Cognitive Handshake® with Greg Hutchins

For RIVER Brief 10, I sat down with Greg Hutchins, an engineer and inventor of AI Assurance Stack®, to explore a deceptively simple question: What does it actually take to trust AI?

I started by asking Greg whether, given AI’s opportunity and risk, he sees the glass as half full.

Greg rejected the premise.

“What’s the purpose of the glass? What color is the glass?”

His answer was pure entrepreneur: don’t debate whether the glass is half full or half empty. Own the glass. Design it. Decide what goes into it. Fill it to the top.

It was memorable—but it also framed the much harder question that followed.

Who is willing to put their name behind the AI system—and on what evidence?

Governance is not the same as assurance

I asked Greg what an auditable decision looks like when part of the thinking is being done with AI.

He quickly moved the conversation from auditing to assurance—and from assurance to trust.

In traditional engineering, assurance has a tangible meaning. Is the system safe? Is it fit for use? Does it do what it is supposed to do safely?

AI makes those questions harder. We may understand the intended use of a system. We may establish policies and controls around it. But in higher-consequence settings, Greg’s concern is whether we understand enough about the context, inputs, what is happening inside the system, and the outputs to justify reliance.

Governance can tell us what should happen. What proves that it actually happened?

Policies, standards and procedures matter. But having governance documentation does not itself demonstrate that an AI system behaved as intended—or that its outputs deserve reliance.

That is the assurance gap.

The engineering-stamp test

I asked Greg what evidence he would need before putting his own name behind the sentence:

“I trust this AI system.”

His response made trust personal.

“If we don’t know what’s going on with the systems, we can’t put our engineering stamp on a drawing or on an AI system.”

The stamp represents an attestation somebody is willing to stand behind.

Greg’s threshold begins with context. How is the AI being used? For what purpose? By whom? What are the inputs? What do we understand about the process? What do we know about the outputs?

If those questions cannot be answered sufficiently for the risk involved, the response cannot simply be, “We have an AI policy.”

Sometimes the appropriate answer may be to narrow the scope. Sometimes it may be to look only at the controls. And sometimes the right answer may be to walk away.

That is a very different standard from checking a governance box.

Three questions for AI assurance

Our discussion of standards produced a useful executive framework.

Greg pointed to the NIST AI RMF, ISO 42001 and emerging sector-specific AI standards. But standards alone do not resolve the assurance problem.

He framed three questions leaders need to answer:

1. What standard, benchmark or expectation are we using?

2. How will we determine whether the system actually meets it?

3. Who is qualified—and accountable—to provide that assurance?

The second question may be the hardest. It is relatively easy to publish a policy. It is much harder to demonstrate effectiveness.

My takeaway from Greg’s answer is that the evidence burden should rise as the consequence and autonomy of the use case rise.

When AI can act before humans can react

The conversation became even more difficult when we moved from AI models that provide information to AI agents that can act.

If an AI agent can act before a human reviews its decision, where does accountability actually live?

Greg focused on the extraordinary difference in decision speed between humans and machines. A human may deliberate for hours, days or months. A machine can act almost instantly.

That creates an uncomfortable possibility: putting a human “in the loop” may sound reassuring while giving that human little realistic ability to intervene before an action has already occurred.

Greg described the current challenge in terms of humans being “in the loop, on the loop, and over the loop.” But his deeper point was about the rules of engagement between human and machine.

What authority has actually been delegated?

What boundaries exist?

When must a person intervene?

And who remains accountable when the system acts?

A board-level question

I asked Greg what he would tell a board considering a high-impact AI system.

“Be very careful because one bad decision is basically going to bet the company.”

Not every AI use case carries that level of consequence. But some will.

The practical takeaway I drew from Greg’s answer is that a board does not need false certainty. It does need enough evidence to understand the decision it is authorizing.

What is the business context?

What can the system do?

What can go wrong?

What evidence supports reliance?

Where does human judgment remain essential?

What happens when the system moves outside its expected boundaries?

The question we may ask five years from now

Near the end of our conversation, I asked Greg:

Five years from now, what will we look back at in today’s AI governance programs and wonder, “How did we think that was enough?”

I asked him to pick just one issue.

“Does the machine have agency?”

That may be the question underneath many of the others.

The challenge is no longer simply whether AI can generate a useful answer. It is increasingly whether organizations are willing to allow AI to make decisions, initiate actions and interact with other systems—and under what conditions.

For me, that reframes the leadership question.

Not: Can the AI do this?

But: What authority have we earned the right to give it?

Before you put your name on the AI

Before relying on a consequential AI system, leaders should be able to answer five questions:

• What is the system being used for—and by whom?

• What do we understand about its inputs, process and outputs?

• What are the risks and benefits of using it in this context?

• Where is the human—in the loop, on the loop or over the loop?

• Does the system have agency, and what rules of engagement govern the human-machine relationship?

If those questions cannot be answered with enough confidence for the stakes involved, that itself is an important assurance signal.

Would you put your name on it?

The most useful test from my conversation with Greg may also be the simplest.

Imagine your name attached to the decision.

Not the vendor’s.

Not “the algorithm’s.”

Yours.

Would you put your name behind this AI system?

If yes, what evidence makes that judgment defensible?

If not, what uncertainty is still unresolved?

And if the machine can act before a human can meaningfully intervene, where does accountability actually live?

Those are AI governance questions. They are assurance questions. But ultimately, they are leadership questions.

At the end of our conversation, Greg gave the idea behind this series an unexpectedly fitting close:

“Cognitive handshake. Human to human, not human to machine.”

That feels like the right place to leave the question.

For discussion

Where has your organization granted AI decision authority faster than it has built the assurance needed to defend that choice?

Watch the full conversation

Greg Hutchins — Engineer & Inventor of AI Assurance Stack®