LAAF: A Layered Accountability Architecture Framework for LLM Applications
Organizations: School of Computer Science Engineering and Technology, Bennett University, Greater Noida, India · Centre for Sustainable Cyber Security (CS2), University of Greenwich, United Kingdom · School of Electrical Engineering, Computing & Mathematical Sciences, Curtin University, Australia · Systems and Software Security (S3), University of Manchester, United Kingdom
Abstract
Large Language Models (LLMs) operate in hospitals, courtrooms, banks, and public service desks, where fluent, confident outputs are treated as authoritative even when ungrounded or incorrect. When such an output contributes to harm, who is answerable, and through what mechanisms can responsibility be traced, explained, and acted upon? Following PRISMA guidance, five databases were searched from January 2022 to March 2026 against four review questions; of 4,512 records identified, 122 primary studies were included, together with 12 regulatory and standards documents analysed as primary sources. The review consolidates a sociotechnical account of accountability as an actor-forum relation resolved into five dimensions, and synthesises mechanisms across four families: technical controls, human oversight, organisational governance, and documentation and traceability, each with a maturity assessment. The corpus is read through a four-layer classification device spanning provenance, application logic, human oversight, and governance and redress, cross-cut by traceability, role clarity, and continuous monitoring. Both are mapped onto the EU AI Act, whose high-risk obligations have applied since 2 August 2026, the NIST AI RMF with its Generative AI Profile, ISO/IEC 42001, and sectoral guidance in healthcare, consumer finance, education, and the public sector. Four persistent gaps emerge: under-specification of human oversight, absence of shared accountability metrics, disciplinary disconnection, and limited empirical evaluation, alongside five structural tensions that no surveyed instrument resolves. The review closes by consolidating the classification device into an integrated accountability architecture, LAAF, with cybersecurity aligned to the OWASP LLM Top 10 (2025); it is a synthesis of the surveyed evidence rather than a validated artefact.
Figures & tables
| Actor type | Actor | Contribution | Accountability surface | Answerable at |
|---|---|---|---|---|
| Internal | Foundation-model provider | Training data, base weights, alignment, release | Model card, evaluation reports, systemic-risk disclosures | L1 |
| Internal | Fine-tuning party | Domain adaptation, safety patches | Fine-tuning records, drift documentation | L1 |
| Internal | Application developer | Prompt design, retrieval, tools, guardrails | Application logs, design rationale, retrieval provenance | L2 |
| Internal | Deploying organisation | Policy, roles, review obligations, override authority | Governance policy, role allocation, audit trails | L2-L4 |
| Internal | Domain professional | Prompt phrasing, interpretation, professional judgement | Review records, sign-off, duty of care | L3 |
| External | End user or affected party | Reliance on output, downstream action | Terms of use, reported harms, complaint and contestation records | Forum, not a layer |
| Ref. | Focus | Concept | Mech. | Reg. | Sector | Cyber | Differentiation from this survey |
|---|---|---|---|---|---|---|---|
| [ 43 ] | Hallucination taxonomy | P | Y | N | N | N | We integrate hallucination into an accountability framework |
| [ 76 ] | Accountability concept | Y | N | N | N | N | We add mechanism synthesis + LAAF construction |
| [ 112 ] | Attributability gap | Y | N | N | N | N | We extend to LLMs with regulatory mapping |
| [ 70 ] | LLM auditing (3-layer) | P | Y | P | N | N | LAAF covers full lifecycle incl. cybersecurity |
| [ 34 ] | EU AI Act analysis | P | N | Y | P | P | We bridge legal and technical perspectives |
| [ 90 ] | Risk governance for AI | P | P | P | N | N | We update to LLM context with GenAI Profile |
| Dataset / resource | Domain | Scale | Application |
|---|---|---|---|
| HaluEval [ 58 ] | Hallucination detection | 35,000 annotated samples | Evaluating detection methods |
| TruthfulQA [ 61 ] | Factuality | 817 questions, 38 categories | Truthful generation |
| FactScore [ 66 ] | Long-form factuality | Atomic-fact annotations | Fine-grained factuality |
| RAGTruth [ 74 ] | RAG hallucination | 18,000 word-level annotations | Retrieval-augmented evaluation |
| BOLD [ 19 ] | Fairness | 23,679 prompts | Open-ended fairness |
| HolisticBias [ 94 ] | Bias coverage | 600 descriptors, 13 axes | Bias measurement / audit |
| Stage | ACM | IEEE | ScienceDirect | Springer | Wiley | Total |
|---|---|---|---|---|---|---|
| Identified (keyword) | 612 | 1,847 | 1,108 | 832 | 113 | 4,512 |
| After duplicate removal | 553 | 1,648 | 989 | 565 | 70 | 3,825 |
| After title screening | 187 | 432 | 261 | 174 | 24 | 1,078 |
| After abstract screening | 92 | 248 | 178 | 109 | 15 | 642 |
| After intro/conclusion review | 45 | 121 | 89 | 64 | 7 | 326 |
| Final inclusion | 24 | 41 | 32 | 22 | 3 | 122 |
| Dimension | Central question | Failure mode when missing |
|---|---|---|
| Disclosure and justification | Can actors explain and justify decisions? | Disclosure without consequence |
| Oversight | Can humans meaningfully review and override? | Ceremonial sign-off, automation bias |
| Organisational / governance | Are roles and pathways embedded institutionally? | Aspiration without operationalisation |
| Moral/professional | Are human duties of care preserved? | Responsibility displaced onto the model |
| Enforcement/redress | Are failures investigated and sanctioned? | Rhetorical accountability without consequence |
| Family | Specific mechanisms | Primary contribution | Maturity | Regulatory anchor |
|---|---|---|---|---|
| Technical controls | RAG, guardrails, uncertainty/abstention, watermarking, logging | Attach outputs to evidence; mark/contain risk | RAG & logging high; guardrails/UQ medium; watermarking emerging | EU AI Act Arts. 11–12, 15; ISO/IEC 42001 |
| Human oversight | In-the-loop, on-the-loop, escalation, override | Place substantive judgement in the path | Medium (mostly simulated) | EU AI Act Art. 14; NIST Manage |
| Organisational | Roles, committees, audit/red team, incident response, management systems | Embed answerability institutionally | Medium | EU AI Act Arts. 9, 17, 27–73; ISO/IEC 42001 |
| Documentation | Model/system cards, datasheets, evaluation reports, output provenance | Make decisions investigable post-hoc | Cards high; output provenance emerging | EU AI Act Annex IV; NIST Map/Measure |
| Sector | Principal guidance | Deployment patterns | Mechanisms emphasised |
|---|---|---|---|
| Healthcare | FDA AI/ML SaMD; EMA reflection paper | Clinical decision support, diagnostics | Predetermined change control, validation, surveillance |
| Consumer finance | CFPB Circular 2023-03; EBA | Credit decisioning, advisory chatbots | Output traceability, reason-giving, contestability |
| Education | US Dept. of Education; UNESCO | Tutoring, assessment, personalisation | Transparency, instructor oversight, privacy |
| Public sector | OECD; EU AI Act Annex III | Service delivery, benefits, hiring | Risk classification, oversight, contestability |
| Dimension | EU AI Act | NIST AI RMF | ISO/IEC 42001 | Sectoral |
|---|---|---|---|---|
| Legal status | Binding, penalties | Voluntary, influential via procurement and state reference | Voluntary, certifiable | Mixed: binding where statutory, advisory otherwise |
| Scope | Horizontal | Horizontal | Horizontal | Sector-specific |
| Human oversight | Mandatory (Art. 14) | Govern and Manage; GenAI Profile actions | Operational controls | Mandatory in regulated sectors |
| Documentation/logging | Mandatory (Arts. 11–12, Annex IV) | Map/Measure | Documented information | Sector-specific records |
| Post-deployment monitoring | Mandatory (Arts. 72–73) | Measure and Manage | Performance evaluation | Post-market surveillance |
| Cybersecurity | Mandatory (Art. 15) | Map, Measure, Manage; GenAI Profile actions | Annex controls | Sector-specific |
| Persistent gap | Where documented | Requirement imposed on LAAF |
|---|---|---|
| Under-specification of human oversight | 1.2, 7.1, 8.5 | Specify what, when, with what information, with what authority |
| Absence of shared accountability metrics | 7.5, 8.5 | Define layer-specific accountability indicators |
| Disciplinary disconnection | 1.2, 6, 7 | Integrate mechanisms from the technical and governance literatures |
| Limited empirical evaluation | Sections 6–8 | Articulate evaluation criteria and validation pathways |
| Tension | Where most visible | How LAAF addresses it |
|---|---|---|
| Transparency vs. competitive/security | Documentation, watermarking, security | Separate internal/external disclosure surfaces in Layer 4 |
| Automation vs. substantive oversight | Oversight, decision support | Distinguish review regimes; require explicit justification |
| Standardisation vs. contextual fit | Audit, standards, sectoral | Sector-agnostic architecture with sector specialisations |
| Traceability vs. privacy | Provenance, logging, privacy | Governed provenance and audit assets in Layer 4 |
| Deployment speed vs. governance maturity | Capability vs. risk governance | Incremental adoption by layer, with the accountability properties forgone at each stage stated explicitly |
| Layer | Accountability function | Principal artefacts | Named accountable actor |
|---|---|---|---|
| L1 Foundation Model & Provenance | Establish verifiable identity of model and training basis | Model card, training-data record, version, systemic-risk disclosures | Foundation-model provider; fine-tuning party |
| L2 Application Logic & Guardrails | Ground generation, enforce policy, mark uncertainty, log behaviour | Retrieval pipeline, guardrails, uncertainty scores, abstention rules, output provenance | Application developer; deploying organisation |
| L3 Human Oversight & Review | Place substantive human judgement in the path | Review workflow, escalation pathway, override authority, regime selector | Deploying organisation; domain professional |
| L4 Governance, Audit & Redress | Allocate roles, govern, audit, respond to incidents | Role allocation, governance committee, audit, incident response, management system | Deploying organisation (corporate entity) |
| Property | Layer 1 | Layer 2 | Layer 3 | Layer 4 |
|---|---|---|---|---|
| Traceability | Model/version ID, training-data record | Output provenance, retrieval citations, uncertainty | Review record, override record | Audit record, incident record, minutes |
| Role clarity | Provider & fine-tuner named | Developer & deployer named | Reviewer & override authority named | Named individuals per governance role |
| Continuous monitoring | Update notifications, risk reassessment | Logging hooks, drift detection | Review/override pattern analysis | Incident cycles, audit cycles, improvement loop |
| Layer | EU AI Act | NIST | ISO/IEC 42001 | OWASP LLM Top 10 (2025) | Layer indicator |
|---|---|---|---|---|---|
| L1 | Ch. V, Annex IV | Map | Design/development controls | LLM03 Supply Chain; LLM04 Data & Model Poisoning | Completeness of model/training disclosures |
| L2 | Arts. 11–12, Annex IV | Map, Measure | Operational controls | LLM01 Prompt Injection; LLM02 Sensitive Info Disclosure; LLM05 Improper Output Handling; LLM06 Excessive Agency; LLM08 Vector & Embedding Weaknesses & LLM09 Misinformation | Proportion of outputs with citations & uncertainty |
| L3 | Art. 14 | Manage | Roles & competence | LLM07 System Prompt Leakage | Override rate, review time, regime justification |
| L4 | Arts. 9, 17, 72–73 | Govern (all) | Leadership, planning, evaluation, improvement | LLM10 Unbounded Consumption (org level); all categories | Incident closure rate, audit-cycle completion |
| LAAF element | Healthcare | Finance | Public sector |
|---|---|---|---|
| L1 priorities | Clinical safety in training data | Fair lending in training data | Democratic neutrality in training |
| L2 guardrails | Clinical accuracy, citation grounding | Discriminatory features, data leakage | Political balance, source verification |
| L3 reviewer | Clinician with medical authority | Credit officer with adverse-action knowledge | Civil servant with verification duty |
| L4 governance | Clinical-AI lead + hospital quality | Credit risk + fair lending + consumer protection | Digital service + DPO + accountability officer |
| Regulatory anchors | EU AI Act high-risk, FDA, EMA | CFPB, EBA, EU AI Act Annex III | OECD, EU AI Act Annex III |
| Sector-specific risk | Diagnostic error, patient harm | Discriminatory denial, financial harm | Citizen rights, democratic harm |
| Ref. | Framework | Layered | Oversight | Cyber | Reg. map | Sector | Roadmap | Eval. criteria |
|---|---|---|---|---|---|---|---|---|
| [ 70 ] | Three-layered LLM audit | P | P | |||||
| [ 3 ] | NIST AI RMF | P | P | P | ||||
| [ 4 ] | NIST GenAI Profile | P | P | |||||
| [ 46 ] | ISO/IEC 42001 | P | P | P | ||||
| [ 10 ] | Transparency Index | P | ||||||
| [ 90 ] | Risk governance | P | P |
AI Accountability
AI accountability concerns how responsibility for AI decisions and harms is assigned, evidenced, challenged, and remedied.
See all 157 papers