AI governance: how executives own AI risk, policy and oversight

By Risk With Context editorial · Published 2026-11-06

AI governance is the set of decisions, roles and controls that decide how an organisation builds, buys and uses AI, and who answers for the risk. It covers ownership, policy, risk and impact assessment, compliance with laws such as the EU AI Act, and the reporting that lets a board see whether AI is being used safely.

What is AI governance?

AI governance turns general principles such as fairness, security and transparency into named owners, written policies, approval steps and reporting. The aim is simple: any use of AI in the organisation can be traced to a decision, a person who made it, and the evidence that its risks were considered, so that AI use is checked rather than assumed.

In practice it sits between several existing functions. Privacy teams care about the personal data that models are trained on or fed. Legal teams care about contracts, liability and new AI laws. Security teams care about attacks on models, leaked prompts and agents that act with too much access. Governance is the layer that makes these groups work from one inventory, one risk method and one set of decisions.

In IAPP research, 77% of surveyed organisations were working on AI governance, rising to near 90% of those already using AI (source).

Who should own AI governance in a company?

AI governance works best with one named executive owner who has authority across privacy, legal, security and the business units that use AI. The owner does not do all the work; they chair the decisions, hold the inventory of AI systems and report to the board. With several partial owners, each function tends to govern only its own slice of the risk.

Today ownership is spread thin. When the IAPP asked which function holds primary responsibility, privacy and legal and compliance led at 22% each, while security held it in only 5% of surveyed organisations (source). In the view of this site, that gap matters, because risks such as prompt injection, model theft and over-permissioned agents are security problems first.

A regulated firm may give ownership to its chief risk officer, a software company to its technology leadership, and an organisation deploying AI agents at scale to its security leader.

What does an AI governance operating model include?

An AI governance operating model is the machinery that makes decisions repeatable: a cross-functional AI committee, an inventory of every AI system in use, a risk tiering method, an approval path for new use cases, and a reporting rhythm to executives and the board. It defines who proposes, who assesses, who approves and who monitors.

A workable first version has five parts, each with a measure the board can follow:

Which AI policies does an organisation need first?

Start with three policies: an acceptable use policy for employees, a policy for approving new AI systems and vendors, and a data policy that says which information may be used with which AI tools. Together they address two avoidable failures: staff pasting confidential data into public tools, and teams deploying AI with no review.

Later policies can cover model development standards, human oversight for high-impact decisions, incident response for AI failures, and records management for the evidence regulators may request. Each policy should name an owner and a review date, and should point to the approval path in the operating model rather than repeating it.

How do you assess AI risk and impact before deployment?

An AI risk assessment checks a proposed use case before launch against a fixed set of questions: what data it uses, who it affects, what decisions it makes or influences, how it could be attacked or misused, and what happens when it is wrong. The result sets the risk tier and the controls required, and the decision is recorded.

Pre-deployment review has spread quickly. In the World Economic Forum’s survey, the share of organisations with a process to assess the security of AI tools before deploying them rose from 37% in 2025 to 64% in 2026 (source). Thorough assessments combine security testing, a privacy impact assessment where personal data is involved, and a fairness or impact review where people could be harmed by an automated decision.

Which laws and standards shape AI governance: the EU AI Act, ISO/IEC 42001 and NIST AI RMF?

Three references matter most for an executive: the EU AI Act, which sets legal duties by risk level; ISO/IEC 42001, a management system standard for AI; and the NIST AI Risk Management Framework, built on four functions: govern, map, measure and manage. A practical approach is to run the programme on NIST or ISO and use the AI Act for minimum legal duties.

The EU AI Act. The Act applies in stages, and the high-risk dates moved in 2026 (source):

By the first high-risk date, an organisation using AI in hiring or credit decisions should know which of its systems fall into Annex III and who is responsible for each.

The Act is not only for European companies. It also covers providers and deployers established outside the EU where the output produced by their AI system is used in the Union (source). For prohibited practices, fines can reach EUR 35 million or, for companies, 7% of total worldwide annual turnover for the preceding financial year, whichever is higher (source); smaller companies face lower caps.

The standards. ISO/IEC 42001 was published in December 2023 (source) and sets out requirements for an AI management system. The NIST AI Risk Management Framework was released on January 26, 2023 (source); its core describes four functions, GOVERN, MAP, MEASURE and MANAGE, to help organisations address the risks of AI systems in practice (source).

Rules outside the EU. Laws aimed at specific uses of AI also matter. New York City’s Local Law 144 of 2021 prohibits employers from using an automated employment decision tool unless it has had a bias audit within one year of use, the audit information is public, and candidates or employees have been notified (source). Because rules like this attach to a use rather than to a technology, the inventory should record where and for what each AI system is used.

How should the board oversee AI?

A board oversees AI by approving the organisation’s appetite for AI risk, knowing which high-risk AI systems are in use, and receiving regular reporting on incidents, compliance and the results of risk assessments. Directors do not need to understand model architectures, but they must be able to ask who owns AI risk and see evidence that controls work.

The right column of the operating model table above is a good starting set for board reporting. Beyond the numbers, these are the questions a director can put to management:

1. Who is the single named owner of AI risk, and what can they stop?
2. How many AI systems are in use, including AI features switched on inside software the organisation already buys?
3. Which of them make or shape decisions about people, such as hiring, credit or access?
4. Which systems fall into a category with a legal deadline, and is the organisation on track for it?
5. What happened to the last use case that failed review?
6. What would management do in the first 24 hours if an AI system leaked data or made a harmful decision?
7. Which vendors process the organisation’s data with AI, and what do their contracts allow?
8. When did the board last see a report on AI incidents and near misses?

What does a Chief AI Officer do, and how does the role relate to the CISO?

A Chief AI Officer leads the organisation’s use of AI: strategy, adoption and the value AI delivers. The role can also chair AI governance. The CISO, by contrast, owns the security of AI systems and the data they touch. The two roles work best with a clear split: the CAIO decides where AI is used, and security decides whether it is safe enough to use.

The role is spreading. IBM reports that 76% of surveyed organisations had a Chief AI Officer in 2026, up from 26% in 2025 (source). In the United States federal government, a White House memorandum requires the head of each agency to retain or designate a Chief AI Officer within 60 days of the memorandum’s issuance (source).

Risk With Context offers an AI governance lead engagement.