I want to end this run of research pieces on the question I think every other one has been circling without quite landing on directly: when a brand drifts, whose job was it, specifically, to have caught it? Not "the company's," in the vague, diffuse sense that lets everyone and no one feel responsible at once. A name. A role. A specific person who could be asked, today, "did you check," and would know exactly what that question meant.
Why "the company" is never a real answer
Every case I've studied shares a structural feature I think deserves to be named plainly: in the moment before the drift became public, there was no individual whose job clearly included catching it. CNET's compound-interest errors sat uncorrected for months without anyone specifically tasked with sampling AI output against editorial standards. AdVon's undisclosed AI use ran across a portfolio of publisher clients without any single publisher's contract specifying who, exactly, was responsible for verifying the vendor's actual practices on an ongoing basis. Robodebt's legal risk was flagged internally, in writing, years before the scheme ended, and still nobody with clear authority to pause the program actually exercised it. In every one of these cases, "the company" bears the reputational and financial consequences. In none of them was there a specific person whose defined responsibility was to have prevented it.
This is, I think, the actual root failure underneath every version of Brand Drift I've studied, more fundamental than any single missing check or missing tool: accountability that's distributed so broadly it becomes nobody's job in particular is functionally the same as having no accountability at all.
What a real accountability structure borrows from enterprise risk management
I don't think brand governance needs to invent an entirely new accountability model from scratch, because a well-established one already exists in a different corner of corporate governance, and it maps onto this problem with very little modification needed. The Three Lines Model, formalized by the Institute of Internal Auditors, assigns risk responsibility across three distinct roles: a first line of operational management that owns and manages a risk day to day, a second line of risk and compliance functions that sets guardrails and independently challenges the first line's work, and a third line of internal audit that provides objective assurance to the board that the first two lines are actually functioning as intended, reporting independently rather than through management.
Applied to Brand Drift specifically, this gives a founder or leadership team an actual structure to assign, rather than a vague aspiration to "take AI governance seriously." A first line: whoever operates the AI tools day to day — the marketing team running the chatbot, the ops team managing the vendor relationship — owns the immediate responsibility for output quality. A second line: someone with real independence from that operational team, whose specific job includes periodically sampling output against the brand's stated standards and flagging drift before it compounds, the same role my own BIG Framework's Intelligent Human Oversight pillar is trying to describe in more brand-specific language. A third line: at a minimum, a leadership-level check-in, on a real schedule, that asks the second line whether the checks are actually happening, rather than assuming they are because a policy document once said they should.
Why the second line is the one almost everyone skips
Of the three, the first line almost always exists by default, because someone has to run the tool for it to run at all. The third line often exists in name, because most leadership teams hold some version of a quarterly review. The second line — the genuinely independent check, separate from whoever's incentivized to say everything's fine — is the one I find missing most consistently across every organization I've talked to, for a reason that's almost structural: the person best positioned to notice drift day to day is usually the same person operating the tool, who has the least organizational incentive to flag their own output as a problem, not out of dishonesty, but because nobody notices their own drift as easily as an outsider would.
What assigning this actually costs, versus what skipping it costs
I want to be concrete about the actual size of this ask, because I think part of why it gets skipped is an assumption that it requires a new hire or a significant budget line. It doesn't, for most organizations at the scale I typically work with. It requires taking someone who already has enough distance from day-to-day content production — a founder, a different department head, in some cases a trusted outside advisor — and giving them an explicit, calendared responsibility to sample output and compare it against a written standard, with the authority to escalate if something's off. That's a matter of clearly assigning an hour a month, not building a new department. Compare that cost to Robodebt's multi-billion-dollar settlement, or Sports Illustrated's executive turnover and reputational collapse, and the asymmetry should be uncomfortable enough to actually move a leadership team to act, rather than nod along and move on to the next agenda item.
Why this framing changes the conversation with a leadership team
I've found that naming the gap this specifically — as a missing second line, rather than as a vague call to "care more about AI governance" — changes the actual tenor of the conversation when I raise it with a founder or leadership team. "Care more" is an instruction nobody can act on directly, because it doesn't specify what caring more would actually look like on a Tuesday morning. "Assign a second-line role to someone with real independence from the operational team, and give them a calendared hour a month to run a specific check" is an instruction a leadership team can accept, reject, or modify in a single meeting, because it's concrete enough to actually be someone's job description rather than a value everyone's supposed to hold in the abstract. I think a meaningful share of the reason Brand Drift persists across so many organizations isn't that leadership doesn't care. It's that "care about this" was never translated into a role with a name attached, and abstractions don't show up for their scheduled check-ins.
What this looks like when the second-line person actually finds something
It's worth walking through what happens after the second line does its job correctly, because the structure only works if the finding actually goes somewhere. Say the designated second-line reviewer samples a month of AI-drafted customer communications and finds a pattern — a value that's stopped showing up, a tone that's flattened, a phrase that keeps appearing that nobody would have chosen deliberately. Under a real Three Lines structure, that finding doesn't stop at "huh, that's odd" and get quietly forgotten by the next meeting. It gets escalated, formally, to whoever holds the third-line responsibility — the leadership-level check-in — with enough specificity that a decision can actually get made: pause this specific process, retrain this specific team, revisit this specific vendor relationship. The structure's entire value lies in that escalation path existing and actually being used, not just in the initial sampling happening once and disappearing into a report nobody reads again.
Why I built this research to end here, rather than with another case
I've spent this entire series moving through case after case of what happens when this structure is missing — CNET, Sports Illustrated, Robodebt, Amazon's hiring tool, Levi's, a string of chatbots that said things nobody would have approved if anyone had been asked in advance. I think ending on the accountability question, rather than one more case, is the honest place to land, because every one of those cases, examined closely enough, reduces to the same root gap: not a failure of technology, not even really a failure of values, but a failure to assign, in writing, to a specific person, the job of noticing before the rest of the world does it for you.
The question I'd leave every reader of this research with
If your brand's automated output drifted significantly this month — not hypothetically, but actually, starting today — is there a specific person who would notice before a customer, a journalist, or a tribunal did? If you can name that person, you've built something most of the organizations in this entire research program hadn't. If you can't, that's not a failure of technology, or of intention, or even of resources in most cases. It's an accountability gap sitting exactly where every other case in this work has shown it tends to sit — unassigned, unnoticed, and quietly compounding until someone outside the building finds it first.
If you're not sure who, specifically, would catch your own brand's next drift before someone outside your organization does, that's the exact gap I'd want to help you close. Get Your Free Brand Audit →
References
Diligent. (2025). Three lines of defense in risk management: ERM framework guide.
Institute of Internal Auditors. (2020). The IIA's Three Lines Model: An Update of the Three Lines of Defense.
Royal Commission into the Robodebt Scheme. (2023). Final Report.