Philosophers call it control and responsibility. IT teams call it access rights and audit logs. In the end, both are pondering the same thing: whoever, or whatever, is acting. Could it have gone another way, and did anyone know what would happen?
On November 4, Frends invited Filippos Stamatiou, a postdoc at the Centre for Philosophy of AI, to take on the question underneath both vocabularies: what does real control over AI require?
The occasion was Talkflows Copenhagen, a morning event at Nimb Rotunda for IT teams in the public sector and regulated industries, built around EU sovereignty and AI — themes that run through most conversations in IT right now. The agenda asked what it means to have real control over your data and your AI tooling, and how to put AI to work without losing that control.
In a fireside chat led by Ravish Gopal, solutions & advisory director at Software Improvement Group, Filippos said that regulatory control “creates this kind of paper trail, processes and some sort of accountability, which is extremely important and necessary.”
He also named what it leaves out. Regulation, he said, doesn’t tell us “whether companies or the public sector have placed humans in the right positions to be able to exercise control.” He called the EU AI Act the best example of AI regulation, while at the same time acknowledging it as incomplete and problematic. A paper trail can show who did what. It cannot show whether that person had another option, he explained.
In plain terms, Filippos said, control in the sense that he studies it means you could have done something different. “If you only have one path ahead of you, that’s usually not what we understand by control.” While we tend to think of control as a kind of power, Filippos says it is about having options.
He separated legal responsibility from moral responsibility using a coffee cup as example: “if you throw a cup of coffee at me, I’m not going to sue you, right?” You would still be blamed. Regulation covers the legal part. Organizations and the individuals inside them carry the moral part themselves.
Sovereignty usually gets described through ownership: who owns the data, who owns the models. Filippos likes to widen the picture. “Ownership, when you can’t actually do otherwise, it can be a kind of dependency as well, right?”
A question from the audience made this concrete. A public sector attendee described a position many teams share: American technology is ruled out for their data, so a European AI alternative looks like the answer. Is that really sovereignty, they asked, if there is only one?
The philosopher shared an example of taking matters into their own hands when it comes to finding another option, gaining back control. In New Zealand, a community called Te Hiku found that no language model spoke Māori well enough. "So, hey basically built their own LLM from scratch.”
He pointed to communities like this as a route that has barely been tried, one where the people who use a technology “actually have some say and some meaningful control in how the technology is built and what it does.”
Filippos does not expect AI models to carry the moral load. “We don’t need to expect models to take more responsibility or exercise control, or become moral. We need to do it ourselves. We only have ourselves. No one is going to come and save us,” he said.
He pushed the same logic into other topics. Public sector teams often hear that a model is a black box, as if that ends the discussion. “The black boxes are also not spontaneously generated, aren't they?”
There's also a choice in utilizing them or not. He asked the public sector to take an active role in finding the points between design and deployment where someone could have decided the other way, and to know who to talk to when it wants that decision to go differently.
The practical side came in the second session of the morning, when RK Prabhu, solution architect at Frends, walked through putting AI to work in integration with Frends MCP as the example. Governance works the same way for a person and a model, he said: “this doesn’t change if it’s an AI doing something, or if a person is doing something.” Every version that gets built should be tracked, and anything that runs should be monitored, with logs for each step.
Where an AI does analysis inside a Process, the Process can pause and hand the decision to a person for approval before it continues, no matter how long this might take. Version history and logs are the paper trail. The approval step is the choice. RK also described bringing your own models into the platform, and working with different AI systems at the same time, including their own, instead of sticking to one platform, which speaks to the attendee’s question.
For teams not yet using AI, RK’s advice was simple: “start with the fundamentals, don’t just jump into the AI train.” Nobody has to match the pace of the rest of the market.
Before the next AI project goes live, check two things. The first is accountability: can you see who did what, and could the person approving the work say no? The second is sovereignty: can you rely on it? A team that can answer both has accountability and sovereignty that hold up under pressure.