Gary Cheung · Point of View
Govern the decision—not only the system.
AI governance becomes consequential when AI changes a business decision. Controls and model oversight matter. They are not enough if ownership, authority, and the basis for judgment remain unclear when outcomes affect customers or the business.
My focus is the connection between information risk and executive judgment: what AI changes, which exposures follow, and who can act before those exposures become embedded.
The central question
Who owns the outcome—and who can stop the process?
When AI influences a consequential business decision, who remains accountable for the outcome? Who has the authority, information, and practical ability to challenge, pause, or stop the process?
A named reviewer is not the same as effective oversight. Accountability needs to survive the handoffs between business owners, technology teams, vendors, and risk functions.
Three governing principles
The principles behind my writing.
01 · Accountability
Accountability before automation
Make outcome ownership and decision authority explicit before AI becomes embedded in a workflow.
Shared delivery does not remove the need for a business owner who can accept the exposure, resolve disagreement, and answer for the consequences.
02 · Governance timing
Governance while choices remain open
Engage while objectives, data flows, thresholds, and intervention rights can still be shaped.
Late review may identify a weakness without leaving a realistic way to change it. Governance timing is therefore a risk decision, not simply a project milestone.
03 · Executive judgment
Evidence for judgment—not reassurance
Use evidence to expose uncertainty and trade-offs, rather than merely confirming that an approval process was followed.
Leaders need to know what has been tested, what remains uncertain, and what would trigger reconsideration.
My decision lens
Start with the business decision.
I examine an AI development through four connected questions. The technology is the context; the consequences for decision-making are the point.
01 · Decision
What changes?
Identify the outcome, the role AI plays, and the point at which its output influences an action.
02 · Exposure
What is at risk?
Examine the exposure created, transferred, or amplified—and who would bear the consequence.
03 · Authority
Who can act?
Trace outcome ownership, challenge rights, escalation, and the ability to intervene in practice.
04 · Evidence
What supports judgment?
Define the evidence for approval and the signals that would justify pausing or reconsidering use.
Regulated organizations
Model performance is only part of the decision.
Illustrative decision contexts in financial services include AI-influenced credit assessments, claims handling, fraud investigation, customer treatment, and operational priorities.
My view is that technical performance must be read alongside the business consequence. A system can produce useful outputs while the surrounding workflow leaves a customer unable to challenge an outcome, or an accountable owner unable to explain why an action was taken.
The leadership task is to make the intended use, acceptable exposure, evidence, and intervention conditions explicit. Those conditions should be revisited when the model, data, vendor service, or business workflow changes.
Selected writing
Three essays that develop this point of view.
Decision accountability
The AI Governance Question Regulators Are Forcing — And Most Leaders Can’t Answer
Why models and controls still leave a fundamental question about decision ownership.
Design-phase governance
AI Governance Is Failing at the Design Phase — Not the Review Phase
What happens when oversight begins after the architecture and operating assumptions are set.
Authority and oversight
From Guardrails to Governance: What Actually Changes When Organizations Get Serious About AI Risk
The shift from constraining system behavior to establishing authority and accountability.
The perspective behind Beyond1n0
An information risk lens, grounded in practice.
I’m Gary Cheung, an information risk leader with a background in financial services, technology risk, and application security. That experience shapes how I examine the gap between identifying a risk and giving the right person a clear basis—and the authority—to act.
Beyond1n0 is my independent professional home for risk-led thinking on AI governance and information risk. I use developments in AI as a starting point for original analysis of the business decisions they change.
I distinguish sourced facts, illustrative scenarios, and my own editorial judgment. The perspectives shared here are my own.
Put the point of view to work
Have an AI decision to work through?
Begin with the decision, the accountable owner, and the conditions under which the process should be challenged. The AI Governance Decision Review provides a starting point for that conversation.
