Who should own AI governance?

What is happening

AI touches security, legal, privacy, procurement, HR, data, and every operating unit. Because it touches everything, it is often assigned to everyone — which means nobody can make a decision without convening a meeting.

How to assign it

One accountable owner

Name a single executive accountable for AI governance outcomes. In most mid-sized organizations this is the CIO, CTO, CISO, or head of risk. The test is whether they have authority over tool approval and data classification.

Defined decision rights, not a standing debate

• Legal and privacy: contractual terms, regulated data, disclosure obligations.
• Security: data handling, access, vendor security review, incident routing.
• Data owners: whether a specific dataset may be used for a specific purpose.
• HR: uses that affect employees, and workforce impact considerations.
• Business unit leaders: accountability for outputs used in their processes.

Use existing structures where they exist

If you already have a technology governance or risk committee that functions, extend it. A parallel AI body usually duplicates decisions and slows both.

What not to do

• Do not assign ownership to an innovation function with no authority over data or procurement.
• Do not create a committee without naming who decides when the committee disagrees.
• Do not separate AI governance entirely from information and security governance — the underlying data risks are the same.

Questions to ask

• Who can approve a new AI tool today, and how do we know?
• Who decides whether a dataset may be used for a given purpose?
• Who is accountable if an AI-assisted output causes harm to a customer or an employee?
• Where does an AI-related incident get reported, and to whom?

Warning signs

• Approval requests circulate without a defined recipient.
• Two functions each believe the other owns AI policy.
• The governance group has no authority to stop a deployment.

When internal teams can handle it

When leadership can agree on where accountability sits, assignment is straightforward and internal.

When outside help may be appropriate

When accountability is contested between functions, or when the organization needs a neutral party to design decision rights that leadership will accept.