Who is responsible for AI governance in an organisation?

The board's role in AI governance

Leadership should agree what management can approve, what requires escalation and what evidence will be reported. A supplier, technical team and business owner may each control different parts of an AI use. Record those responsibilities rather than relying on a single broad title. The organisation's duties under the AI Act follow its legal role; directors' individual responsibilities also depend on company law, sectoral rules and the facts.

Operational accountability for AI governance

Below board level, AI governance accountability typically sits with the CEO, Chief Risk Officer, or a nominated AI governance lead. In larger and more AI-intensive organisations, a dedicated Chief AI Officer or Head of AI Governance may hold the role. The operational AI governance lead is responsible for maintaining the AI inventory, implementing the AI use policy, running the risk assessment process, overseeing incident reporting, and producing regular reporting to the board and senior leadership. In smaller organisations, this role is often shared; the CEO holds overall accountability, with the risk or compliance function handling the day-to-day mechanics. What matters is that someone holds the role explicitly, not that every organisation has the same structure.

Legal references reviewed 4 October 2026. High-risk provisions have phased application and transition rules. Sources: Commission timetable, deployer duties, impact-assessment scope and literacy guidance.