If you cannot say who switches it off, you do not have governance

In short: You are on the board of CleanCorp, and your HR team just saved money with an AI recruiter that quietly rejected three women. What now? The Executive AI Governance Boiler Room, a partner initiative with DCM and Nyenrode, turned the whole room into that board, with live votes feeding a panel. Ty Francis’s verdict on any AI system nobody can switch off: “that’s not governance, that’s wallpaper.” The fuller account is below.

Most governance sessions tell you what to think. This one made you decide. Moderated by Michael van Woerden and Romeo Kadir of DCM, held at the Nyenrode campus in Amsterdam and online at once, the Executive AI Governance Boiler Room cast every participant as a member of the governance, risk and compliance board of a fictional company, CleanCorp, “a large industrial tank cleaning company” operating across the Benelux, the UK, Germany and the Middle East. Around ten Mentimeter votes drove the afternoon, pausing every few questions for a panel to react to how the room had voted. There were, as van Woerden kept reminding everyone, no right answers, only consequences, each choice building or destroying trust.

The panel sat as the CleanCorp board. Andrea Cardoso of ICC Netherlands played the chair and chief executive, opening with the board’s job of enabling AI innovation while protecting integrity, reputation and long-term value. Ty Francis, a governance and AI ethics specialist who had come from New York and wrote a chapter in the ICC book Leading with Integrity in a Digital Age, was the dominant voice. Ivo van Nimwegen of Siemens brought the cybersecurity lens, Eileen Berntsson the governance, ISO and compliance-systems view, and Guido Febus, now in the food industry and on DCM’s advisory board, the crisis-management experience.

The dilemma that ran through the room

The scenario escalated around AI in hiring. First question: should HR be allowed to cut recruitment costs by deploying AI? The room split, many wanting the legal counsel to review obligations across every jurisdiction first, others willing to proceed subject to a data-privacy impact assessment and testing of the training data.

Then the twist. Three female candidates had been rejected because of biased training data. What should the board do? The options were pointed: three people is not material, human judgment is biased too, or ban AI in recruitment altogether. This is where Francis set out the framing that became the session’s backbone, three questions in order: “can we, should we, and will we?” Can we is usually yes, it is within the mandate. Should we is the real question, and it depends on whether anyone actually assessed the risk. His argument against the comforting “only three people” vote was sharp. One wrongly excluded candidate is already a breach of the code of conduct and of basic rights, and because a model applies the same logic every time, three is very likely the visible edge of something systemic across thousands of applicants. And machine decisions leave a ledger. A one-off human bias is usually subconscious and defensible; a biased system that you deployed knowingly is “you knew it was biased and let it happen.”

The other panellists stayed in character. Van Nimwegen, from the security seat, wanted to stick to the board’s job: can we protect the confidentiality and integrity of the data, set clear guardrails, and then let it be a business decision. Berntsson put the ethics case most memorably: “I would not board a plane if there are no pilots.” AI should support human decisions, not replace them.

When it goes public

The next turns tested the response. Social media erupts with accusations that HR has abused AI. The room reached for the sensible verbs: investigate, verify, be transparent, stand up a crisis team. The panel gently complicated each one. Febus warned against reflex escalation, since a crisis team is for genuine exceptions, and the first duty is to do the risk assessment properly before deployment rather than scramble afterwards. Francis urged sticking to known facts and legal obligations, stopping any implicated system, and being clear who owns the response, and borrowed a line from Simon Sinek: “transparency is not always about telling everything, it’s about context.” Berntsson tied it to a stakeholder-based communication plan with anonymous reporting and no fear of retaliation.

Then the labour inspector opens an investigation, and every respondent voted to convene a crisis team chaired by the legal counsel. The panel pushed back on their own audience. Are we even there yet? Get the facts first, said van Nimwegen, through internal audit, and stop the use of the AI to contain the problem. Francis gave the image that stuck: “when you have a leak in a pipe, the first thing you do is switch off the water.” Stop the suspected source, then decide whether it is a crisis.

Shadow AI and the honest survey

A quieter but telling question turned to staff using ChatGPT, a shadow-AI problem, since the company sanctions Copilot but not ChatGPT. The risks the room named were the obvious and correct ones: data leaving the organisation’s control, confidentiality and security breaches. Van Nimwegen’s answer was to provide a secure internal alternative with guardrails and to teach people how to behave, rather than simply forbidding. Berntsson suggested something humbler and more useful: run an internal survey or AI-literacy check, because organisations are routinely shocked by how much unregulated personal AI use is already happening under their noses.

A closing stretch on the annual management review drew a clear consensus against silos. Risks should be spotted where they are taken, escalated, and then consolidated so that individually minor risks in supply chain, HR and finance are seen together, with the board weighing business against compliance. Francis added the discipline most often missing: every leader should be able to say what they are actually trying to achieve with AI, because “many companies fail because they don’t know what they’re trying to achieve with it,” and fewer still measure whether the promised savings ever arrive.

The point of it all

Francis drew the threads together with a method rather than a slogan. Start from your existing risk assessments, map where AI touches each risk, and work out which risks are material, which differs by company, “the same way we looked at ESG.” His headline was that this is not a technology problem wearing a technology solution. “AI is not an IT issue. The governance side is a human issue.” He reached for Formula One: “we use amazing high-performance brakes, not to stop the car, just to allow us to go faster.” And he landed on accountability. Everyone needs a voice, but one named person has to be able to turn the machine off, fast. “If you can’t point to that person in five or ten seconds, that’s not governance, that’s wallpaper.”

Van Woerden closed on the paradox the whole exercise had been built to expose. “Nobody owns AI. Everyone owns AI.” The way out of that paradox is not another policy document. It is a shared framework, a named owner for every system, and a kill switch somebody can actually reach.

The Week of Integrity continues year-round, with a spotlight on International Anti-Corruption Day on 9 December.