The Next AI Problem Is Delegation Drift

Most organisations are still talking about AI adoption as if the main question were tool usage.

Who has a licence? Which team gets access? How much productivity can we claim before Finance starts quietly asking for evidence?

Wrong centre of gravity.

The serious question is now delegation. Not “can AI help?” but “what are we allowing a system to do on behalf of the organisation, with whose authority, under what proof?”

That sounds semantic. It is not.

A chatbot suggests. An agent acts. It reads files, calls tools, runs code, saves intermediate work and sits inside an execution environment. OpenAI’s recent Agents API makes that shift explicit: the enterprise product is no longer just model access, but managed environments where AI can perform work.

Check it. The old risk question was content quality. The new risk question is delegated authority.

Google DeepMind is saying the quiet part out loud too. Its AI Control Roadmap treats increasingly capable internal agents as a systems-security problem, with sandboxing, endpoint security, prompt-injection resistance and live monitoring. In other words: do not just align the model. Control the operating environment.

That should make communications, digital, marketing and sustainability teams sit up.

Because delegation drift rarely arrives as a dramatic board decision. It arrives as a workflow improvement. A campaign assistant drafts and schedules. A service agent resolves complaints. A sustainability tool classifies suppliers. A comms workflow summarises risk and prepares responses. Everyone is delighted because things move faster.

Then one day somebody asks a basic question: who authorised that?

Seriously, who?

The official story is that AI makes work more efficient. The evidence suggests something more awkward: AI also redistributes organisational judgement. It moves decisions from named people into systems, vendors, prompts, defaults, APIs and automated escalation rules. Authority does not disappear. It becomes harder to see.

That is the strategic problem.

Regulation is starting to catch the same reality. The European Commission’s AI Act transparency guidance points providers and deployers towards obligations that apply from 2 August 2026. NIST’s AI Risk Management Framework has long framed trustworthy AI around governing, mapping, measuring and managing risk.

Fine. Useful. Necessary.

But a policy document will not stop delegation drift if the operating model underneath is mush.

The missing artefact in many organisations is an authority map. Not an AI principles poster. Not a ten-point acceptable-use PDF written by Legal and ignored by everyone else. A practical map of where AI may suggest, where it may decide, where it may act, where it must stop, and where a human must be visibly accountable.

Different functions should care for different reasons.

Communications should care because an AI-assisted response, statement, briefing or social post is still organisational speech. If an agent drafts, routes or publishes, the reputational question is not whether AI was used. It is whether the organisation can explain the chain of authority behind the message.

Marketing should care because automation is already compressing creation, targeting, optimisation and reporting. If the machine can adjust the offer, audience or claim, marketers need records that show why. “The platform optimised it” is not a defence. It is an admission that nobody can explain the commercial behaviour of the brand.

Digital teams should care because interfaces are becoming decision environments. The user experience is no longer just navigation and conversion. It is consent, evidence, escalation and control embedded into the product itself.

Sustainability teams should care because AI is becoming another claims-and-impact system. If AI helps classify emissions data, screen suppliers or generate ESG copy, then the evidence chain has to survive scrutiny. Greenwash with a better autocomplete is still greenwash.

So what should change?

First, separate assistance from authority. Make a hard distinction between AI that helps a person think and AI that performs an organisational act.

Second, create escalation thresholds before deployment, not after the awkward incident. Money, safety, employment, public claims, vulnerable users, regulated advice and reputationally sensitive topics should not be left to vibes.

Third, log the evidence that matters. Inputs, sources, approvals, model versions, prompts, outputs, edits and exceptions. Not because documentation is beautiful. Because memory is weak and accountability needs receipts.

Fourth, stop pretending this is only an IT control. Delegation is a cross-functional design problem. Legal sees liability. Security sees access. Comms sees trust. Marketing sees claims. Sustainability sees impacts. The operating model has to see all of it.

The organisations that win with AI will not be the ones with the most enthusiastic adoption decks.

They will be the ones that can answer a harder question without flinching: what exactly have we delegated, and how do we know it is still under control?