Control · C-105 · Skills, Capability & Culture

Speak-up route for AI concerns

Staff can raise concerns about how AI is being built or used, in confidence and without fear of reprisal, and each concern is assessed, investigated where warranted and answered.

Control type: Detective
Family: 12 Skills, Capability & Culture
Risks addressed: 3
Audience: Board · Heads-of · Practitioner
Frameworks: Clause 7 · GOVERN 4
Responsible AI domain: 11 Monitoring, Assurance & Incidents
12 Skills, Capability & Culture
Lifecycle stage: 7 Operate & monitor
Reviewed: 2026-11-11

What it does

It brings to light what staff know and formal controls miss. People who work with AI systems see faults, shortcuts and misuse before any report shows them: a model known to be unreliable, a review that has become a formality, monitoring that has gone too far. A defined route lets them say so, to someone independent of the line concerned, with their identity protected. Concerns are logged, assessed and answered. A senior owner independent of delivery is accountable. The route is open continuously, and its use is reported to the board.

How to implement it

State that concerns about AI are within the organisation's speak-up arrangements, and name the route.
Give access to someone outside the management line of the system concerned.
Protect confidentiality, and act visibly against retaliation.
Triage each concern, investigate where warranted, and tell the person the outcome.
Pass substantive concerns to the system owner, the governance forum or the regulator as appropriate.
Report volumes, themes and outcomes to the board.

Evidence it operates

Design: a speak-up policy that covers AI; a named independent recipient. Operation: a log of concerns with outcomes; evidence of feedback to those who raised them; actions taken as a result; board reporting; staff survey results on willingness to speak up.

Where it fits

In operation, across every system. It supports intrusive AI monitoring of workers, unfair algorithmic management and weak independent assurance of AI, by giving a channel that does not depend on management reporting. It complements the feedback and complaints channel for AI, which serves users and the public.

Limits

A route is used only where staff believe they will be heard and not harmed, and that belief is slow to build and quick to lose. Many concerns are never raised. Staff who are monitored closely by AI may be the least willing to speak. The channel finds what individuals choose to report and is no substitute for assurance.

Risks this mitigates

Supporting mappings

Intrusive AI monitoring of workers High: Gives staff a route to raise concerns. AI is used to monitor staff activity, communications or behaviour in ways that are disproportionate, opaque or beyond what the stated purpose needs.
Unfair algorithmic management High: Staff can raise concerns about how they are being managed by AI. AI is used in recruitment, task allocation, performance assessment or dismissal without fairness testing, explanation, human review or a route to challenge.
Weak independent assurance of AI Medium: Concerns raised by staff give assurance functions a source they would otherwise lack. Second-line review and internal audit do not cover AI with sufficient skill or frequency, so control failures persist undetected.

Framework and clause references

Framework	Clause	Title
ISO/IEC 42001:2023	Clause 7	Support Communication.
NIST AI Risk Management Framework (AI RMF 1.0)	GOVERN 4	A culture that considers and communicates AI risk A culture that surfaces risk.

How to cite

Axiom Verity (2026). Speak-up route for AI concerns. Reference Library, C-105. https://axiom-verity.com/controls/speak-up-route-for-ai-concerns. Reviewed 2026-11-11.

Found an error or a better source? Report a correction.