Artificial intelligence can extract facts, compare documents, summarize exceptions, and draft recommendations at high speed. That changes the pace of review while leaving the underlying institutional question unchanged: what does the output mean, what supports it, and can another institution reasonably rely on it?
NIST treats validity and reliability, accountability and transparency, and explainability and interpretability as distinct characteristics of trustworthy AI. That distinction points to a practical question: what must sit between a machine-produced answer and a consequential institutional decision?
A board may approve a plan. A lender may underwrite a facility. An insurer may price a policy. A buyer may decide what diligence, protection, or integration work is required. In each case, the decision depends on more than the sentence on the screen. It depends on the record behind it.
The market has moved further toward this problem. McKinsey's August 2026 global survey found that nearly nine in ten respondents reported regular AI use in at least one business function and 44% said AI was scaling across the enterprise, yet only 37% reported any positive EBIT contribution and about 6% met McKinsey's definition of AI high performers. Use, scale, and institutional value are therefore different questions.
When accurate outputs still leave an operating question open
Operating records are created for different purposes. The useful question is rarely whether every system contains the same answer. It is whether the records, taken together, support the assertion another institution is being asked to rely upon.
| Example | What the records may say | Questions that remain |
|---|---|---|
| Entity and reporting | A legal register shows a subsidiary as active; a consolidation file treats it as dormant; payroll shows people working in the jurisdiction. | Do the records cover the same date and operating perimeter? What activity is actually occurring? Which specialists need to assess legal, tax, or reporting consequences? |
| Vendor and contract | Procurement lists a vendor as approved; accounts payable shows spend through an affiliate; the contract repository shows an expired agreement; access records remain active. | Which entity is buying the service? What contract is in force? Who has access to systems or data? Who owns continuity and remediation? |
| Workforce and access | Payroll counts people paid during a period; HR counts active employees on a date; identity systems count enabled users. | Are the populations comparable? Which worker types, dates, entities, or non-employee accounts explain the difference? Does any control issue remain after the populations are reconciled? |
Six questions a decision-grade record should answer
- Are the records actually comparable in population, entity, period, obligation, and purpose?
- What does each source legitimately support for the assertion being made?
- What has management explained, confirmed, disputed, or left unresolved?
- What uncertainty remains after the relevant specialists have advised within their scopes?
- Who owns the next decision or action, and what evidence would support closure?
- Could a later reviewer reconstruct the evidence, explanation, assessment, decision, and action without restarting the investigation?
Where the operating layer fits
A practical operating model separates roles rather than collapsing them. AI and reporting tools can accelerate observation and comparison. Management explains factual context and operating intent. Legal, tax, accounting, cyber, HR, benefits, audit, and other specialists advise within their scopes. GGI uses ERI to establish an evidence-backed operating baseline, surface gaps and evidence questions, and preserve a governed record while GGI applies independent operating judgment and coordinates material remediation.
The objective is a judgment chain clear enough that another institution can understand what it is relying upon, how the conclusion was reached, and where uncertainty remains.
That question becomes more consequential as software agents move from producing analysis to acting through tools and enterprise systems. NIST's 2026 agent work highlights identity and authorization as first-order controls when software agents are given access to data, tools, and applications. The institutional record must therefore distinguish what a system observed or recommended from what it was authorized to do and what action actually occurred.
Questions to ask before institutional reliance
- What evidence supports the assertion?
- What evidence qualifies or conflicts with it?
- Are the underlying records comparable?
- What explanation has management provided?
- What have the relevant specialists concluded?
- What remains uncertain?
- Who owns the next step?
- Can the full judgment chain be reconstructed later?
- If an automated system can change a record, initiate a transaction, or execute a workflow, what authority, approval, and execution evidence applies?
Conclusion
AI will keep improving extraction, comparison, drafting, and analysis. The harder institutional question remains whether a conclusion is sufficiently supported for action.
A cited answer is useful. A defensible decision requires comparable evidence, clear source roles, accountable explanation, independent assessment, ownership, and a persistent record of what happened next.
Sources
[1] NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0), 2023 - https://www.nist.gov/itl/ai-risk-management-framework - Referenced for the distinct characteristics of trustworthy AI, including validity and reliability, accountability and transparency, and explainability and interpretability.
[2] NIST, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, 2024 - https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-generative-artificial-intelligence - Cross-sectoral companion profile for managing generative-AI risks.
[3] McKinsey & Company, The state of AI in 2026: On the road to ROI, 25 August 2026 - https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai - Market context distinguishing use, enterprise scale, and reported financial impact.
[4] NIST, AI Agent Standards Initiative, 17 February 2026 - https://www.nist.gov/news-events/news/2026/02/announcing-ai-agent-standards-initiative-interoperable-and-secure - Agent interoperability and security context.
[5] NIST NCCoE, Identity and Authority of Software Agents, 5 February 2026 - https://www.nist.gov/news-events/news/2026/02/new-concept-paper-identity-and-authority-software-agents - Agent identity and authorization context.
What does your institution rely upon?
Compare notes on a live financing, integration, succession, audit, board, or exit-readiness issue—or discuss an Operational Readiness Baseline.
Request a Baseline Discussion →