AI System Transparency and Corporate Governance

#business #croatia

The level of automation an organisation introduces must be matched by an equal level of audit trail — otherwise speed becomes a source of risk rather than an advantage.

Over the past few years, almost every organisation seriously pursuing digitalisation has faced the same question: how deeply to automate decision-making without losing the ability to explain why a given decision was made. The answer increasingly heard in practice is that technical feasibility should never be the only criterion. An equally important question is whether the organisation can show, at any moment, who approved, changed, or rejected something, when, and on what basis.

While automation was until recently viewed mainly through the lens of efficiency — faster processing, less manual work, higher volume — regulatory and market expectations have shifted the focus toward provability. It's not enough for a system to reach the right decision; there must be a trail showing what data, rules, and approvals produced that decision. Without such a trail, fast automation actually accelerates the spread of uncertainty rather than reducing it.

This is especially true for processes that directly affect financial statements, contractual obligations, or public disclosures. If a system automatically drafts text, classifies risk, or assigns tasks, management needs a clear answer to whether that recommendation went through human review before becoming part of an actual business process.

In practice it's useful to distinguish at least three levels at which automated or algorithmic systems can operate within an organisation, since each carries a different degree of risk and different oversight requirements. The first level covers internal data processing with no direct external effect — sorting, classification, suggestions for further analysis — where an error is relatively cheap because it's immediately visible internally and easy to fix. The second level covers preparing content or recommendations that a human must explicitly approve before they become visible outside the organisation — draft posts, proposed contract changes, risk assessments a manager must confirm — where it's essential that the approval is genuine, not a formality with no real content. The third level covers actual, executed business decisions with legal or financial effect, for which there is no substitute for human accountability, however sophisticated the system is at preparing the basis for the decision.

One of the most common sources of confusion in public communication about digital transformation is mixing illustrative, educational depictions of how algorithmic systems work with real business decisions. A display illustrating what an automated process might look like — with a visualised workflow, simulated progress indicators, or synthetic examples — has clear educational value, but that value exists precisely because it is transparently labelled as illustrative, not as a source of real business or financial claims.

Organisations that publicly showcase automation concepts should consistently label whether a display is a concept demonstration or an actual operational system with real consequences. That distinction isn't cosmetic — it determines the level of trust a reader or partner can reasonably place in the figures shown.

The European regulatory framework for artificial intelligence increasingly distinguishes systems by the level of risk their use carries, with systems affecting financial, legal, or safety outcomes subject to stricter requirements for documentation, oversight, and the possibility of human intervention. Regardless of how individual regulations ultimately take shape, the direction is clear: the burden of proof is shifting from whether a system is accurate to whether its operation is documented, explainable, and supervised.

For organisations, this means investing in an audit trail, clear approval roles, and data-source documentation is not an administrative cost that slows innovation, but a precondition for automation being able to scale safely at all.

For governing bodies, this comes down to a few concrete questions worth asking regularly: which decisions within the organisation are today assisted by automated systems; is a clear approval level defined for each; is that level actually applied in practice, not just written into an internal policy; and can it be reconstructed at any moment who made a specific decision, when, and based on what data.

Organisations able to answer these questions with confidence are in a stronger position not only with regulators but also with their own investors, partners, and employees — because trust in digital processes grows with the level of transparency, not with the speed at which those processes were introduced.

This publication is an original analysis; the sources cited serve as reference documentation.