When oversight is tested, a policy is not evidence. A decision you can reconstruct is.
A board approves an AI deployment, or more often never sees it, and the system runs. Then a decision it made is challenged. A customer or a member disputes an outcome. A regulator asks what happened. A complaint escalates, or a claim is filed. The question that lands on the board is not whether it had a policy. It is what the board can show about how that specific decision was made, on what basis, and under whose authority. Most boards, asked that question, cannot answer it from anything they hold.
For a long time, board oversight of a system meant approving a framework and receiving assurances that it was working. That was enough when the systems in question were slow and human-paced. An autonomous system is neither. It makes decisions continuously, at a scale no board reviews case by case, and the board remains answerable for the outcomes. Oversight of that cannot mean having approved a policy. It has to mean being able to show, when a decision is challenged, what the system actually did and who was accountable for it.
Oversight now reaches past the policy into the decision
Directors are increasingly expected to oversee not just whether a governance framework exists, but whether the systems the organisation deploys behave as the framework says. When an AI decision is challenged, the questions run along a chain: was the system designed and approved for this use, was it deployed within those bounds, how did it operate in the specific instance, and what was the outcome. A board can usually speak to the first link, the approval. It is the deployment, the operation and the outcome, the links where the system was actually acting, where most boards have nothing to show. Those are the links a challenge tests.
What a board should be able to show
Decision provenance is a record of what an autonomous system did, on what basis, under whose authority, and how each item was captured, kept so it can be reconstructed later. For a board, it is what turns “we had oversight” into something that can be shown rather than asserted.
A board evidence record does not have to grade the decision. It has to make the decision legible: what the system did, which authority it acted under, what evidence existed at the time, and how each of those facts is known. Because the record shows how each fact is known, whether it came from the infrastructure that ran the decision, was captured close to the event, was reconstructed, or was stated by a person, an inquiry can weigh it rather than take the board’s word. That is exactly what oversight, tested after the fact, requires.
Custara prepares, structures and preserves that record. It does not assess whether the board’s oversight was adequate, and it does not decide what the record means for the board’s position. Those are questions for the inquiry, the board’s counsel, and where relevant an independent assessor. Custara’s job is to make sure that when the board is asked, there is a record to answer from.
Reconstruction cannot be built after the outcome
The reason this has to be in place before a decision is challenged is plain. After an adverse outcome, reconstruction is contested, and the party doing it has an interest in how it comes out. A record assembled under those conditions, from logs that were never designed to answer the question, is weak precisely when it needs to be strong. A provenance record captured as the system operated, and kept current, is the one that holds up when the outcome is bad and the pen is in an interested hand.
Oversight rests on a record prepared in a consistent structure
A board is not meant to certify its own AI, any more than it audits its own accounts. Oversight rests on a record prepared in a consistent structure the board did not set, that an independent party can review. A standard can define what the record should contain and how evidence quality is described, which is the work of the Decision Standards Institute, and an independent assessor can review the record separately, which is the role of Attestra. Custara prepares the record. It does not assess it, and it does not certify the board’s governance. That separation is what lets a board’s oversight rest on evidence rather than on its own say-so.
The board that can show what a challenged decision did, on what basis and under whose authority, is doing oversight. The board that can only point to a policy is describing it. As autonomous systems take on decisions boards remain answerable for, that difference is where directors’ accountability is heading.
See how one record supports board and reviewer oversight in the worked examples, or read how Custara works with regulated enterprise.
The framework behind this approach, and the book that sets it out, are forthcoming. This article is general information, not legal advice. Directors and trustees should seek their own advice on their duties.