Someone is to blame for approving the use (or unapproved use) of a tool/process that breaks the law, same as today. When I worked in a regulated industry, we kept records of all inputs and decisions made and an auditor would do random checks that the results matched our documented methodology (afaik that documentation was submitted to/approved by either an auditor or the regulator).