Who owns AI governance in a regulated company?

AI governance is the set of decisions and controls that decide which AI systems a regulated company may use, how they are checked, and who answers when one fails. The third question is the one this page is about, and it has to be settled before an AI system fails, not after. See what AI governance is for the full picture.

• The board: holds accountability for AI risk and oversight.
• A named executive: runs the program day to day and is the person others go to.
• The DPO: carries the data protection part where an AI system processes personal data. Under Article 39 of the GDPR, the DPO informs, advises and monitors compliance, including on data protection impact assessments.
• The CISO: carries the security part of the AI systems and the data they use.
• The business owner of each AI system: carries the part for the system their team uses.

A committee can coordinate this work. It cannot carry the accountability, so the program needs a named person at its head.

Programs break when ownership sits with a group rather than a person. Everyone attends the meeting, nobody holds the decision, and when an AI system misbehaves no one knows who may act. ISO/IEC 42001 makes the same point in its leadership clause: top management assigns the responsibilities and authorities for the AI management system (clause 5.3). See the ISO 42001 guide.

Ask who can turn an AI system off on a Friday evening, and whether that person knows they have the authority to act. If the answer is a committee, the program is not ready yet. If it is a named person who can reach the right people, the program is working.

For high-risk AI systems, Article 26 of the EU AI Act puts the duty on the deployer, the company that uses the system:

• Article 26(2): assign human oversight to natural persons who have the necessary competence, training and authority, as well as the necessary support.
• Article 26(5): monitor the operation of the system on the basis of the instructions for use. Where the use may present a risk, inform the provider or distributor and the market surveillance authority without undue delay and suspend the use of the system.

After Regulation (EU) 2026/1744, the high-risk obligations apply to standalone Annex III systems from 2 December 2027. See the EU AI Act guide.

In AI Governance in Acuna GRC, each AI system has its overseers. Each assignment records a person from your organization, the kind of oversight, whether they can override an outcome or suspend the system, a competence basis and an effective-from date. Both authority boxes are off unless ticked. The No overseer at all and Nobody can stop it lenses show the systems that fail the Friday test, and every AI incident has an owner. See AI Governance in Acuna GRC.