Whenever I speak to companies about AI governance, I keep hearing the same answers. IT is responsible. No, Legal owns it.The project manager is leading the implementation. The developers built it. The reality is that none of these answers is entirely wrong. But none of them is entirely right either.

At the same time, governments around the world are moving quickly. The European Union has introduced the EU AI Act, while countries such as the United Kingdom, Canada, Australia, Singapore and Japan are developing their own regulatory or governance frameworks. In the United States, organizations are navigating an increasingly complex mix of state laws, sector-specific requirements and regulatory enforcement. Regardless of where a business operates, one thing is becoming clear: AI governance is no longer optional.

But here's what I find interesting. While so much attention is being given to the laws themselves, far less attention is being paid to a much more practical question - Who is actually responsible for AI inside the organization?

AI Governance Is Not a Department

‍

The temptation to assign AI governance to a single department is understandable. Artificial intelligence is, after all, a form of technology. It is also increasingly regulated. That naturally leads many organizations to conclude that AI governance should sit with either IT or Legal.

In practice, however, neither department sees the full picture.

Legal can interpret legislation, but it does not decide how employees use AI on a daily basis. IT can implement technical controls, but it cannot determine whether AI-generated content is accurate, appropriate or aligned with business objectives. HR may develop internal guidance, yet it cannot assess the cybersecurity of an AI platform. Procurement can perform vendor due diligence, but it is rarely the team deciding how the technology will ultimately be used. Well, the reality is much simpler.

AI no longer belongs to one function because it's no longer used by one function.

It supports recruitment, marketing, finance, software development, customer service and countless everyday business decisions. Every department interacts with AI differently, creates different risks and contributes to different outcomes. As AI becomes embedded across the organization, governance must evolve in the same way.

This doesn't mean everyone owns AI governance. Quite the opposite. Effective governance depends on clearly defining who is responsible for each decision, process and control. Leadership sets the direction, legal advises on regulatory obligations, IT secures the technology and HR establishes internal standards. And so, business teams remain accountable for how AI is used within their functions.

When these responsibilities are clearly allocated, AI governance becomes part of the way an organization operates rather than a document sitting in a shared folder.

‍

Defining AI Governance Roles Across the Organization

Once organizations accept that AI governance can't within one department, the next challenge becomes much more practical - who is actually responsible for what?

This is where many AI governance frameworks begin to fall apart. Not because people are unwilling to take responsibility, but because responsibilities are never clearly defined. Leadership assumes Legal is overseeing AI. Legal assumes IT has approved the technology. IT assumes the business has assessed the risks. Meanwhile, employees are already using AI in their day-to-day work.

Good AI governance removes those assumptions. Every department has a role to play, but those roles are different.

Leadership

AI governance starts at the top. Leadership decides how AI supports the organization's strategy, how much risk the business is prepared to accept and how governance is embedded into everyday operations. Without visible support from leadership, AI governance quickly becomes another policy that nobody reads.

Legal & Compliance

Legal provides the regulatory lens. That includes monitoring legal developments, advising on applicable laws, reviewing contracts, supporting high-risk AI use cases and helping the business understand where the legal boundaries are. Legal should enable responsible innovation, not become a bottleneck every time someone wants to use AI.

IT & Cybersecurity

IT creates the technical foundations for responsible AI. That includes approving AI platforms, protecting company data, managing access, implementing security controls and monitoring the organization's technical environment. AI governance is just as much about secure implementation as it is about compliance.

Procurement

Many organizations overlook Procurement when discussing AI governance, yet this is often where AI enters the business. Procurement should assess AI vendors, carry out appropriate due diligence, understand what data is processed and work closely with Legal to ensure the right contractual protections are in place.

Human Resources

HR plays an increasingly important role as AI becomes part of everyday work. From recruitment and performance management to employee training and internal guidance, HR helps ensure that AI is used responsibly and consistently across the workforce. In many organizations, HR will also own or co-own the internal AI Policy.

Development Teams

Where organizations develop or customise AI solutions, development teams are responsible for building them responsibly. That includes testing, documenting, validating outputs, escalating technical concerns and ensuring appropriate human oversight throughout the development process.

Business Functions

Marketing, Finance, Sales, Customer Service, Operations and every other business function remain accountable for how AI is used within their own teams. AI can support decision-making, but it should never replace professional judgement. Employees must understand the limitations of AI, verify important outputs and know when to escalate concerns.

Most importantly, AI governance isn't about making everyone responsible for everything but making sure everyone understands the responsibilities that belong to them. That's how governance moves beyond a policy and becomes part of the way an organization actually works.

‍

Building an AI Governance Framework: Where to Start

Companies often draft an AI Policy, publish it on the intranet, ask employees to acknowledge it and consider the project complete. In reality, that is only the beginning.

An effective AI governance framework is made up of several different components that work together. Some focus on governance, others on day-to-day use, while others help organizations manage legal, operational and cybersecurity risks as AI continues to evolve.

‍

At a minimum, organizations should consider the following:

AI Governance Framework

This is your blueprint. It should clearly set out:

• The organization's overall approach to AI governance.
• Roles and responsibilities across the business.
• Who makes key decisions.
• How AI risks are identified, assessed and managed.
• How different departments work together.

AI Policy

This is the document employees will interact with most often. It should explain:

• Which AI tools may be used.
• Which AI tools are prohibited or require approval.
• What information must never be entered into AI.
• When human review is required.
• Where employees should go if they have questions or concerns.

AI Risk Assessment

Not every AI use case creates the same level of risk. Before introducing AI, organizations should consider:

• Is personal data involved?
• Will confidential business information be processed?
• Are there intellectual property concerns?
• Could the AI produce biased or inaccurate outputs?
• What would be the impact if something went wrong?

AI Vendor Management

Many organizations don't build AI - they buy it. That makes vendor governance just as important.
Before introducing a new AI solution, consider:

• How does the vendor process data?
• Where is the data stored?
• What security measures are in place?
• Are contractual protections sufficient?
• Does the vendor meet your organization's compliance standards?

AI Approval Process

Without a clear approval process, AI quickly enters the business through the back door.
Define:

• Who can request a new AI tool.
• Who reviews the request.
• When Legal should be involved.
• When IT or Cybersecurity should be involved.
• Who gives the final approval.

AI Training

Even the best AI governance framework won't work if employees don't understand it.
Training should help employees:

• Use AI responsibly.
• Recognise its limitations.
• Protect confidential information.
• Understand when human judgement is still required.
• Know how and where to report concerns.

Monitoring and Continuous Improvement

AI governance isn't a one-off project.
Organizations should regularly:

• Review how AI is being used.
• Update policies and guidance.
• Monitor legal and regulatory developments.
• Assess new AI tools.
• Learn from incidents and continuously improve their governance framework.

At the end of the day, AI governance isn't measured by the number of policies an organization has. It's measured by whether people know what to do, who to involve and how to make good decisions when AI becomes part of their everyday work.

‍

AI Governance Is About People, Not Technology

Organizations often spend months evaluating AI platforms, comparing features and discussing which tool to introduce next. AI has quickly become the shiny new toy every business wants to have. Yet, far less time is usually spent preparing the people who will actually use it. That's where AI governance begins.

Knowing what to do doesn't happen by accident. It comes from leadership, clear expectations, practical training and a culture where people understand both the opportunities and the limitations of artificial intelligence. Despite its name, AI governance has never really been about technology alone. Why? Because technology doesn't decide whether confidential information should be uploaded into a chatbot. It doesn't choose to rely on AI-generated content without checking the facts. It doesn't determine whether AI should be used to screen candidates, analyse contracts or support business decisions. People make those choices every single day.

The purpose of AI governance isn't to replace human judgement. Quite the opposite. It exists to strengthen it by giving people clear guidance, practical processes and the confidence to make informed decisions.

Artificial intelligence still needs human intelligence.

The biggest risk isn't that organizations are adopting AI. It's that many are adopting it faster than they are preparing their people. No AI Policy, governance framework or technical safeguard can compensate for unclear responsibilities, poor judgement or a workforce that has never been shown how to use AI responsibly.

Technology will continue to evolve. There will always be another model, another platform and another headline promising to change everything. So... don't build your organization around the latest AI trend. Build an organization where people know how to question AI, challenge its outputs and use it responsibly. Technology will always evolve. Good judgement never goes out of style.

‍