Question 2 of 24
Who owns AI governance within the organization?
Defining accountability for AI governance, whether in Legal, IT, Risk, or a dedicated AI ethics function, and establishing clear escalation paths.
The ownership question is not optional
AI governance without clear ownership defaults to no governance. When accountability is diffuse, risk assessments do not happen, vendor reviews get skipped, and incidents have no clear owner. Regulators and litigants look for evidence that someone was responsible. If you cannot answer that question, the answer defaults to everyone, which in practice means no one.
The right governance structure depends on your organization's size, regulatory environment, and AI maturity. What matters more than the specific structure is that it is explicit, documented, and resourced.
Three common models
The Legal-led model places AI governance within the General Counsel's office or compliance function. This works well in heavily regulated industries where legal risk is the primary driver. The limitation is that Legal typically lacks the technical depth to evaluate model behavior, and may be reactive rather than embedded in product development.
The Risk-led model houses AI governance within enterprise risk management or information security. This integrates AI risk into existing risk frameworks and reporting structures. It works well when AI risk is primarily framed as operational or reputational risk. The limitation is that Risk functions may not have the regulatory expertise to track legislative developments.
The dedicated AI ethics or AI governance function sits outside Legal and Risk, often reporting to a Chief AI Officer or directly to the C-suite. This model is most common in larger organizations with significant AI exposure. It combines policy, technical, and legal expertise, and is better positioned to be proactive rather than reactive.
Define the RACI before the incident
Regardless of which model you adopt, document a RACI (Responsible, Accountable, Consulted, Informed) for the key AI governance activities: system inventory, risk classification, vendor due diligence, incident response, regulatory monitoring, and employee training.
Escalation paths matter as much as day-to-day ownership. Who decides when a high-risk AI deployment should be paused? Who approves exceptions to AI use policy? Who speaks to regulators if there is an inquiry? These decisions should be pre-assigned, not improvised under pressure.