Ask five executives at the same company who owns AI governance and you will often get five answers. The CIO says it is a technology matter. The CISO says it is a security matter. Legal says it is a compliance matter. The CEO assumed someone had it covered.
New survey data reported on 12 October suggests that picture is common. It is also where most AI governance failures begin.
What the surveys are saying
CIO Dive reported that PwC's October survey of more than 3,900 business and technology leaders across 71 countries found less than 30 per cent of AI accountability sits with CIOs, CTOs or other technology leaders. About a quarter of organisations have a dedicated AI executive. Seventeen per cent place accountability with the CISO. Half of security leaders named protecting AI as their largest single preparedness gap.
PwC's Tonya Ugoretz was quoted as saying there is not yet one ownership model for AI governance and risk. KPMG's third quarter report, also cited, found 49 per cent of organisations have high-risk use scenarios restricting autonomous agent access, up from 28 per cent a year earlier. KPMG's sample size was not stated, and I could not open PwC's report itself, so treat these figures as reported rather than checked.
A word of scepticism. These are consulting firm surveys, and consulting firms have a commercial interest in organisations feeling unprepared. What the figures do support, in my view, is a simple observation: accountability for AI is spread thin. You do not need a survey to know that. You need only look at who attends your AI steering meetings.
The Australian picture is less clear than it looks
Infor's research with YouGov, released on 7 October, surveyed 2,111 business decision-makers, with 789 in Australia, Japan and Singapore combined. Only 6 per cent of Australian respondents said AI governance, risk or compliance had no single owner, against 21 per cent in Japan. That looks reassuring. It may not be.
This is vendor commissioned research and the Australian sample size was not stated. More to the point, a leader who says "we have an owner" has not necessarily told you the owner has authority, budget or visibility of what is deployed. What tends to happen is that ownership is nominal. A name sits on a policy while the actual decisions are made by whichever team ships the tool.
Who owns AI governance when everyone owns a piece?
There is no single right org chart. But a workable model tends to share four traits.
One executive is accountable for the AI governance outcome, even if many people contribute. That person can say no, or at least escalate, and has a seat where AI investment decisions are made. Technology owns the controls, security owns the threat model and legal owns the obligations. Nobody owns the whole, and that is the gap.
It also helps to separate accountability for the programme from accountability for each system. The programme lead sets standards. Each AI system needs a named business owner who answers for how it behaves. In practice, this tends to be overlooked until a system misbehaves and nobody can say whose decision it was.
A composite scenario
A regional services firm has a customer-facing AI assistant built by marketing, a document tool bought by operations and an agent trialled by IT. A customer complaint reveals the assistant gave wrong advice. Marketing says the model vendor is responsible. IT says it never approved the tool. Legal learns of it from the complaint. Nothing in the firm's records says who was meant to be watching. The problem was never the assistant. It was the absence of an owner.
What This Means for Your Organisation
What we see across organisations is that the ownership conversation is postponed until a trigger event forces it. You can have it earlier and more cheaply. Name an accountable executive. Give them a mandate, a register of AI in use and a regular line to the board. Then assign a business owner to every system on that register. If your answer to "who owns this one" takes more than a minute, that is your first finding.
Key Takeaways
- Reported survey data suggests AI accountability is spread across several executives with no common ownership model.
- Consulting and vendor surveys deserve scepticism, but the underlying pattern of diffuse accountability is easy to verify inside your own organisation.
- One executive should be accountable for the AI governance outcome, with a named business owner for each AI system.
- Nominal ownership is not enough: authority, budget and visibility of what is deployed matter more than the title.
How Trusenta Can Help
- Fractional AI Officer provides an accountable AI lead for organisations that are not ready to hire one full time.
- AI Governance Foundations sets up the ownership model, register and decision rights described above.
- AI Governance records every AI system with its named owner so accountability is visible rather than assumed.
Conclusion
Governance does not fail because nobody cares. It fails because everybody cares a little and nobody has the job. The organisations that handle AI well in the next few years will mostly be the ones that settled who owns it before they needed to know.
