Understanding Ethical AI

Last week I delivered a Keynote at the Okta AI Identity Summit in London, speaking to a room of IT directors, security leaders and identity professionals about a question that is moving very quickly from the theoretical to the urgent: if an AI agent is authorised to act, who is accountable when it does? I want to share here the core of what I discussed, because it applies far beyond that room. The honest picture is that adoption is real, but it is lopsided. Deployment has run ahead of governance. When I ask a security leader whether they can name every agent running in their organisation, and who owns each one, the response is usually a pause. So the question is not whether this is hype. It is genuinely happening, in more places than most organisations can see. The gap is between how fast we are putting agents to work and how slowly we are learning to answer for them. Let me start with the scale of what we are dealing with. For every human identity in the enterprise today, there are now around 109 non-human ones. These are the service accounts, tokens and, increasingly, the AI agents that quietly run our systems. The agents are the fastest growing part of that picture. Gartner expects the average Fortune 500 organisation to be running over 150,000 of them by 2028, up from fewer than 15 in 2025. But the figure that should stop us in our tracks is this: only 34% of organisations apply the same identity and access controls to their agents as they do to their people. So we have taken on an enormous new workforce, practically overnight, and two thirds of us are not governing it the way we would govern a human employee. That gap, between what our agents can do and what we can answer for, is the whole problem. It helps to separate two ideas that are often confused. Control answers a technical question: can the agent be seen, scoped and stopped? Accountability answers a human one: when it acts, who answers for it, and can you prove it? Those are not the same thing. A system can be perfectly controlled and still leave nobody answerable. You can have full visibility, least privilege access, guardrails and a working off switch, every technical box ticked, and still be unable to say whose name is on the outcome when something goes wrong. Control is a setting. Accountability is a decision, and only people make it. This matters because the liability is not hypothetical, and the law already points squarely at us. An agent has no legal personhood. You cannot sue it and you cannot sanction it, so a human or the organisation is always the liable party. “The AI did it” is not a defence. The Information Commissioner’s Office has been explicit that you answer for the outcome whether a person or an agent carried it out. Human oversight is not merely good practice either; it is a legal duty, with UK GDPR Article 22 giving people rights over decisions that significantly affect them, and a statutory code now in place on AI and automated decisions. The financial exposure is real money: up to 17.5 million pounds, or 4% of turnover, under UK GDPR, and up to 10% of global turnover under the Competition and Markets Authority’s regime. And if you serve customers in the European Union, the EU AI Act reaches you on top of all of that. The liability already exists. The only question is whether you can meet it. People often tell me they are waiting for the law to arrive before they act. The UK does not have a single AI Act, that is true, but what we have instead is a principles based approach, and your agents are already regulated under it. The ICO governs what your agents do with personal data and is updating its automated decision making guidance right now. The National Cyber Security Centre has set clear security expectations. The Competition and Markets Authority now covers traders deploying agents, and the Digital Regulation Cooperation Forum, which brings the CMA, the Financial Conduct Authority, the ICO and Ofcom together, is mapping where all of this overlaps. There may be no single statute, but five principles bind every one of those regulators: safety, transparency, fairness, accountability and contestability. “We are waiting for the law” is not a strategy. The expectations are already here. They are simply spread across the regulators you already answer to. The cyber security community should take some confidence from where this is heading. In May, the National Cyber Security Centre, together with its Five Eyes partners, published guidance on deploying agentic AI. It says that before you deploy an agent you must decide five things: who owns it, who approves its access, who monitors its behaviour, who reviews incidents, and who can stop it when something goes wrong. Its blunt test is that an agent you cannot understand, monitor or contain is not ready to deploy. Notice the pattern in that list. Ownership. Authorisation. Oversight and audit. An off switch. That is not just one speaker’s framework. It is what the country’s own cyber authority now expects of you. The framework I shared distilled into four questions to ask of every single agent you run. First, who owns it? There should be a named, accountable human behind every agent, because if no one’s name is on the door, no one answers when it walks through yours. Second, what can it do? Scoped, least privilege access to the systems the task needs, and nothing more. Do not hand the agent the master key. Third, how do we know what it did? Every action should be logged, attributable and tamper evident, with traceability built in by design rather than reconstructed after an incident. And fourth, when does it stop? A clean lifecycle, in which the agent is provisioned, rotated, revocable and decommissioned, with an off switch you have actually tested. If you can answer all four for an agent, you can be accountable for it. If you cannot answer even one, that is not an agent you have deployed. It is an agent you have lost track of. The principle of least privilege deserves a moment on its own, because it is doing more work than people realise. Least privilege means giving an identity only the access it needs to do its specific job, and nothing more. Not what might be handy, not what is easiest to set up, and not the same access as the team it sits in. Think of a new cleaner who is given a key to the offices they clean, rather than the master key to the building, the safe and the server room. Even if the master key would be more convenient, you do not hand it over, because the risk if it is lost or misused is enormous. For AI agents the same logic applies, and it matters more, because agents act fast, at scale, and often without a human watching each step. An agent built to summarise support tickets needs read access to the ticket system, and that is all. It does not need to write to your customer database, issue refunds or reach your finance data simply because those things happen to be reachable. If it is over provisioned and it misbehaves, or it is hijacked, the blast radius is everything it could touch, not just what it was meant to touch. This is precisely why it is so concerning that 97% of non human identities carry privileges beyond what they actually use. That standing, excess access is the gap attackers exploit, and every unused permission is a door you have left open. Answering those four questions is how you move from authorised to accountable, because accountability you cannot evidence is not accountability at all; it is hope. Four things make it real. Attribution, so that every agent action traces to one identity and one human owner, never blurred across a shared account. Explainability, because if you cannot explain how an output was reached you should not ship it, since opacity is a liability rather than a feature. Audit and escalation, meaning immutable logs, sampled reviews and a fast, human route to challenge or reverse an agent driven outcome. And decision rights, which define the calls an agent may never make on its own, on the basis that the higher the stakes, the more a human stays in command.  The biggest mistake I see is treating all of this as a technology project rather than an accountability one. The Boston Consulting Group has a useful rule of thumb for AI success: roughly 10% is the algorithms, 20% is the technology and data, and 70% is the people and the processes around them. In other words, you can buy the tools, but you cannot buy the culture, the ownership and the judgement that make them safe. The organisations that struggle are the ones that automate first and ask who owns this afterwards. Authorised means an agent is allowed to act. Accountable means you can stand behind what it did. The organisations that will thrive in the agentic era are the ones that treat that distinction as a design principle rather than a clean-up exercise, and that decide, before anything goes live, whose name is on the outcome. The technology is the easy part. The real work, and the real advantage, is human judgement, governance and accountability by default. If you would like to talk about how to put this into practice in your organisation, I would love to hear from you.

It was an inspiring day at Engage London, hosted by Everest Group — an event that brings together leaders and innovators shaping the future of global business services (GBS), sourcing, and technology. I was honoured to deliver the closing Keynote: "The Connected Advantage with AI: From Ambition to Scaled Value." My session explored how organisations can move beyond AI experimentation and isolated pilots, by connecting strategy, data, people, process and governance. The real competitive advantage comes when AI is not treated as a standalone initiative, but as a business-wide capability that delivers trusted, measurable value at scale. I also spoke about the importance of strong leadership, readiness across people and process, and building the right foundations to scale AI responsibly. I've now written three books on applying AI to business — the most recent published in November 2025 — but in a field moving this fast, staying current is a daily discipline, not a one-time effort. Events like Engage London are genuinely invaluable for that reason, and I came away with a great deal to reflect on. The panel sessions were particularly rich, and several themes stood out: GBS leaders are becoming the custodians of experience. They are increasingly orchestrating work with a bird's-eye view across the total workforce — a significant shift in how the function is understood and valued. The "3 Ss" were a standout insight: self-service, self-adaptation, and self-healing. These three principles offer a compelling framework for thinking about where intelligent automation is heading. GBS has a critical role in governing the AI estate. Trusted data, and people and process readiness, were highlighted as non-negotiables — not optional extras — in any serious AI programme. Resilience remains central to sustained competitive advantage. Amid so much disruption and uncertainty, the organisations that build resilience into their operations will be the ones that endure. One comment that particularly resonated was around intellectual curiosity as a leadership quality. In the AI era, the ability and willingness to keep asking questions is arguably as important as any technical skill. Another powerful observation was about the human dimension of AI adoption: enabling humans to act at the pace of AI, while AI strives to act with the empathy of humans. It's a thought-provoking framing that I'll be carrying into future conversations. There were also excellent insights from Rolls-Royce — a company I had the pleasure of collaborating with for my previous book launch. The reflections shared on cultural change driving sustained behavioural change were memorable: embedding the right mindset into hiring, onboarding and assessment criteria; the shift from awareness to daily habits; and ensuring governance is underpinned by constant dialogue and feedback rather than top-down mandates. Well done to the entire Everest Group team for curating such a thought-provoking event and for the excellent organisation throughout the day. To find out more about Katie's keynote topics and availability, visit the Keynotes page.

Jambo! Heading home from my latest trip - this time to Zanzibar. I’ve dreamed of visiting for 30 years or more, ever since my dad shared with me a marriage certificate from 1941, which revealed that my grandmother (the Nan I adored) married the Sultan of Zanzibar’s son, and seeing in the certificate’s margin an intriguing ‘police exhibit one’ stamp.  That’s what inspired me to research her complex life story spanning different geographies, and write an historical fiction novel. I recently completed the first draft of 100k words; next step is to edit it and find an agent/publisher. I’ve had 2 - soon to be 3 - business books on AI published by Kogan Page Publishing but this is a whole new experience. This is about giving her a voice; it’s her legacy. Please let me know if you’re aware of any potential interested parties. 🙏 This visit was to the western coast of Unguja, the main island of the Zanzibar Archipelago. I’ve travelled far and wide, but this was my first sighting of the exquisite Indian Ocean. The highlight was a walking tour in Stone Town – the old part of the city. The Sultans commissioned many of the incredible buildings. There’s also a museum dedicated to Freddie Mercury who was born in Zanzibar. And I had a rare opportunity to join a school graduation party. My Guide Kassim was a gem – so well informed and so kind. As a business trip it has not been all plain sailing. I’ll remain professional and spare the details. Suffice to say you never give up learning, and doing business across borders and different legal jurisdictions can pose real challenges. A huge positive learning is the Swahili phrase “pole pole" (pronounced pole-ay pole-ay) meaning “slowly, slowly" or "take it easy" and it reflects a cultural philosophy of patience, an unhurried approach to life, and a mindful appreciation for the present moment. It encourages a calm, relaxed mindset, often encountered in the laid-back lifestyle of East Africa, but also used as practical advice for achieving goals. Wise words for many of us living and working in hectic towns and cities…

AI is no longer a buzzword – it’s business-critical. I’ve seen that change in the 6 years since my first AI book was released, compared to the landscape today and the case studies I researched for book 3 (due out in November.) AI is impacting every sector, including insurance. I’m featured in the latest issue of Modern Insurance Magazine – which delves into how AI is transforming every aspect of insurance – from underwriting and fraud prevention to customer experience and claims. You can read the full issue here . On page 13, I explore ethical and responsible AI adoption, as does Sagacity Charles Skamser breaks down the emerging AI landscape and what it means for insurers. There are real-world applications from organisations including FibriCheck, I Love Claims, Steeper Group, Geo Sec, SkinVision and A3 Alternative Accommodation Agency Ltd. There are insightful contributions from the Editorial Board and from the following: Carpenters Group, Digilog UK, e2e Total Loss Claims Management, NWVA, FMG, ParaCode, QuestGates, National Windscreens, Lyons Davidson Limited, Auxilis, Thatcham Research, Rapid Repair Network, Witness Wise, CMG, Copart UK Limited, and Laird Assessors. A Fraud Prevention Spotlight offers expert input from Adele Sumner, Allianz, WHITELK Fraud Performance Consulting, FRISS, RGI Solutions, Charles Taylor, and Insurance Fraud Bureau (IFB). I've worked with many Associations, across multiple sectors. This issue features many Association Insights, including BIBA, Motor Accident Solicitors Society (MASS), FOIL - the Forum of Insurance Lawyers, Association of Personal Injury Lawyers (APIL), Chartered Insurance Institute, Managing General Agents’ Association (MGAA), IAEA, CHO on legislative change, ethical innovation, and the broker’s evolving role. The team even asked ChatGPT for its thoughts. What does AI think about its role in the industry? Big thanks to editor Hayley Dalton.

Big thanks to Partnerize for inviting me to deliver the Keynote at their Partnership Day – an event dedicated to AI and innovation in affiliate marketing. My session explored wider company AI strategies, as I shared with the audience ‘stealable innovation’ whereby they can learn from other sectors, as well as a check sheet for measuring the AI potential in a business. Following my talk, Rebecca Betteridge, Hollie Macdonald, Molly Lediard, and Matilda Kousa formed a panel to discuss the future of partnerships for fashion and beauty. AI also featured heavily, as the panel shared the challenges which brands face in gaining buy-in for AI from the business. They talked about the need to educate in order to alleviate concerns; and how important time and patience are. So interesting to hear their advice on the need to shift the narrative of affiliate marketing, focusing instead on innovations with AI such as dynamic commissioning and a personalised approach at the checkout. These incredible ladies represent leading brands and organisations - Selfridges, Puig, Klarna and Fenwick and they were able to advise us all about the need to adapt to changing consumer behaviour, particular during this period of unpredictable socio economics and global uncertainty. They debated the need to research how and when customers shop; also the importance of price sensitivity, given how customers conduct online research and then visit physical stores. We learned how peer reviews have gained importance in how consumers trust brands. Thanks for these learnings. Thanks to Kate Ellis Maura Smith and all the team and congrats on staging such a great event!

What a great week of tech in sunny London! Thanks to RPC for inviting me to speak at their stunning offices in St. Katharine Docks for London Tech Week! Following opening remarks from RPC's Caroline Tuck, I gave the first Keynote on the fact that AI is no longer a distant concept – it's here and fundamentally reshaping the way businesses operate, unlocking opportunities that were once unimaginable. I walked everyone through the ways businesses can harness AI in an ethical way, how to equip your workforce in the AI era and what to consider when rolling out AI initiatives on a global scale. I was followed by Piers Wingfield – a fascinating session on how, in a single workplace, there could be up to 5 generations, each bringing different experiences, ideas and norms. While all are valuable in their own right, intergenerational conflict often stems from differing experiences. He covered how tech, including AI, is being used effectively to relieve tensions, maximise opportunities and improve workplace collaboration and culture. There was then a discussion and networking event for women in the tech industry, covering how tech usage has changed over the last 10–15 years, what the future looks like in terms of tech use in the media and entertainment and retail and consumer industries, whilst also discussing the challenges and opportunities for women in the tech industry, hearing from two incredible leaders. Big thanks to Dawn Airey CBE, Chair at Women’s Super League Football and Maria Raga Venture Partner and Angel Investor.

I've just returned from speaking in Savannah, Georgia (USA) at Nosco 's MasterMinds event. After my Keynote, I joined CEO Craig Curran to record an episode for his podcast Nosco Unpacked . We explored how AI is transforming the printed packaging industry. From reducing labelling errors to enabling hyper-personalised customer experiences, I shared real-world examples of how brands are using AI to drive smarter packaging solutions. Key takeaways from the discussion include: • AI is cutting labelling errors by up to 70%. • Smart packaging is boosting engagement through personalisation. • AI is helping teams balance creativity, compliance and speed to market. • AI is not replacing people, it's amplifying their impact. Whether you're in pharma or consumer goods, this episode is packed with insights to help you lead through innovation. Check it out below: 

Heading home from Saskatoon, Canada after a wonderful few days at the very impressive inaugural Prairie Business Summit, hosted by Edwards School of Business, University of Saskatchewan . I gave a Keynote on AI, focused on how to kickstart AI adoption for competitive advantage. I also talked about using ChatGPT to help find a literary agent for my debut novel. And my school AI programme. I have literally just finished my 3rd book for publisher Kogan Page Publishing on how to apply AI to business but like everyone else, I must learn continuously. I listened to some fabulous Keynotes, panel debates and practical workshops, hearing about step prompting, synthetic customers, the accountability of algorithms, model compression, the need for consistent use of AI, AI skill wallets and containers; how software as we know it today is over and that the future of computing involves no apps, and there will be nothing between you and your data. That nuclear fusion will offer unparalleled energy for free. The words ‘secret sauce’ were used many times. I have pages of notes but this is a quick flavour. Highlights included: A really informative, humorous session from Adam Cheyer - Siri co-founder(!) – who shared powerful insights on The Future of AI in Business and how AI, in partnership with people, significantly increases productivity. Quote: “Generative AI will be as important as the Web and Mobile. Challenges exist but ROI is starting to happen, and use cases are expanding for internal and external products. In the future, AI will offer better interfaces, both knowing and doing, and a worldwide ecosystem of partner service.” A great workshop from Scott Meyer , CEO and Co-Founder of Chipp AI – someone who shares my passion for AI in marketing and customer engagement. He outlined some great tools and frameworks involving iterative collaboration between humans and AI. Quote: “1 person with AI = 1.5-2 people without AI.” The best part of travelling around the world delivering these sessions is the opportunity to meet wonderful people and learn about local cultures. Awesome to chat to fellow speaker Ross Pambrun who shared a vision for driving growth and empowering communities in the Prairies. Coming from the UK where age is definitely not revered(!), it’s wonderful to see the respect Canada has for its elders. (I experienced the same in Australia and New Zealand.) We were lucky to hear from Elder Julie Pitzel, who blessed the food, shared prayers and inspired us with her wisdom, reminding us to keep searching for the answers, and how our spirits shine as bright as the stars. Also great to see the indigenous hoop dance by Lawrence A. Roy Jr. So…a very big thanks to the amazing Kristan Embrett Marjorie Delbaere Joelena Leader and all the team for staging such a great event., and for super moderation by the hugely energetic Heather Morrison .

The body content of your post goes here. To edit this text, click on it and delete this default text and start typing your own or paste your own from a different source.