AI has a speed problem, although not the kind we usually worry about. The models are getting faster, the workflows are getting shorter, the research is getting easier, and the time between “I wonder…” and “here is a reasonably convincing answer” keeps collapsing. The difficulty is that everything around the answer is not accelerating at quite the same rate.
People still need time to understand what they are seeing, challenge assumptions, weigh consequences, reconcile competing priorities, recognize when something unusual is happening, decide what deserves escalation, and ultimately own what happens next. Organizations still need to align around consequential decisions, understand who has authority to make them, and work out whether moving faster is actually the same thing as moving well.
McKinsey recently gave this problem a useful name: the judgment bottleneck. In its October 2026 research on AI and strategic decision-making, McKinsey argues that analysis increasingly runs at AI speed while judgment still runs at human speed. One strategy team reported compressing five weeks of financial analysis into less than two days. Another began producing analytical work ten to twenty times faster and running three to five times as many scenarios, only to find that executives sometimes needed more time to decide because they did not fully understand the assumptions and evidence underneath the output. Read McKinsey’s research on the judgment bottleneck
That is an important strategy problem, but it is also becoming a Human Risk Management problem. If AI makes analysis cheap and abundant while human judgment remains constrained, the question is no longer simply how organizations get more from AI. It is whether the people sitting around increasingly accelerated decisions have the capability, authority and context to exercise judgment well.
The judgment bottleneck is not simply a limit on how quickly humans can review AI output. It is a growing gap between the speed at which AI can produce analysis and action, and the human capability required to understand risk, challenge assumptions, make decisions and remain accountable for what happens next.
When AI analysis becomes abundant, human judgment becomes scarce
For much of modern knowledge work, analysis itself was expensive. Someone had to gather the data, construct the spreadsheet, test the assumptions, research the alternatives, produce the slides, review the findings and start again when a senior leader asked the one question nobody had modeled. That friction could certainly be inefficient, but it also did something less visible: it limited how much analysis an organization could produce and forced people to spend time inside the reasoning that produced it.
AI changes that equation. A team can now generate alternatives, scenarios, summaries, recommendations and supporting evidence at a pace that would have been impractical only a few years ago. In many contexts, that is enormously valuable because better analysis can expose more possibilities, test more assumptions and free experienced people from work that does not require their expertise.
Abundance, however, creates its own problem. If you can produce fifty plausible analyses in the time it once took to produce five, someone still has to decide which deserve attention. If every team can produce recommendations in hours rather than weeks, leaders still have to understand where the assumptions came from, what uncertainty remains and which decisions deserve human scrutiny.
That is where the bottleneck moves. McKinsey’s point is that it moves toward human judgment. Our concern is what happens next, because “use human judgment” sounds wonderfully sensible until you start asking what that judgment actually consists of and whether organizations are deliberately building it.
The question is becoming more urgent as AI moves beyond generating information and begins participating in decisions and actions. MIT Sloan researchers recently proposed an AI Decision Matrix that uses ambiguity and risk to determine when AI can act more independently and when human leadership should remain stronger. Routine, low-risk and low-ambiguity decisions are better candidates for automation; decisions with high ambiguity and high consequences demand substantially stronger human involvement. Explore MIT Sloan’s framework for determining when AI can make decisions
That is a useful way to frame the problem because it moves the conversation beyond a binary argument about whether humans or AI are “better” decision-makers. The real question is where each should exercise authority, under what conditions, and with what safeguards.
AI verification, AI judgment and risk judgment are different jobs
A great deal of current AI training understandably focuses on verification. Check the source, look for hallucinations, validate important facts, and do not assume an AI-generated answer is correct simply because it arrived in complete sentences and with the confidence of someone who has never once been trapped in an airport security line. All sensible advice, but accuracy is only one dimension of judgment.
An AI-generated recommendation can be factually correct and still be the wrong thing to do. Imagine an employee using AI to analyze a supplier contract, and the model correctly identifies that a particular clause allows the organization to terminate the agreement. The more important questions are what happens if the organization acts on that conclusion, what other obligations exist, who may be affected, whether the employee is authorized to make the decision, whether legal review is required, how reversible the action is, and what business, regulatory, operational or reputational risk may follow.
At some point, verification becomes decision-making, and decision-making becomes risk judgment. That distinction matters because many organizations are currently putting significant energy into AI literacy while assuming that good judgment will somehow arrive as a side effect. It may not.
AI literacy can help a person understand what a large language model is, where hallucinations come from, why sensitive data should not be pasted into an unapproved tool, and how to construct a better prompt. AI judgment is the ability to determine when, whether and how AI-generated information or action should influence a real-world decision. Risk judgment adds another layer by requiring people to understand the consequence, uncertainty, authority, exposure and escalation requirements surrounding that decision.
Those capabilities will increasingly matter anywhere AI moves from helping someone think to helping someone act.
This is also why AI workforce risk cannot be treated as another topic for the awareness calendar. As we have argued in our guide to AI Workforce Risk Management, the human and organizational risk created by AI sits in the gap between governance as designed and AI-enabled work as people actually perform it. Employees make continual decisions about what to delegate, what to verify, what to trust, when to intervene, how much judgment to hand over and what to do when a workflow behaves in a way nobody anticipated. Read Cybermaniacs’ guide to AI Workforce Risk Management
Human-in-the-loop is not the same as effective human oversight
One of the most reassuring phrases in AI governance is human in the loop. There it is: the human, safely in the loop, presumably judging things. The difficulty is that simply placing a person somewhere between an AI recommendation and an organizational action tells us almost nothing about whether meaningful oversight is actually occurring.
The person may not understand the underlying work or know which assumptions matter. They may lack enough subject-matter expertise to recognize a subtle error, be reviewing dozens of outputs under time pressure, assume somebody else already checked the model, or believe the organization values speed more highly than dissent. They may know that they are technically accountable for the decision while having very little meaningful control over how it was produced.
This is not merely a theoretical concern. Harvard Business Review has highlighted the growing divide between experienced professionals who can use AI to amplify expertise and less experienced workers who may not yet possess enough judgment to know when AI-generated work is weak. David Duncan’s analysis argues that organizations must deliberately redesign work so people continue developing judgment rather than allowing AI to remove the experiences through which expertise was traditionally built. Read HBR on developing good judgment in the AI era
Recent workforce research from IBM points in the same direction from another angle. In its 2026 CHRO study, 71% of CHROs identified the ability to supervise, validate and override AI outputs as an essential workforce capability, while only 29% of employees ranked judgment as important. IBM also found that 41% of CHROs believed employees might not feel safe challenging or overriding AI outputs, and that unclear accountability was already complicating AI deployment for many organizations. Read IBM’s 2026 research on judgment and AI-enabled work
That gap matters. An organization may formally assign human oversight while assuming the human already possesses the expertise, confidence, authority and organizational permission required to exercise it.
We have made a similar argument in our own work on human-in-the-loop controls and AI agents. Human presence and human control are not synonymous. A review step can exist on a workflow diagram while contributing very little actual ability to detect, challenge or stop a poor decision. Read Human-in-the-Loop Is Not a Control
Human oversight is only a meaningful AI control when the person involved has the capability, context, authority and organizational support to intervene when it matters.
The AI apprenticeship problem: where will tomorrow’s judgment come from?
This may be the most interesting paradox in the current research. McKinsey argues that AI is making judgment more valuable at exactly the same time that it is beginning to remove some of the experiences through which people historically developed judgment. That should make executives uncomfortable for reasons that go well beyond talent development.
People generally do not acquire good judgment by reading the judgment policy. They acquire it through exposure: investigating things that turn out not to matter, making assumptions and getting challenged, discovering that the obvious answer was incomplete, watching more experienced colleagues notice patterns they missed, making low-consequence mistakes, receiving feedback and gradually building mental models that become useful when the situation is no longer obvious.
It is inefficient in much the same way that learning to cook is inefficient compared with ordering dinner. Unfortunately, outsourcing all the inefficient bits may also outsource some of the learning.
HBR has described this as a looming development challenge: junior workers risk becoming managers who have never deeply performed the underlying work they are eventually expected to supervise. Another recent HBR article goes further, arguing that AI can undermine leaders’ independent judgment when it narrows their breadth of perception or encourages them to defer too readily to machine-generated interpretations. The research discussed there included a field experiment involving 228 experienced evaluators assessing innovation proposals, adding to a growing body of work examining how AI assistance changes the judgments humans ultimately make. Read HBR on AI and the erosion of leaders’ independent judgment
California Management Review has recently described a related oversight gap, distinguishing between evaluative judgment — deciding whether an AI-produced answer is sound — and generative judgment, which involves recognizing the alternatives or possibilities the AI failed to surface. Their argument is useful because good human oversight cannot consist solely of proofreading whatever the machine happens to put in front of us. Read California Management Review on AI and the erosion of judgment
We think there is another useful risk concept emerging alongside this research: human capability debt.
Organizations can capture immediate productivity by allowing AI to take over work without deliberately replacing the developmental value that work once provided. The productivity gain is visible now, while the missing expertise may not become visible until later, when the organization relies on people to supervise, challenge or override systems whose underlying work they have never really learned to do.
Like technical debt, the first few installments can feel suspiciously like free money.
AI decision velocity also increases risk velocity
There is another part of the judgment bottleneck that matters particularly to CISOs and risk leaders. AI does not simply accelerate analysis; it can compress the distance between analysis and action. A traditional knowledge-work process might have involved research, a spreadsheet, a draft, a meeting, revisions, an approval and eventual execution, while AI can shrink several of those stages dramatically and agentic AI can shrink them further.
That is valuable when the decision is routine, reversible and well controlled. It becomes more interesting when the decision touches money, access, sensitive data, customers, employees, production systems, contractual commitments, safety or regulated activity. At that point, the question is no longer only how much faster the workflow can become, but how much consequential activity can occur before someone realizes the judgment was wrong.
That is risk velocity, and it is one reason the human side of AI governance and AI risk management cannot be reduced to awareness of approved tools and prohibited data. People increasingly need to recognize not only whether an AI system is behaving strangely, but whether a situation has crossed a threshold where greater scrutiny, intervention or escalation is required.
The broader AI governance community is already moving in this direction. The NIST AI Risk Management Framework treats AI risk as an organizational issue that extends beyond model performance alone and is intended to help organizations manage risk across the design, development, deployment and use of AI systems. Explore the NIST AI Risk Management Framework
The harder operational question is what those principles mean for the people performing AI-enabled work.
That is a Human Risk Management problem because it involves the interaction between competence, behavior, psychology, culture, authority, working conditions and organizational design. At Cybermaniacs, we define Human Risk Management as an organizational capability for understanding the human factors contributing to cyber risk, choosing appropriate interventions, measuring meaningful change and adapting as the organization and risk environment evolve. Our work deliberately goes beyond knowledge alone because understanding what somebody knows is very different from understanding what they are likely to do under pressure, why they may behave that way, and what surrounding conditions make that behavior more or less likely. Read Human Risk Management Has a Definition Problem
AI makes that distinction considerably more important.
AI governance depends on culture when the policy runs out
It is tempting to treat judgment as a quality that sits neatly inside an individual: some people have plenty of it, others presumably need another module in the LMS. Organizations are rather more complicated than that.
Consider an employee who notices something unusual in an AI-generated recommendation. Their response will be shaped not only by whether they recognize the problem, but by whether they believe they are expected to challenge it, whether doing so will make them look careful or obstructive, whether the team is rewarded primarily for speed, and whether leadership has spent the past six months celebrating how much friction AI has removed. A technically perfect escalation process does not help very much if using it feels like volunteering to become the person who slowed everything down.
Hierarchy complicates the picture further. A junior employee may be perfectly capable of spotting a weak assumption and still hesitate when the AI-supported conclusion aligns with what a senior executive clearly wants to hear. Someone may know they have formal authority to intervene while being considerably less certain that exercising it will be welcomed.
The effectiveness of human oversight therefore depends on more than competence. It depends on psychological safety, leadership modeling, prioritization, perceived control, accountability and the norms that develop around when challenge is expected. An organization can design a perfectly sensible escalation process that nobody feels comfortable using.
This is why culture belongs inside the AI governance conversation. Governance can specify where human approval is required, who owns a decision and when escalation should occur, but those controls ultimately rely on people being willing and able to use them. California Management Review recently made a similar case for moving AI governance beyond defensive guardrails toward a model that deliberately preserves the productive relationship between AI capability and human judgment, including decision rights, escalation and meaningful human agency. Read Governing AI Through Human-AI Symbiosis
Our work on the human permission layer reaches the same problem from the perspective of authority. AI risk registers may capture models, tools, permissions and technical integrations while still missing the network of human decisions that determine who can expand capability, change instructions, approve use, override safeguards or allow an experiment to become part of the operating environment. Read Is Your AI Risk Register Missing the Human Permission Layer?
Human Risk Management provides a useful lens because it asks not only whether people know what they are supposed to do, but what conditions make the desired behavior more or less likely. For AI-enabled work, that means looking at whether employees can recognize the relevant risk, whether they understand the limits of their own authority, whether challenge is reinforced rather than merely permitted, and whether leaders model the kind of scrutiny they expect from everyone else.
That is a much higher bar than putting a person in a workflow diagram.
Responsible AI should preserve judgment, not simply add more approval steps
There is an easy way to misunderstand this argument. AI is not dangerous because it is fast, and humans are not inherently better because we are slow. Humans bring our own magnificent collection of biases, blind spots, inconsistencies and Friday-afternoon decisions to the enterprise.
The goal should not be to preserve every manual process in amber so people can continue experiencing the character-building joy of spreadsheet reconciliation. The opportunity is to make much better use of both kinds of capability.
McKinsey makes this distinction clearly. Routine, high-volume decisions with known parameters may increasingly be automated, while decisions involving greater uncertainty can remain human-led with AI support. Decisions carrying substantial safety, liability or strategic consequence should retain clearer accountable human ownership.
MIT Sloan’s recent decision-rights work reaches a similar conclusion: the role assigned to AI should vary with the ambiguity and consequence of the decision rather than defaulting either to complete automation or reflexive human approval. Responsible AI therefore needs something more sophisticated than a universal “human in the loop” requirement. It needs deliberate decisions about where human judgment adds value, what kind of judgment is required, and what level of AI autonomy is appropriate for the risk.
That also gives us a more useful way to think about human-agent accountability. As AI systems gain greater autonomy, the organization needs to know not simply what the agent is permitted to do but who has the authority to delegate that work, who supervises it, who can intervene, and who owns the resulting outcome. We have already seen these questions surface as agents gain access to more systems, broader audiences and greater operational authority. Read AI Agents Create Four New Fronts of Risk
The argument, then, is not that humans should be inserted reflexively into every possible loop. It is that judgment should be placed deliberately, with a clear understanding of where human interpretation adds value and whether the person being relied upon actually has the capability and authority to exercise it.
What should CISOs and AI governance leaders do about the judgment bottleneck?
The first step is not another enterprise-wide AI training course. Training may absolutely be part of the answer, but only after the organization understands what capability it is trying to build. Without that, organizations risk teaching people how to use AI while leaving the harder judgment, accountability and risk questions untouched.
1. Map consequential AI-enabled decisions
Start by identifying where AI already influences consequential decisions or actions. That includes obvious high-risk uses, but also the less dramatic workflows where an employee can now research, recommend and act far faster than before.
The important question is where AI changes the speed, confidence, scale or reach of a decision enough to alter the underlying risk.
2. Define the human role and decision authority
Map who is expected to understand the output, who can challenge it, who can approve it, who can stop it, who owns the consequence, and what conditions should trigger escalation. Distinguish between decisions that are easily reversible and those that deserve a much higher threshold of human scrutiny.
This is where accountability stops being a sentence in an AI policy and starts becoming an operating model.
3. Define the judgment capability the role actually requires
That may involve technical AI literacy, but it may also require domain knowledge, risk recognition, confidence, critical thinking, escalation behavior and enough organizational authority to intervene when the answer is inconvenient. Different roles will require different combinations of those capabilities.
The Cybermaniacs Human Risk Management Capability Map takes this broader view by separating the capabilities needed to understand and diagnose risk, develop people, influence behavior and culture, connect evidence and context, measure change, and continually adapt the program. Explore the Human Risk Management Capability Map
4. Test whether human oversight actually works
If human oversight is an important AI control, treat it like a control rather than assuming it works because a policy exists or somebody completed training. Scenarios, simulations, assessments, behavioral evidence and culture measures can help establish whether people recognize relevant conditions and respond appropriately.
This is exactly why workforce measurement needs to move beyond course completion and self-reported confidence. Cybermaniacs’ Human Risk Assessment and Assurance work is designed to examine competency, behavior, psychology, culture and organizational conditions so organizations can see not only where risk exists, but why. Explore Cybermaniacs Human Risk Assessment and Assurance
5. Protect the experiences that build future judgment
Finally, pay attention to what AI is removing as well as what it is adding. If automation eliminates important developmental experiences, deliberately replace them through structured simulations, case reviews, supervised decision-making, exposure to consequences and deliberate challenge exercises.
The judgment previous generations developed organically may increasingly need to be built intentionally.
From AI governance to Human-AI Workforce Resilience
AI governance will continue to mature. Policies will improve, controls will get more sophisticated, standards will become clearer, and technical tooling will make more AI activity observable. All of that is necessary, but none of it will eliminate the need for people to make difficult decisions in situations the policy did not anticipate.
That is where resilience matters.
A resilient AI-enabled workforce needs to do more than know the rules. People need to recognize risk, challenge assumptions, understand consequence, know when their authority ends, escalate uncertainty, recover when things go wrong and learn as the technology and work continue to change. Those are operational capabilities, not simply awareness outcomes.
That is why we believe AI workforce risk belongs increasingly inside the Human Risk Management conversation. At Cybermaniacs, our Human Risk Management work connects competency, behavior, psychology, culture, measurement and program operations because human-related risk rarely has a single cause or a single intervention. Explore Cybermaniacs Strategic Human Risk Management
As AI becomes embedded deeper into enterprise work, we are applying that same thinking to AI Enablement: helping organizations measure readiness, identify capability and behavioral gaps, understand adoption barriers, strengthen human oversight and turn governance expectations into safer, more productive ways of working. Explore Cybermaniacs AI Enablement
McKinsey is right that judgment is becoming a bottleneck. The next question is whether organizations are prepared to treat judgment as a capability they must deliberately design, build, measure and protect, rather than something that conveniently appears whenever a workflow box says “human review.”
AI can make the answers arrive faster. The consequences of a bad decision are under no obligation to slow down with them.
