Who's Responsible When AI Goes Wrong? A New Framework Aims to Answer That Question - Coalition for Secure AI

Join Now

Who’s Responsible When AI Goes Wrong? A New Framework Aims to Answer That Question

Coalition for Secure AI Unveils New Agentic Identity and Security Research Following High-Profile Sessions at RSAC 2026<br>May 6, 2026

Coalition for Secure AI Unveils New Agentic Identity and Security Research Following High-Profile Sessions at RSAC 2026<br>May 6, 2026

When an AI system causes harm or fails a compliance audit, the finger-pointing starts almost immediately. The model provider blames the configuration. The cloud provider points to the tenant. The application team cites model limitations. Our new AI Shared Responsibility Framework is designed to end that cycle before it starts.

Most organizations have spent years building clear lines of ownership around their technology stacks. They know who owns the network, who owns the application layer, who calls the vendor when something breaks at 2 a.m. AI has complicated all of that.

The problem is not that AI systems are inherently ungovernable. The problem is that the accountability structures most organizations rely on were designed for a different era of technology. A traditional cloud shared responsibility architecture divides the world cleanly between provider and customer. AI systems operate across layers this architecture was never designed to address: foundation models trained on third-party data, platforms that stitch together multiple vendors, agentic systems that can take autonomous actions on behalf of users, and regulatory requirements that cascade differently across the stack depending on the industry you operate in.

When something goes wrong across that kind of architecture, the question "whose fault is this?" becomes genuinely hard to answer. And the longer it takes to answer, the longer it takes to fix.

Read the full AI Shared Responsibility Framework here.

A Framework Built for How AI Actually Works

CoSAI’s Workstream 2 has spent the past year building a structured answer to this problem. The result is the AI Shared Responsibility Framework (AI SRF), a five-layer model that maps accountability across the full AI stack and assigns exactly one responsible party to each component.

The five layers reflect how AI systems are actually built and operated:

AI Business and Usage covers governance, regulatory compliance, and the business decisions organizations make about how AI is deployed. This layer exists because AI-specific regulations (FDA guidance for software as a medical device, SR 11-7 model risk management in financial services, EU AI Act requirements) create obligations that traditional cloud compliance frameworks simply do not address. Someone has to own those obligations. This layer makes that explicit.

AI Information addresses data: who owns training data, who governs what information agents can access, and how organizations manage the growing problem of shadow AI — employees using external AI tools that no one sanctioned, monitored, or secured. This is a layer the traditional three-tier cloud model skips entirely.

AI Application covers the teams building and deploying AI-powered products. Application developers integrating AI via APIs carry specific responsibilities for input validation, access controls, safety systems, and integration security that are distinct from what either the platform or the model provider owns.

AI Platform covers the infrastructure and services that host and serve AI models. Cloud providers, MLOps platforms, and model API services each have defined obligations at this layer, including compute security, compliance certifications, and the identity and access management primitives that tenants depend on.

AI Model Provider is a new layer for shared responsibility frameworks and addresses something that has been a consistent blind spot: the foundation model supply chain. Who is accountable for a model’s known susceptibility to prompt injection? Who documents training data provenance? Who maintains vulnerability disclosure processes when model-level weaknesses are discovered? This layer assigns those responsibilities to model providers, clearly and unambiguously.

The Pain Points This Framework Is Designed to Solve

The accountability gaps the AI SRF addresses are not theoretical. Courts and regulators are already making decisions that organizations were not prepared for.

In 2024, Air Canada was held liable after its customer service chatbot gave a passenger incorrect information about bereavement fares. The airline argued the chatbot was a separate entity. The court disagreed and ordered Air Canada to honor the discounted fare. No one inside the organization had clearly owned the question of what the chatbot was authorized to promise on the company’s behalf, or what would happen when it got something wrong.

Around the same time, a car dealership added an AI chatbot to its website. Within days,...