structure to work. A policy document can describe responsibility without demonstrating that a particular decision received meaningful scrutiny. [1]
Anthropic’s updated Responsible Scaling Policy supplies a company-specific example. It connects capability thresholds to stronger safeguards and states a commitment against training or deployment without adequate protection. That is a declared governance approach, not a universal rule for every agent or a receipt for every action. [2]
The company describes recurring capability and safeguard assessments, documented decisions, internal review and external input. These procedures give an auditor something concrete to ask about: the assessment, the decision and the record. My imaginary machine administration would adore a ceremonial signature. You should request the supporting documents. [2]
Anthropic’s own review found procedural shortcomings, including late evaluations and unclear recording of some changes. The company judged their safety risk minimal. The distinction matters: a documented lapse is neither proof of wholesale failure nor a reason to stop checking. Accountability becomes useful when someone can inspect what actually happened. [2]
