From second-order tensions to fourth-order AI governance: control, learning, ethics, and responsibility in reflexive sociotechnical systems

Purpose This conceptual paper addresses fragmentation in organisational AI governance, where ethical orientation, compliance control and organisational learning are often treated separately. It asks how governance can remain effective when contemporary weak or soft AI becomes a decision-shaping component of organisational sociotechnical systems and when responsibility must remain attributable across distributed actors and lifecycle stages. Design/methodology/approach The paper develops a selective, problem-driven conceptual synthesis grounded in cybernetic concepts of feedback, observer dependence, structural coupling, learning, control and responsibility. These concepts are used as analytical lenses to reinterpret AI governance, risk management, auditing, regulation and lifecycle responsibility, structured through the transition from first-order regulation to proposed third- and fourth-order governance capacities. Findings Current AI governance frameworks provide indispensable principles, standards, controls and lifecycle instruments, but they often leave unclear when a governance concern should move from behavioural correction to revision of evaluative criteria, institutional arrangements, or the broader purpose and boundaries of automation. The paper proposes a four-order governance architecture and integrates ethics, control and reflexivity as mutually conditioning functions. Ethics provides navigational orientation for value-laden trade-offs; control stabilises action through multi-level regulation; and reflexivity reopens assumptions, criteria, governance arrangements and legitimacy when deployment outcomes, contestation or context changes warrant revision. Originality/value The paper extends second-order cybernetic thinking into contemporary AI governance by distinguishing cybernetic orders from governance levels and by locating responsibility in identifiable human and organisational actors across the AI lifecycle. Its contribution is a living governance model that connects normative orientation, behavioural regulation and reflexive revision across technical, operational, organisational and ecosystem levels. The framework clarifies how organisations can preserve accountability and adaptive capacity under conditions of uncertainty, data-recursive feedback, distributed responsibility and evolving sociotechnical consequences.