On 4 November I was in conversation with Claire Stapleton at a joint session of the BCS ICT Ethics Specialist Group and the BCS IT Leaders Forum. Claire was one of the organisers of the 2018 Google Walkout. On 1 November that year around 20,000 Google employees and contractors in some 50 cities walked out, by the organisers' count, over how the company had handled sexual harassment claims, after reports of a $90 million exit package for Android creator Andy Rubin. Her memoir, Don't Be Evil: Bad Bosses, Fake Promises, and My Escape from Big Tech, came out this year.

Within a week, Google ended forced arbitration for individual sexual harassment and assault claims. It took 20,000 people leaving their desks to get there. In April 2019, Claire and fellow organiser Meredith Whittaker said they had faced retaliation for organising. Google said it does not tolerate retaliation. Claire announced her departure that June.

I've worked with dozens of organisations of every size, and one pattern holds. The more effort an organisation puts into talking about and publishing its ethics and values, the less likely it is to live by them. Google's motto was "Don't be evil".

Why this matters more with AI

Every AI governance framework I've read has a human in it somewhere. The EU AI Act puts that human into law. Article 14 requires high-risk systems to be designed so the people overseeing them can understand them, spot when they're going wrong, override them and stop them. Article 26 requires the organisations using those systems to hand that job to people with the competence, training and authority to do it. Those duties now apply from December 2027 for standalone high-risk systems, after this year's delay. The design is settled.

Read that again as a description of a person, not a process. Someone has to notice the output is wrong, say so, and act on it, often against a deadline, a target, or a manager who has already signed off the rollout. An override is a small act of speaking up. Article 14 assumes people will do it.

Most won't unless the organisation has made it safe. When I look at oversight, the question that tells me most is a simple one. Has anyone ever used the override, and what happened to them when they did? If the honest answer is "they got a reputation for being difficult", the override is decoration.

Agents make this harder. When a person drafts a letter with AI help, a person still reads it before it goes out. When an agent runs a chain of tasks on its own, the checkpoints thin out. Fewer people see the work. The ones who do are often junior, or a long way from the decision. And the reasons to stay quiet are the old ones: you might be wrong, the system is probably right, and nobody likes the person who slows things down.

Courage is a symptom

I want courage in the people who oversee AI. I don't want to depend on it.

In CHART, the framework I wrote for assessing the human layer of AI governance, the top level of accountability is one where it is "embedded in organisational design, not dependent on individual courage", and where incentives, reporting lines and escalation paths make accountability the path of least resistance. If speaking up still takes bravery, the system isn't finished.

That's what I took from the Walkout. It took 20,000 people to make one company change one policy. A well-run organisation should need one person and one email.

What the law already says

Reporting a breach of AI law is already protected in more places than people realise. Article 87 of the EU AI Act applies the EU Whistleblower Directive (2019/1937) to reports of breaches of the Act. In the UK, the Public Interest Disclosure Act 1998 protects workers who report specified kinds of wrongdoing, such as a breach of a legal obligation, where they reasonably believe the disclosure is in the public interest. In June 2024, current and former staff of OpenAI and Google DeepMind published "A Right to Warn about Advanced Artificial Intelligence", asking AI companies not to retaliate against employees who raise risk-related concerns.

Both regimes cover breaches of the law. A worry that an agent is simply making bad decisions is not automatically covered. Legal protection is a floor, not a culture. Being protected on paper has never stopped a career quietly stalling.

Three questions for your next board meeting

  • When did someone last override or stop an AI system here, and what happened to them afterwards?
  • If a junior analyst thought an agent was making bad decisions, who would they tell, and would they bother?
  • Does our ethics statement describe what we do, or what we would like people to think we do?

Sources

Julie Hendry FBCS is Treasurer of the BCS ICT Ethics Specialist Group and the author of CHART, an openly published framework for assessing the human layer of AI governance.

← Back to Writing