These questions started showing up in our CISOs' Slack about six months ago. First, from a financial services team trying to scope their SOC 2 Type II audit. Then from a healthcare compliance lead wrestling with HIPAA Security Rule obligations. Now they're everywhere.
The pattern's clear: your security stack got smarter, your board wants metrics on "AI-driven defense," and you're stuck explaining who's actually accountable when an autonomous system makes a call that grounds flights or locks out your payment gateway.
Here's what practitioners are actually asking when the slide deck ends and the real work starts.
Q1: If our EDR automatically isolates a server, who owns that decision for audit purposes?
You do. The system executed the action, but you authorized the policy that permitted automatic isolation under specific conditions.
For SOC 2 Type II, your auditor will ask: Who approved the isolation criteria? What's the escalation threshold? Where's the decision log? If your answer is "the AI decided," you've just created a control deficiency. The Trust Services Criteria require you to demonstrate that monitoring activities include "evaluating the results and identifying anomalies," not that your monitoring activities are the anomalies.
Document the authority chain: Define which threat scores or behavioral indicators trigger automatic containment. Assign a named owner (typically your SOC manager or CISO) who reviews isolation events within a defined window. Log every automated action with enough context that someone can reconstruct the decision six months later during an incident review or regulatory inquiry.
India's CERT-In directions require incident reporting within six hours of detection. If your AI isolated a system at 02:00 and no human reviewed it until 10:00, you've potentially missed your reporting window, and you can't blame the algorithm.
Q2: Our SIEM vendor says their AI can "auto-remediate" threats. What's the compliance risk?
The risk isn't the remediation. It's the accountability gap.
Auto-remediation works fine for low-impact scenarios: blocking a known-bad IP, quarantining obvious malware, disabling a compromised user account. These are bounded actions with limited operational consequences.
The problem emerges when auto-remediation affects critical systems. Consider the July 2024 CrowdStrike incident in India: a faulty sensor update pushed through routine automation disrupted aviation operations nationwide, forced manual boarding passes at every major airport, and affected healthcare systems relying on the same endpoint platform. No attacker was involved. A single automated update, deployed without human authority in the decision path, was enough to disrupt aviation, finance, and healthcare simultaneously.
Your compliance obligation isn't to prevent automation. It's to define which decisions require human authority based on operational impact, not just technical confidence. The NIST Cybersecurity Framework (CSF) 2.0 emphasizes governance of cybersecurity supply chain risk, which includes the risk that your vendor's automation makes a high-impact decision your organization can't explain or defend.
Q3: How do we prove "human oversight" when the AI processes millions of events per second?
You don't oversee every event. You oversee the decision framework that governs how the AI acts on those events.
Think of it like Role-Based Access Control. You don't manually approve every file access; you define the roles, assign permissions, and audit exceptions. The same principle applies to AI-driven security decisions.
Establish decision tiers:
- Tier 1 (Fully Automated): Known threats, low operational impact, reversible actions. Example: blocking a domain on your threat intel feed.
- Tier 2 (Automated with Human Review): Medium-confidence detections, moderate impact. Example: isolating a workstation requires SOC analyst confirmation within 15 minutes.
- Tier 3 (Human Authority Required): High-impact actions, attribution decisions, or anything affecting critical infrastructure. Example: disconnecting a production database requires CISO or designated deputy approval.
Your Statement of Applicability for ISO/IEC 27001 should document these tiers and map them to specific controls. Auditors want to see that you've thought through which decisions can be delegated to automation and which must remain human-authorized.
Q4: What happens if our AI makes the wrong call and we face regulatory penalties?
You face the penalties, not the AI vendor. That's the accountability layer everyone's trying to avoid talking about.
The Digital Personal Data Protection Act, 2023 in India allows penalties up to 250 crore rupees (approximately $26.2 million) for inadequate security safeguards and up to 200 crore rupees (approximately $21 million) for failing to notify a breach. The regulator doesn't care whether your AI had 98% confidence in its decision. They care whether you had adequate controls, whether you can explain the decision, and whether an accountable person signed off on the action.
Under the General Data Protection Regulation, the same principle applies. Article 5(2) requires you to demonstrate compliance, which means you need decision logs, approval workflows, and named owners for high-impact actions. "The algorithm did it" isn't a defense. It's evidence of a governance failure.
Mitigation starts with decision auditability: every automated action above your Tier 1 threshold should generate a record that includes the triggering event, the AI's recommendation, the confidence score, the action taken, and the human who validated (or overrode) the decision.
Q5: Can we use AI to meet our six-hour incident reporting requirement, or does that create more risk?
AI can help you detect incidents faster. It can't relieve you of the judgment required to determine what constitutes a reportable incident.
CERT-In's six-hour window starts at detection, not resolution. Your AI might flag 300 anomalies in an hour. Which ones meet the reporting threshold? That's a question of impact, scope, and regulatory interpretation, not statistical confidence.
Use AI to triage and correlate. Use human judgment to decide whether the correlated events constitute a breach of your critical systems, unauthorized access to sensitive data, or a cybersecurity incident affecting your operations. The Computer Security Incident Response Team lead makes that call, not the SIEM.
Your incident response plan should explicitly define who has authority to declare a reportable incident and what evidence they need to make that determination. If your playbook says "the AI will decide," you're setting yourself up for a compliance finding.
Q6: We're a mid-market company. Do we really need this level of governance for AI-driven security?
If you're using AI to make decisions that could affect operations, customer data, or regulatory obligations, yes.
The governance framework scales with your risk, not your headcount. A 200-person SaaS company relying on automated threat response for customer environments has the same accountability obligation as a 10,000-person enterprise; you just implement it differently.
Small teams should focus on three things: decision classification (which actions require human authority), named ownership (who's accountable for each decision tier), and basic auditability (logs that show what the AI recommended and what action was taken). You don't need a dedicated AI governance committee. You need a documented policy and someone who owns it.
Where to Go From Here
Start with a decision inventory. List every automated security action your tools can take. Classify each by operational impact. Assign authority levels. Document the framework in your security policies and map it to your ISO/IEC 27001 controls or SOC 2 trust services criteria.
Then test it. Run a tabletop exercise where your AI isolates a critical server at 03:00. Who gets the alert? Who has authority to reverse the decision? Can you reconstruct the decision chain six months later when the auditor asks?
AI will keep getting faster and more autonomous. Your accountability framework needs to be in place before the next update goes out.
