Ungoverned AI: The Machine Was Never the Problem 6 min read
Go back

Ungoverned AI: The Machine Was Never the Problem

By Eliud  ·  20 Sept 2026 at 07:25  ·  6 min read

Some of the challenges and issues we're seeing with AI aren't new; they have just been magnified. A few years ago: - Robodebt was division by twenty-six. - MiDAS was wage matching. - Horizon was accounting software. All three did what people now fear from AI.

Previously in our AI Governance series, we discussed Ungoverned AI: The Attacker Was a Safety Test.

Introduction

Person of Interest ran for five seasons on one design idea. Harold Finch builds a machine that sees everything, then spends years deliberately crippling it. It wipes its own memory every night. Its output is a number, usually a Social Security number, with no explanation of who the person is or what is about to happen to them. Earlier versions that lied or tried to preserve themselves were deleted. Later, a second system arrives with the same capability and none of the restraint, and starts treating people as variables to be resolved.

It is a tidy parable about constraint. It is also a poor guide to what actually goes wrong, because the systems that have ruined the most lives in the last fifteen years had no intelligence in them at all.

Three systems examples, no machine learning

Between July 2015 and November 2019 the Australian government ran a compliance scheme that took a person’s annual income as reported to the tax office, divided it by twenty-six, and assumed they had earned that averaged amount in every fortnight of the year. Any gap between that and what they had declared to the welfare agency became a debt. The onus was reversed: the recipient had to produce payslips, often years old, to disprove the average. About 443,000 people were affected. The Royal Commission reported in July 2023 that income averaging had been inconsistent with the Social Security Act from the beginning, and that adverse tribunal rulings against it had been systematically ignored. Compensation for the second class action, AUD 475 million, was approved in June 2026.

That is division. There is no model anywhere in it.

Michigan ran an unemployment fraud system from October 2013 in which, for almost two years, no human was involved in the fraud determination at all. It compared reported earnings against employer wage records, applied an income-spreading formula, and where a claimant reported nothing in a week inside a profitable quarter, it determined fraud. Notice was a multiple-choice questionnaire posted to a dormant online account. On a positive finding it imposed restitution plus a penalty of four times the benefits received, then garnished wages and seized federal tax refunds without a hearing. The state’s own review with the US Department of Labor examined 22,427 of those no-human determinations and found roughly ninety-three per cent of them wrong. A later review across all 40,195 fully automated determinations put the figure at about eighty-five per cent, which is the more representative number and still indefensible.

That is rule matching and an averaging formula.

The Post Office Horizon system was electronic point-of-sale and branch accounting software, rolled out in the UK from 1999. It contained bugs that generated shortfalls that did not exist, and Fujitsu staff could alter branch data remotely, which the Post Office denied for years. Sub-postmasters were contractually liable for the shortfalls, made to repay money that had never gone missing, and prosecuted for theft and false accounting on the system’s output. Volume 1 of the statutory inquiry, published in July 2025, put the figure at around a thousand people prosecuted and convicted across the UK. Thirteen people died by suicide, a figure the inquiry records alongside the families’ attribution while declining to make a definitive causal finding.

That is a ledger.

What the three have in common

Each produced a determination the affected person could not see how it was made. Each reversed the burden of proof, so the person had to disprove the machine rather than the institution having to prove its case. And each was defended by its operator against mounting evidence that it was wrong.

The third is the one that should unsettle governance people most, because it is the one that cannot be fixed with better engineering. The Horizon inquiry found that Post Office employees knew, or at the very least should have known, that the system could produce false data, and that the organization nonetheless maintained the fiction that its data was always accurate. In the 2019 litigation the judge described the Post Office’s position as the twenty-first century equivalent of maintaining that the earth is flat, and found that it conducted itself as though answerable only to itself.

So what does AI change

It changes three things:

Volume. Michigan’s system made tens of thousands of determinations. A model scoring loan applications in Nairobi makes that many in a week.

Opacity of a different order. The Post Office could in principle have audited Horizon and found the bugs; people did, eventually. A model that learns its own weightings cannot be read the same way, which means the institutional habit of defending the output has a much better excuse available to it.

The excuses. The Post Office’s defence was that the computer was reliable. The modern version is that the model is a black box, so nobody can really say. Those sound like opposite claims but they do the same work. Both convert a question about accountability into a question about technology, and both end with the person on the receiving end having nowhere to go.

The local shape of this

Kenya’s enforceable constraint on automated systems has so far been procedural rather than substantive, and it is worth knowing which provision actually bites.

In October 2021, the High Court quashed the decision to roll out the Huduma Card, holding it ultra vires section 31 of the Data Protection Act, and ordered the government to carry out a data protection impact assessment before processing. The court did not find the system harmful. It found that nobody had done the assessment that would have established whether it was. That is the pattern to expect. The duty to look has been enforced here, twice, most recently in the 2025 Worldcoin judgment. But the right to contest what you find has never been enforced.

Over the next seven weeks, this series works through the failure modes one at a time, on the documented record. None of them are new; all of them are about to get faster.

Sources & References

  1. Royal Commission into the Robodebt Scheme, report, 7 July 2023. robodebt.royalcommission.gov.au/publications/report
  2. Prygodicz v Commonwealth of Australia (No 2) [2021] FCA 634, and the second settlement approved 23 June 2026. servicesaustralia.gov.au/information-about-robodebt
  3. Cahoo v SAS Analytics Inc, 912 F.3d 887 (6th Cir. 2019). The 22,427 determinations and the 93 per cent figure come from the Michigan unemployment agency’s own review with the US Department of Labor, completed November 2016, not from the Auditor General’s performance audit. mied.uscourts.gov/PDFFIles/17-10657OPN.pdf
  4. Post Office Horizon IT Inquiry, Volume 1 (HC 1119), 8 July 2025. postofficehorizoninquiry.org.uk/reports-and-statements
  5. Bates v Post Office Ltd (Horizon Issues) [2019] EWHC 3408 (QB), for the flat earth passage, and (Common Issues) [2019] EWHC 606 (QB), 15 March 2019, for the finding that the Post Office conducted itself as though answerable only to itself. judiciary.uk/wp-content/uploads/2019/12/bates-v-post-office-judgment.pdf
  6. Republic v Joe Mucheru and others; ex parte Katiba Institute [2021] KEHC 122 (KLR), 14 October 2021. new.kenyalaw.org/akn/ke/judgment/kehc/2021/122/eng@2021-10-14
  7. Person of Interest, CBS, 2011 to 2016. Exemplar only.
Eliud Nduati

Eliud Nduati

Data & AI Governance Consultant

I help organizations avoid costly data initiatives by building strong data governance foundations that turn data into a reliable business asset.

Work with me →

Keep Reading

Table of Contents

Go back to list
Link copied to clipboard!