How Do You Measure AI Speak-Up Culture?

AI speak-up culture should be measured using several forms of evidence rather than a single employee survey or incident count. A useful assessment combines what people believe about raising concerns, what they actually do when something feels wrong, how the organization responds, and the context in which AI is being used.

The interesting findings often appear where those sources disagree.

An organization may report very few AI concerns because its systems are well controlled. It may also report very few because employees do not recognize weak signals, reporting routes are unclear, people are unsure what qualifies as an AI concern, or experience has taught them that raising an issue achieves very little. The number is real in every case, but its meaning is not self-evident.

That is why measurement has to answer a harder question than “How many AI problems were reported?” Senior leaders need to understand whether the organization can reliably detect, move, interpret, and act on human observations about AI risk.

What should organizations measure in an AI speak-up culture?

A mature measurement approach needs evidence from several parts of the system.

At a high level, four kinds of evidence are particularly useful:

None of these gives you a complete diagnosis on its own. The value comes from looking across them and asking whether they tell a coherent story about how risk information actually moves through the organization.

That is particularly important in AI-enabled work because the same surface metric can arise from very different underlying conditions.

Why is an employee survey not enough?

Surveys matter because culture includes beliefs that cannot be observed directly. Employees can tell you whether they feel comfortable raising concerns, whether managers respond constructively, whether they believe intervention will be supported, and whether using an escalation route feels professionally safe.

Amy Edmondson’s foundational research on psychological safety helps explain why those perceptions matter. People are more likely to ask questions, admit mistakes, seek help, and challenge assumptions when they believe doing so will not expose them to unreasonable interpersonal consequences.

For AI risk management, however, self-reported confidence is evidence rather than proof that the control environment is working.

Employees may say they feel comfortable speaking up while formal AI concerns remain almost nonexistent. They may believe their manager welcomes challenge while still assuming that only confirmed failures belong in the reporting system. A team can be psychologically safe and still lack clear escalation routes, sufficient AI understanding, or practical authority to intervene when something goes wrong.

That is why psychological safety in AI risk management should be measured alongside behavior and organizational conditions rather than used as a substitute for them. The survey tells you something important about the environment, but it cannot tell you whether the whole sensing and response system works.

What perception evidence should organizations consider?

Perception evidence should help explain whether employees believe they can participate effectively in AI risk management.

Useful questions go beyond whether the workplace feels generally supportive. Can people question an AI-generated recommendation without feeling that they are obstructing progress? Are they comfortable acknowledging uncertainty before they have complete evidence? Can they challenge someone with greater organizational authority? Do they believe that reported concerns will receive serious attention, and that exercising legitimate intervention authority will be supported rather than quietly discouraged?

The wording matters because generic culture questions can miss AI-specific conditions. Someone may strongly agree that their team is open and supportive while feeling considerably less comfortable challenging a high-profile AI deployment backed by senior leadership.

Context-specific questions are more likely to expose that difference.

They also help separate employee sentiment from organizational capability. “I feel safe speaking” and “I know how to escalate an AI concern beyond my manager” are not the same thing, even though both influence whether a useful signal ultimately reaches the right place.

What behavioral evidence can show whether people actually speak up?

Behavior provides another view because it shows what happens when people encounter AI in real work.

Depending on the environment, useful evidence might include AI-related concerns, near misses, requests for additional human review, challenges to AI-generated decisions, interventions, workflow pauses, overrides, rejected recommendations, escalations, or use of independent reporting routes.

The goal is not to maximize any one of those behaviors.

A high override rate, for example, could indicate healthy skepticism. It could also point to weak model performance, poor workflow design, badly calibrated automation, or an AI system being used in work for which it is not particularly well suited. A low override rate could mean the opposite, or it could mean people are simply accepting what the system gives them.

The behavior becomes useful when interpreted against the work.

A consequential agentic workflow with substantial autonomy might reasonably generate more intervention and escalation activity than an internal tool used to help employees draft routine text. Comparing those raw counts without understanding that difference would produce a very poor risk assessment.

Behavior tells you what happened. The measurement problem is working out what that behavior means.

Why should organizations measure weak-signal reporting?

A strong AI speak-up culture gives the organization visibility before an issue becomes an obvious incident.

Weak signals can be surprisingly ordinary: an unusual output, an unexplained change in system behavior, unexpected access, a recurring workaround, repeated human correction, or simply an employee noticing that an automated process no longer behaves the way they expected.

Those observations often arrive with uncertainty attached. That is part of their value.

The FAA’s voluntary reporting programs are a useful example of why mature safety disciplines create ways for unusual events, errors, and near misses to become visible before they turn into larger failures. The information is valuable because patterns can emerge across events that looked insignificant when viewed individually.

The same logic applies to AI. If the organization only records confirmed failures, it loses sight of the earlier stages in which risk was forming and people were already adapting around it.

Our Guide to the warning signs of a weak AI speak-up culture looks at this problem from the opposite direction. One of the clearest warning signs is an environment where employees wait until the evidence becomes overwhelming before they feel justified in raising a concern.

That can produce very tidy incident data and very poor early warning.

What process evidence should organizations measure?

Once someone raises a concern, the organization itself becomes part of the measurement problem.

A healthy reporting culture can still produce poor risk outcomes if concerns disappear into a slow, confusing, or ineffective process. Measurement therefore has to follow the signal after it enters the system rather than stopping at the moment somebody submits a report.

Useful questions include how long it takes for concerns to receive an initial response, whether they reach people with the right expertise and authority, how often issues need to be rerouted, whether employees receive closure, which concern categories keep recurring, and whether validated problems lead to any meaningful change.

Response time deserves particular attention because AI systems operate at very different speeds.

A two-day review may be perfectly reasonable for one use case and almost irrelevant for an agent capable of taking consequential actions in seconds. The useful measure is not simply “time to response,” but whether the organization can respond within the window in which human action can still influence the outcome.

That is why AI escalation paths need to be assessed as operating mechanisms rather than documented processes. The existence of a route tells you very little about whether information reaches the right person early enough to matter.

How do you measure intervention authority?

Intervention authority is a good example of why several evidence sources need to be considered together.

An organization can begin with the formal design: which roles are allowed to pause an AI-enabled process, require additional human review, restrict an agent’s permissions, reject a recommendation, or stop execution altogether?

That tells you what the organization has authorized.

The next question is what happens in practice. When relevant conditions arise, do people actually use that authority, and do they feel able to exercise it without creating unnecessary personal or organizational friction?

The gap between those two views can be revealing.

As discussed in What Is Intervention Authority in AI Governance?, low use does not automatically mean the control is weak. The system may simply be performing well. But low use can also occur because people fail to recognize the conditions, misunderstand what they are allowed to do, cannot practically stop the workflow, or believe that intervening carries too much organizational cost.

A policy review cannot distinguish among those possibilities. Measurement can reveal that something deserves investigation, but diagnosis still requires interpretation.

Why does organizational context matter so much?

Risk signals do not have universal meanings.

Ten AI concerns in a year could represent substantial activity or almost none. The answer depends on the size of the workforce, how many people are using AI, the kinds of systems involved, how much autonomy those systems have, how many consequential decisions they influence, and how quickly the organization itself is changing.

The surrounding working conditions matter just as much. A team operating under severe productivity pressure may be less willing to interrupt an AI-enabled workflow than one with more time for review. A newly deployed system will naturally generate more uncertainty than a familiar one, and a function where employees routinely challenge technical decisions may have a very different baseline from one where hierarchy is strong.

The NIST AI Risk Management Framework reflects this broader view. Its governance, mapping, measurement, and management functions connect AI risk to organizational roles, culture, human oversight, and the context in which systems are actually being used.

For Human Risk Management, that means measurement needs enough context to explain the evidence rather than merely count it.

What is concordance, and why does it matter?

Some of the most useful findings appear when different forms of evidence agree with one another, or when they do not.

Cybermaniacs uses concordance as a way of examining whether different human-risk signals tell a compatible story. The public concept is straightforward: when perceptions, behavior, processes, and outcomes point in different directions, the disagreement itself deserves attention.

For example:

These are hypotheses to investigate, not automatic diagnoses.

That distinction matters because a mature measurement system should help leaders ask better questions before it encourages them to make stronger claims. The usefulness of concordance lies in showing where the evidence does not quite fit together and where a deeper explanation is needed.

Is high reporting evidence of high AI risk?

Not necessarily.

Higher reporting can reflect more underlying problems, but it can also result from better detection, stronger psychological safety, easier reporting routes, greater AI exposure, or several of those things happening at once.

The same ambiguity appears in other safety disciplines. More visible events do not always mean the system has suddenly become less safe; sometimes previously hidden conditions have finally entered the reporting environment.

This makes simplistic benchmarking dangerous.

An executive dashboard that ranks business units according to who reported the fewest AI problems could create exactly the wrong incentive. Teams may quickly learn that visibility makes them look worse, while quiet teams appear safer without demonstrating anything about the quality of their risk environment.

The useful question is whether the amount and type of reporting makes sense for the work being performed, and whether those signals lead to appropriate action.

Should AI speak-up culture have a single score?

A summary score can be useful for communication and trend tracking, but it should not be mistaken for the underlying condition.

Human Risk Management frequently runs into trouble when complex evidence is compressed into one number and the organization gradually begins managing the number instead of the thing it was supposed to represent. AI speak-up culture is particularly vulnerable to this because several very different failure mechanisms can produce the same headline result.

Two organizations can arrive at similar overall scores while having very different problems. One may have low psychological safety. Another may have confident employees and ineffective escalation routes. A third may be good at surfacing concerns but poor at closing the loop once those concerns are raised.

Those situations should not lead to the same intervention simply because the score looks similar.

Cybermaniacs’ measurement work therefore separates the analytical output from the condition beneath it. Scores, rates, survey responses, behavioral signals, and risk indicators can all be useful, but they answer different questions.

The purpose of the measurement system is to understand enough of what is happening to explain the risk and choose an appropriate response.

What should a senior leader see on an AI speak-up dashboard?

A useful executive view should help a CISO, CIO, CAIO, risk leader, or board understand whether the organization’s human sensing and response system appears healthy.

That may include trends in employee confidence, weak-signal and near-miss visibility, escalation activity, intervention behavior, response and closure, recurring issues, and meaningful differences between populations or parts of the business.

Some simplification is unavoidable at executive level, but the dashboard needs enough context to prevent easy misinterpretation.

A sudden increase in AI-related reporting after a new speak-up initiative may represent improved visibility rather than deteriorating culture. Low escalation can be healthy when local decision rights are clear and work is functioning well; it can also mean that concerns are never traveling beyond the immediate team.

The dashboard should help leaders investigate those possibilities rather than prematurely collapse them into red, amber, or green.

How do you know whether AI speak-up culture is improving?

Improvement should show up across more than employee sentiment.

Over time, an organization might expect employees to become more confident about raising uncertainty, more accurate in recognizing what should be surfaced, and more familiar with the routes available to them. Weak signals and near misses may become more visible, escalation may happen earlier, and the organization may become faster and more consistent in responding to what employees raise.

Some of those movements may look counterintuitive at first.

A healthier speak-up culture can initially produce more reports because people are surfacing things that previously stayed local or invisible. Later, better controls may reduce recurrence while reporting confidence remains high. That sequence tells a much more useful story than a dashboard celebrating a simple decline in incident counts.

Culture also changes through experience. People update their beliefs based on what happens when they or their colleagues speak up, which means one-time surveys are rarely enough. The organization needs to look for persistent changes in the conditions that shape behavior, not merely temporary movement in perception.

How does AI speak-up measurement fit into Human Risk Management?

AI speak-up culture illustrates why Human Risk Management has to extend beyond training activity and isolated employee risk scores.

The evidence crosses competency, psychology, behavior, culture, organizational conditions, technology use, and the work itself. The measurement challenge is understanding how those factors interact well enough to identify the condition that actually needs attention.

That is also why our wider AI speak-up work separates psychological safety, escalation, intervention authority, and organizational response instead of treating “culture” as one broad variable.

Cybermaniacs has been developing the models and measurement approaches needed to examine human risk across these layers. Our AI Enablement & Change work applies that thinking to workforce AI adoption, capability, behavior, and culture, while Agentic Readiness & Change extends it into environments where people increasingly supervise, delegate to, and collaborate with AI agents.

The public concepts help organizations understand what should be measured. Turning those observations into reliable evidence about risk, deciding how much confidence to place in the interpretation, and selecting the right intervention requires a deeper measurement architecture.

What is the most important principle for measuring AI speak-up culture?

Treat each metric as evidence about the system rather than as the system itself.

A survey result can tell you something. So can an escalation, an override, a near miss, or a period with almost no reports. None of those signals has one fixed meaning once it is separated from the environment in which it occurred.

Strong measurement brings them together and asks whether they form a credible picture of how people recognize, communicate, and act on AI risk.

The central problem is visibility. Organizations need enough evidence to understand whether weak signals can become visible, whether they can travel to someone with appropriate authority, and whether the response makes people more or less likely to speak up the next time.

That is much closer to understanding whether the human part of AI governance is working than simply counting incidents.