The Responsibility–Control Gap in AI: Organizational Governance and the Reconfiguration of Control through Sovereign AI

Sammanfattning

Organizations are increasingly held formally responsible for AI-driven decisions while controlover the systems producing those decisions is distributed across external data, models, andinfrastructure they do not own or fully influence. This study examines how this structuraltension, referred to as the responsibility-control gap, is constructed in practice, and howSovereign AI initiatives reconfigure the conditions under which responsibility can be exercised.Drawing on ten semi-structured interviews with senior professionals across defence,telecommunications, transportation, manufacturing, and AI consultancy sectors in Sweden, thestudy finds that responsibility for AI-driven outputs is attributed to individual users across allcases examined, yet the practical capacity to act on that responsibility remains limited. Acrossthree dimensions of organizational control, decision-making authority, resource access, andcapacity to intervene, formal responsibility consistently exceeds the practical capacity to act onit. Internal governance limitations, including shadow IT, weak data governance, and theleadership-capability gap, constitute a second structural layer of the gap that operatesindependently of external infrastructure dependency.Sovereign AI initiatives meaningfully reduce the external layer by expanding organizationalcontrol over data, infrastructure, and model configuration, but do not address the internal layer.The study further shows that Sovereign AI is most productively understood not as a binarycondition but as a deliberate risk positioning decision. Governance maturity is identified as astructural requirement that must be in place before sovereignty initiatives can reduce rather thanmerely relocate the gap. The study contributes an analytical framework for diagnosing wherecontrol is practically absent, and introduces a distinction between operational and epistemicresource access that has not been theorized in existing frameworks.