Moving from voluntary AI principles to mandatory duty-holder oversight

John Morrison argues that the AI industry currently mirrors the early stages of corporate social responsibility, where firms rely on vague, voluntary codes rather than core business accountability (John Morrison from SOS). The business and human rights sector spent decades refining these principles before John Ruggie’s 2011 UN Guiding Principles insisted on mandatory due diligence and remedy. Companies now face similar pressure to shift from AI-washing to establishing named duty-holders and traceable standards, as the issue on Saturday showed.

Treating AI deployment as a social licence issue, similar to mining or heavy industry, allows firms to anticipate community opposition and avoid the high costs of project delays (John Morrison from SOS). Data centre operators currently follow the extractives playbook, often ignoring the local impact of electricity and water use until community consent becomes a ballot-box matter. Instead of relying on point-in-time inspections, firms should examine the entire value chain, including data labellers and cobalt miners, to address systemic risks before they harden into permanent infrastructure.

Building contestability into systems before an incident occurs—through clear explanations, human review, and routes to appeal—prevents the structural discrimination seen in the British Post Office Horizon scandal. Regulators are increasingly treating AI-washing as a financial violation, with the US Securities and Exchange Commission already fining firms for overstating their AI usage. Organizations that incorporate these audit-ready disclosures and remedy mechanisms now avoid the expensive retrofitting required when governance trails deployment.