The most useful unit of analysis in AI governance is not the model, the user or the policy. It is the AI-assisted human — a small, hybrid system in which a person and one or more AI tools act together to produce a piece of work.
When a knowledge worker uses an AI tool for a real piece of work — drafting a contract, triaging a ticket, summarising a board paper, writing a piece of code — they are not using it the way they use a calculator. The interaction is iterative, conversational and consequential. The output of the work bears the fingerprints of both parties.
I have come to call this unit the AI-assisted human. It is a small, temporary sociotechnical system whose properties differ from those of either the person working alone or the model working alone. It is the unit at which most modern governance questions actually land, and it is the unit most policies fail to address.
Sociotechnical systems theory, developed at the Tavistock Institute in the 1950s, argued that workplace performance is determined by the joint design of the social subsystem (people, roles, relationships, culture) and the technical subsystem (equipment, processes, tools) (Trist 1981). Optimise one without the other and you predictably degrade the whole.
The relevance to AI is immediate. Most AI deployments have been technical decisions: which model, which vendor, which integration. The social subsystem — the norms about when to use the tool, how to disclose its use, who reviews its output, what counts as competent oversight — has been left to emerge by accident. Sociotechnical theory predicts that the result will be uneven, unstable performance with episodic harm. That is precisely what we observe.
Actor-network theory (ANT), associated with Bruno Latour, Michel Callon and John Law, argues that the right unit of analysis is the network of human and non-human actors whose interactions produce an outcome (Latour 2005). A train timetable, a microbe and a bureaucrat can all be actors in the same network; agency is distributed.
ANT is unfashionable in some quarters because of its insistence on the symmetry of human and non-human actors, but for AI it is unusually clarifying. A large language model is not a passive instrument. It nudges the user toward certain phrasings, certain structures, certain conclusions. Prompts shape models; models shape users; users shape prompts. Each is an actor with measurable effect. Governing only the human leaves the rest of the network ungoverned.
Combining the two traditions gives a practical model. To govern the AI-assisted human you have to govern four things in parallel.
The person. Skills, expectations, accountability. Does the user know what the model is good and bad at? Are they accountable for the output they ship under their name? Do they have the standing to overrule it?
The tool. Capability, configuration, data handling, vendor controls. Is the model fit for this class of task? What does it retain, share or learn from? Which version is in production today?
The task. The work being done, its sensitivity, its consequences, the required level of assurance. A risk-based approach lives here: not every task warrants the same scrutiny.
The trace. The record of what happened — what was asked, what was returned, what was edited, what was sent. Without a trace, the assisted-human system is opaque to the organisation and to any later reviewer. The trace is what makes the unit governable at all.
The practical implication is that policies written about people using AI are missing two-thirds of the system. Effective governance instruments are designed around the full unit: roles plus tool configuration plus task category plus traceability. They accept that the technical and the social co-determine the outcome and design controls across both.
For boards and executives, the test is simple. Pick any meaningful AI-assisted task in the organisation and ask: who is the responsible person, which tool and version did they use, what category of task is it, and can we reconstruct what happened? If any answer is missing, the unit is ungoverned regardless of how thick the AI policy is.
ISO-STANDARD.app captures AI-assisted humans the way they actually exist — the person, the tool, the task category and the evidence trail — and links each to the controls that keep them safe.
ISO-STANDARD.app ships a ready-to-adopt ISO 42001 workspace with the risk register, controls catalogue, policies and audit-ready exports already wired together — no spreadsheet sprawl, no consultant lock-in.
Prefer a conversation? Email hello@iso-standard.app — a real human responds within one business day.
