AI Outputs Now Bind Boards Personally Through Provenance Gaps

AI model outputs now count as institutional knowledge assets. When those assets rest on poisoned, biased or unlawfully sourced training data, boards face direct duty-of-care exposure, not just operational headache. Bessemer Venture Partners operating advisor George DeCesare lays out why traditional cybersecurity ownership no longer covers the risk and why chain of custody has become the practical fix.

Most CEOs still answer the AI-risk question the old way: legal does compliance, IT runs systems, the CISO owns security. That split worked for stored data. It fails when systems absorb statistical patterns into parameters that later drive diagnoses, credit decisions or financial disclosures.

Once those patterns sit inside a live model, the organization is no longer defending a file. It is defending the decisions the file has become. That is why ownership has to move upward from a single technical function to the full leadership stack.

Traditional Cybersecurity Misses Unauthorized Influence

Cyber defenses target theft, alteration or denial of access. Encryption, access controls and perimeter logging handle those threats well enough for databases. AI training changes the threat. Corrupted inputs shape model behavior without ever looking like a breach. The influence hides inside millions of weights. Retraining is the only full reset, and even then the original problem may be hard to isolate.

DeCesare puts the shift cleanly: the question is no longer who accessed the data. It is where the data came from, who handled it, how it was transformed, and whether that path can be proven clean. That set of questions sits with the board and management, not the security team alone.

• Old model: protect confidentiality, integrity and availability of stored records.
• AI model: protect against unauthorized influence through data poisoning, statistical corruption or pipeline compromise.
• Result: provenance controls matter more than perimeter ones once the model is live.

Healthcare, credit and fraud systems already run on these outputs. Boards that treat the results as black-box technical artifacts are treating institutional decisions as someone else’s problem.

Perimeter tools still matter for the systems that hold the raw inputs. They do not record how those inputs were chosen, cleaned or combined before training. Without that earlier record, a clean security log can sit beside a model whose behavior no one can fully explain to a regulator or a court.

The SCC Triad Complements CIA

Confidentiality, Integrity and Availability remain necessary. They are no longer enough. DeCesare and the AI Overwatch Group framework add Sensitivity, Criticality and Compliance.

Sensitivity asks how damaging misuse would be to people, customers or intellectual property. Criticality measures how heavily the data can swing high-stakes decisions such as clinical or financial ones. Compliance maps legal, contractual and licensing limits on collection, retention and training use.

Boards should require management to classify every dataset against these three dimensions before it enters a training pipeline, retrieval system or production agent. The classification decides the depth of controls that follow.

A low-sensitivity internal log and a high-criticality clinical corpus cannot share the same default pipeline rules. SCC scoring forces that distinction before the first training run, not after an unexpected output appears in production.

Six Principles That Make Chain of Custody Work

Chain of custody started in forensics: every transfer of physical evidence is logged so a court can trust it. For AI the same unbroken record must exist before training starts. After the model internalizes the data, reverse engineering lineage becomes exponentially harder.

These six create an evidentiary standard a litigator would accept for any other institutional record. Without them most organizations cannot answer the basic question: can we prove the data was lawfully acquired, properly handled and unaltered in ways that changed behavior?

AI risk is no longer just about model accuracy-it’s about whether an organization can prove the integrity and lineage of the data and decisions. Without a verifiable chain of custody, AI becomes a source of regulatory and legal exposure rather than competitive advantage.

George DeCesare, Operating Advisor, Bessemer Venture Partners / AI Overwatch Group

Each principle closes a different gap. Origin and possession answer who brought the data in. Tamper evidence and integrity verification answer whether it changed. Access logs and preservation answer who touched it later and whether the story can still be retold under scrutiny.

Regulators Already Expect Proof of Origin

The EU AI Act Article 10 requires high-risk systems to apply data governance practices that cover data collection processes and the origin of data, plus preparation steps, bias examination and suitability assessment. High-risk obligations were set to apply from 2 August 2026, though Omnibus adjustments have introduced some flexibility. GPAI models already face training-content summary duties.

In the United States the FTC has moved on accuracy and deception concerns with a FTC proposed policy statement on AI accuracy opened for comment in July 2026. SEC scrutiny of AI-related disclosures continues, and HHS frameworks treat ePHI used in training as fully in scope. The voluntary NIST AI Risk Management Framework is being updated under the White House AI Action Plan and already stresses provenance, third-party risk and generative-AI specifics.

1. March: AI Overwatch white paper sets the grounding for the later board framework.
2. July 2026: FTC opens public comment on its proposed policy statement on AI accuracy.
3. 2 August 2026: EU AI Act high-risk data-governance obligations were set to apply, with Omnibus flexibility noted.
4. August 2026: DeCesare’s framework is released through Bessemer’s Atlas.

Seventy-two percent of S&P 500 companies disclosed material AI risk in recent filings. Litigation over training-data privacy and copyright keeps rising. The window for voluntary build-out is the time before enforcement sets the floor.

None of these regimes asks only whether a model scored well on a benchmark. They ask whether the organization can show where the training material came from and how it was handled. That is the same proof chain of custody is built to supply.

Seven Actions Boards Can Demand Immediately

DeCesare’s checklist turns the abstract duty into concrete oversight questions.

1. Designate an accountable AI lead with explicit authority over provenance standards, model lifecycle and direct board reporting. The CTO as a side duty is not enough.
2. Require a data provenance audit on every system already influencing decisions. “We don’t know” becomes a risk disclosure.
3. Validate acceptable-use policies that name permitted data, who can start training runs, external sources and how outputs may enter decisions. Board review is mandatory for them to count as governance.
4. Verify cybersecurity has adapted beyond perimeter threats to data poisoning, unauthorized training, model manipulation, agentic identities and adversarial inputs.
5. Schedule independent audits that trace data from origin through output and confirm policies were followed, not merely written.
6. Approve a formal AI ethics framework covering bias, fairness, discrimination and workforce impact as governance obligations.
7. Write chain-of-custody requirements into vendor contracts for any external data, model or AI service, including disclosure of dataset changes.

Inside step 4 sit ten sharp questions every CEO should put to the CISO: origin of every dataset, which systems hit regulated decisions, proof against poisoning, third-party contractual assurances, full reproducibility, SCC classification beyond confidentiality, controls on unauthorized training, ability to prove a decision to a regulator tomorrow, named executive owner, and the single greatest residual risk.

Taken together, the seven actions move provenance from a slide deck into recurring board work. The named lead, the audit, the contract language and the ethics framework each create a paper trail that later answers the ten CISO questions without a scramble.

Who Absorbs the Second-Order Cost

When an AI decision goes wrong and lineage cannot be shown, the hit is not only a fine or a customer lawsuit. Directors’ duty of care and duty of loyalty can be implicated because the outputs function as institutional knowledge. Management still implements the technical controls. Only the board sets the standard and holds the organization to it. Accountability cannot be delegated downward.

Vendors and data brokers become hidden stakeholders too. Contracts that once stopped at SLAs now need provenance documentation and change disclosure. Firms that cannot supply it lose procurement deals. Early movers turn trustworthy AI into a differentiator while competitors scramble under deadline pressure.

Crowd conversation on X and recent surveys underline the gap: many organizations still lack visibility into where data is processed or trained, ownership is fragmented across legal, security and business units, and boards often stay stuck asking technical questions instead of accountability ones. Single named owners with real authority close the seam where failures hide.

The same logic extends to newer deployments. Systems that put on-device agentic models running free still require documented data paths and behavior controls. Enterprise platforms under leaders such as the one driving Scale AI’s enterprise push under new leadership will face buyer questions about lineage as standard diligence.

• Board: sets the standard and cannot push duty of care downward.
• Management: implements technical controls and reports against them.
• Vendors and brokers: must now deliver provenance docs and change disclosure or lose deals.

Provenance Proof Travels Into Every Contract

Once outputs count as institutional knowledge, every external feed into the pipeline becomes a fiduciary concern. A vendor that cannot document origin, possession and change history leaves a hole the board still owns. That is why chain-of-custody language belongs in the contract, not in a side letter the business unit never reads.

The six principles give procurement a fixed checklist. Identifiable origin and documented possession can be demanded up front. Tamper evidence, integrity verification and access logs can be tested in diligence. Preservation terms decide whether a dispute years later still has a reconstructable record.

Firms that already run this checklist win twice. They clear buyer and insurer questions faster, and they avoid last-minute rewrites when a regulator or counterparty asks how a specific high-stakes output was formed.

Fragmented Ownership Hides the Weakest Link

Legal, security and business units each hold a piece of the AI stack. None of them holds the whole path from collection to decision unless the board forces a single accountable lead. Fragmentation is how “we don’t know” survives inside organizations that believe they already govern AI.

The ten CISO questions expose that seam in one sitting. If origin, poisoning proof, SCC classification and named ownership cannot be answered cleanly, the gap is structural. A provenance audit on systems already influencing decisions turns that gap into a disclosed risk instead of a surprise.

On-device agentic models and large enterprise platforms do not escape the pattern. Free-running agents and third-party training services still need documented data paths. Buyer diligence is already moving toward lineage as a standard gate, not a specialty request.

Builders Gain the Quiet Filter

Trust is no longer inferred from brand or model size. It must be proven through an unbroken record linking data, models and decisions. Companies that install the six principles and seven actions now will meet regulator and customer expectations with evidence already in hand. Those that wait will discover that “we used a reputable foundation model” is not a defense when the question is how a specific high-stakes output was formed.

The market filter is already forming. Procurement checklists, insurance underwriting and investor diligence are starting to ask the provenance questions. Boards that treat AI governance as a compliance checkbox arrive late to a standard their peers set. The ones that treat it as fiduciary infrastructure protect both the enterprise and themselves.

DeCesare’s framework, released through Bessemer’s Atlas in August 2026 and grounded in the March AI Overwatch white paper, gives directors a ready agenda for the next meeting. The tools exist. The regulatory clock is running. The second-order choice is whether the organization can still prove what its intelligence is made of when someone asks.