Too many chiefs: who actually owns AI governance?

8 October 2026

Emma Di iorio | CEO & Co-founder, Spriggun

A hybrid unicorn is the ideal person to lead AI governance. They have: enough business fluency to sit in an executive conversation, enough legal and regulatory understanding to navigate the patchwork across jurisdictions, enough governance experience to have built and run a programme, and enough technical literacy to know what the AI tools are doing without needing to build them. That person exists, but there are not many of them. Only thirty-eight percent of enterprises have appointed a Chief AI Officer (CAIO), and credentials are getting ahead of experience; an executive course or a master's programme is not the same as having governed AI inside a regulated business. The false promises around AI readiness are, if anything, worse than those that emerged in the market before GDPR.

Most organisations will not have a dedicated CAIO. The question for every board is: who carries the accountability, and who carries the day-to-day responsibility for AI governance?

Demands of the role

There must be a named, accountable executive. A committee does not equal accountability; it leads to no final decision-maker and finger-pointing when something goes wrong. No one is immune to a major data breach or AI failure.

Two structures work: a dedicated CAIO with their own team, or an adjacent executive who holds the accountability while the day-to-day leadership authority sits one level down with someone who has the depth and the team to do the work. Either way, the three lines of defence hold: the business owns and manages its AI risk; a governance function oversees and challenges; internal audit provides independent assurance. Collapse those lines, and the independence that the role requires disappears too.

The title must be more than a title. If the board grants the title without the authority to make change, without a budget, and without a team; the appointment is decoration. When progress, business benefit and speed are not found in two or four quarters, replacing that person with another to do the same achieves nothing.

The board holds ultimate accountability. Boards still reliant on one tech-fluent director and one tech-focused executive to cover AI have a gap of their own to close. AI governance cuts across regulatory, legal, commercial, and operational territory; it is not a technical matter a single director can absorb. It is a major, long term, organisational shift.

The role-holder must do several things that sit uncomfortably together. They need independence from the business decisions they are assessing: the willingness to tell the board the data is not ready or that the vendor's promises do not survive scrutiny. They need to assess risk and opportunity at the same time; governance that only sees risk is defensive, governance that only sees reward is reckless. They need the regulatory, commercial and operational picture in one view. Most of the alternatives the market is promoting - CISO, CIO, CTO - do not meet this need.

There is real urgency here, not least because many are already doing someone else's job; from slight blurring to full smushing of the lines. OpenAI's own research found that forty-three percent of occupation-specific AI use was cross-occupation; over half of legal-related interactions came from non-lawyers. From experience, the work to clear up a non-lawyer's legal advice takes many times as long as a lawyer giving it directly; especially where product managers or technical leads have signed off on decisions on the basis of their own 'legal advice', often while insisting otherwise. These blurred boundaries make the need for real governance more pressing.

What does not work

Several of the models gaining traction look like governance from a distance, but most share the same structural flaw: the person is not independent of the decisions AI governance needs to assess.

• The CISO carries security risk, not business-wide risk; and is too close to the data and the threats for the independent view the role requires. The approach to governance is likely to narrow to data security and threat response, with the commercial and regulatory picture dropping away. CISOs are not appointed as data protection officers for the same reason.

• The CTO or CIO has proximity to the technology, which is the disqualifier. Technology leaders are judged on delivering return on investment, without independence from the business decisions being assessed.

• The CDAO or CDO owns data lineage and quality, but is judged on accelerating the use of data; data governance is one part of AI governance, and going slow to go fast is a genuine option for AI governance, a difficult one for those in these positions to take.

• A committee stands in for a single accountable executive. Accountability that sits with everyone sits with no one. When a major breach slows the business, the cross-fire blame kicks off, and the three ticking regulatory deadlines have space for one person, not six.

With all of the above positions, there is real pressure for those in these specific roles to jump on the business benefit, sometimes to the detriment of full consideration of the risks. No one who has been presiding over the company's data for years wants to tell the board that data is not actually fit for the use cases proposed for major investment. The issue is not poor data quality or bad workmanship; rather, modern AI models require the data to be used in ways that were never anticipated when originally collected.

Self-governance, where the business decides its own boundaries without external accountability, gives inconsistent results and crumbles on regulatory contact. Algorithmic consensus, where the AI is used to assess the AI, also puts blame on a solution rather than a human; not possible. Neither addresses actual risk of harm.

Who is best placed?

A CAIO, if the role is structured for governance rather than acceleration. If there is no CAIO, the executive closest to the work in most organisations is the COO, provided the role is structured with the right support. The COO sits across the operational landscape, but AI governance requires regulatory and legal depth the COO may not carry alone. That means a close working relationship with the CLO for regulatory and legal judgement, and the CIO for the technical picture. The COO holds the accountability; the CLO and CIO hold the specialist input. That is a viable structure, if properly named and resourced.

The person carrying the day-to-day work under the executive is, in many organisations, the privacy leader. The privacy function was built to assess risk before deployment, advise across departments rather than own the technology, document accountability in a form a regulator will accept, and maintain independence from the business decisions being assessed. A privacy leader who has set up a programme from scratch has done the cross-functional coordination AI governance demands; the reporting lines, executive access, and regulatory relationships are already in place. The EFDPO and Trilateral Research have each made the case: the DPO, Chief Privacy Officer, or privacy functional head is the natural candidate, given the structural overlap between privacy and AI Act requirements.

The fit is genuine, but it is not a small ask. Median privacy team size fell from eight to five in the past year; forty-three percent call their budget inadequate; many have received no AI-specific training at all. Asking a function to absorb AI governance without the headcount, the budget or the training to carry it is not governance. Indeed, the board pushing risk downward without understanding the size of that risk, or its ultimate accountability for it, poses great risk. Not every privacy leader wants the role or is comfortable with the technical territory; that is not a failure. Whether it is a good fit, in part, depends on whether the current role extends beyond compliance to business enablement.

The first step, whatever the structure, is working towards what Spriggun calls a Minimal Defensible Position: governance that can withstand regulatory scrutiny today, while the programme matures. Everything else is built from that.

The regulatory landscape

The regulatory landscape for AI is a patchwork. AI-specific, privacy, cyber and sectoral requirements overlap and are developing at different speeds; in the EU alone, a regulated business can trigger the AI Act, GDPR, NIS2, DORA and sector-specific rules simultaneously. The UK relies on UK GDPR, the NIS Regulations and the forthcoming Cyber Security and Resilience Bill alongside active sector regulators, without an AI-specific statute. The US has no federal legislation. China and South Korea have enacted targeted legislation; Brazil's is in progress; and most others rely on existing privacy and sectoral law. The EU AI Act is the most prescriptive, with requirements beyond what the privacy function was built for; this patchwork needs regulatory depth, jurisdictional fluency, and independence.

History is repeating itself. Before GDPR, vendors promised readiness and organisations bought misplaced confidence; those promises fell through once enforcement began. The same is happening with responsible AI. Vendors marketing tools as 'GDPR compliant' and 'EU AI Act compliant' are no more credible with an ISO certificate behind them. If the organisation does not know what it is using, and what it is subject to, a compliance tool cannot help.

Leadership decisions

The board cannot hand over its own liability when appointing someone to lead AI governance. Whether the answer is a COO supported by a CLO and CIO; a privacy leader carrying the day-to-day under an accountable executive; or another named structure, the decision must be explicit: who holds the accountability, what authority backs it, and what resources follow. As this series has argued from the start: governance done properly is business; where it sits as a separate function, it is decoration. Not making a decision is making a decision, and doing so means the person leading is carrying the risk with their hands tied, a recipe for losing good leaders. It is not governance.

A dedicated Chief AI Officer, done properly, is the ideal. Many organisations will not have one. Effective governance is not optional; acknowledge, scope and resource it.

Emma Di Iorio is Co-Founder and CEO of Spriggun, a UK-based RegTech and AI governance advisory firm. A qualified solicitor with senior in-house and advisory experience, she writes and speaks internationally on AI, data, privacy, and web compliance.