AI governance is often introduced through policies, risk assessments, and responsible AI principles. Putting those requirements into practice, however, requires clear ownership. Organizations need to determine who oversees AI use, who evaluates risks, who approves use cases, and who ensures that governance requirements are followed.
Without defined responsibilities, important decisions can fall between departments. Compliance teams may expect IT to address a risk, while IT assumes the business owner is responsible for resolving it. These gaps can make it difficult to maintain oversight as AI adoption expands across the organization.
AI governance requires coordination among different teams, with clear accountability for specific activities and decisions. Different teams may contribute to the governance process, but each responsibility should have a defined owner.
In this blog, we examine who should be involved in AI governance, what each stakeholder is responsible for, and how organizations can establish clear ownership as AI use expands.
Who Should Own AI Governance?
AI governance should have a designated owner with enough authority to coordinate the program across relevant functions. Depending on the organization, this could be an AI governance leader, risk leader, privacy or compliance executive, or another senior role.
The governance owner provides oversight of the overall program. Their responsibilities may include:
- Establishing governance requirements and procedures
- Coordinating AI reviews across relevant functions
- Defining approval and escalation processes
- Monitoring the governance program
- Escalating significant issues to appropriate leadership
However, this does not mean the governance owner should make every AI-related decision. Individual AI use cases should have business or system owners who understand how the technology is being used and are responsible for addressing the requirements that apply to it.
Who Are the Key AI Governance Stakeholders?
AI governance typically involves several functions. Their involvement should depend on the organization’s structure, the AI use case, and the requirements or risks associated with it.
Business Owners
Business owners are responsible for the purpose and use of individual AI systems. They should be able to explain:
- Why is the organization using the AI system?
- What business process does it support?
- Who uses the system?
- What decisions or activities rely on its output?
- Who is responsible for the system within the business?
Having a clearly identified business owner helps ensure that each AI system has someone accountable for its purpose, use, and ongoing oversight.
IT and AI Teams
IT and AI teams are responsible for the technical aspects of AI systems. Depending on the organization, this may include:
- Implementation and configuration
- Access and permissions
- System integrations
- Technical testing
- Security controls
- Ongoing technical monitoring
Their role is particularly important when AI systems are integrated into existing applications or business processes.
Privacy, Legal, Compliance, Security, and Risk
These functions provide subject-matter review based on the characteristics of the AI use case.
For example, a use case involving personal information may require privacy review, while an AI system connected to sensitive business systems may require additional security involvement. Legal or compliance teams may need to assess applicable obligations or internal requirements.
Not every use case requires every function to participate. The governance process should establish when each type of review is necessary.
Internal Audit
Internal audit can provide independent evaluation of the organization’s AI governance processes and controls. Rather than owning the governance program, internal audit can assess whether established processes are appropriately designed and operating as intended.
Keeping the role separate from day-to-day governance helps preserve the independence of the audit function.
How Should AI Governance Roles Be Assigned?
Once stakeholders are identified, organizations need to determine who is responsible for moving each governance activity forward.
A useful approach is to assign one primary owner to each activity, while identifying other teams that need to provide input or review.
For example:
- AI use case: Business owner
- Risk assessment: Business owner, with relevant subject-matter reviewers
- Technical review: IT or AI team
- Privacy review: Privacy team
- Approval: Designated approval authority
- Control implementation: Appropriate control owner
- Ongoing monitoring: Business and technical owners
- Issue escalation: AI governance owner
The exact assignments will vary by organization and the type of AI use case. What matters is that stakeholders know who is responsible for each step and who has authority to make the final decision.
Where Does an AI Governance Committee Fit?
For organizations with more complex AI use, an AI governance committee can provide a forum for cross-functional decisions.
The committee may be responsible for:
- Reviewing higher-risk AI use cases
- Considering exceptions to established requirements
- Resolving issues that involve multiple functions
- Reviewing significant AI-related concerns
- Escalating matters that require executive attention
The committee does not necessarily need to review every AI use case. Establishing criteria for committee review can keep the process manageable while ensuring that higher-impact decisions receive appropriate oversight.
For example, routine internal AI tools may be handled through the standard approval process, while higher-impact systems that influence decisions about individuals may be referred to the AI governance committee for review.
How Can Organizations Put AI Governance Ownership into Practice?
Once roles have been defined, organizations need a process for applying them to actual AI use cases. A practical starting point is to document the governance process from intake through ongoing monitoring.
Organizations can start by:
- Identifying the AI systems and use cases currently in use or under consideration and assigning an owner to each.
- Defining review requirements based on the type of AI use case, data involved, and potential impact.
- Documenting approval requirements so employees know when a use case can follow the standard process and when additional review is required.
- Establishing escalation paths for exceptions, unresolved risks, or significant changes.
- Defining when AI use cases must be reassessed as their purpose, data, functionality, or potential impact changes.
This gives employees a clear process to follow instead of relying on individual teams to determine who should be involved each time an AI use case is introduced.
Conclusion
AI governance does not belong to a single department. It requires coordination across business, technical, and oversight functions, with specific responsibilities assigned to the people making decisions and managing AI systems.
Organizations can start by identifying who owns the overall governance program, assigning owners to individual AI use cases, and defining when additional review is required. Approval, escalation, and monitoring processes can then be built around those responsibilities.
As AI use expands, businesses can adjust the structure to accommodate new use cases, risks, and requirements. The goal is to make responsibility clear enough that employees know who makes the decision, who provides input, and who remains accountable after an AI system is deployed.
FAQ
Who owns AI governance?
AI governance should have a designated owner responsible for overseeing and coordinating the overall program. Individual AI use cases should also have business or system owners accountable for how each system is used and managed.
Who are the key AI governance stakeholders?
Key AI governance stakeholders typically include business owners, IT and AI teams, privacy, legal, compliance, security, risk, and internal audit. The specific functions involved will vary depending on the AI use case, the data it involves, and the risks or requirements that apply.
What does an AI governance committee do?
An AI governance committee provides a forum for cross functional oversight and decisions that require broader input. Its responsibilities may include reviewing higher risk AI use cases, considering exceptions to established governance requirements, resolving issues involving multiple functions, and escalating significant concerns.
Does an organization need a VP of AI governance?
No. AI governance can be overseen by an existing leader in privacy, compliance, risk, IT or another relevant function. A dedicated VP of AI governance may become appropriate as an organization’s AI use expands and its governance responsibilities require more centralized leadership.
