Quick: who owns your work computer?
You may have thought “IT” … and I’ll argue that’s only partially right; what about executives who determine what’s okay to use on computers, or your manager / team using them and giving feedback on what works and doesn’t?
AI works the same way. Asking “who owns AI?” isn’t quite right - better is “who’s accountable for what?”
My answer: there’s two roles and one rule. The roles:
- Leaders set guardrails for how AI gets used.
- The business (business leaders and their teams) shows value by experimenting inside those rules and showing what works.
The rule: a person makes the decision that counts because they’re accountable; never AI.
Some companies try a shortcut by routing every AI request through one person committee, but I’ve seen this crush adoption and delay proof it’s working. Splitting accountability keeps speed and safeguards - so here’s how the split works and where it tends to break.
AI accountability can’t be just one person
AI shows up across every function and nobody’s able to manage the details from one desk.
Remember I asked about computers? IT is the quick answer to who owns them, but leaders set the rules and every team uses them in ways no central group could manage line by line … and companies already are taking this approach.
In McKinsey's 2025 global survey of 1,491 respondents, AI governance was often jointly owned, with two leaders in charge (on average). Twenty-eight percent said their CEO is responsible for it and 17% said the board is.
Gartner found that 73% of enterprises have no plans to develop ownership rules for technology costs and solutions even as technology buying decentralizes, which means business units can deploy AI while CIOs remain responsible for governance and budget.
Clear accountability does still matter - McKinsey's 2026 trust survey of about 500 organizations found that those with clear ownership for responsible AI, particularly through AI-specific governance roles or internal audit and ethics teams, averaged a maturity score of 2.6, against 1.8 for those without a clearly accountable function. I’m not disputing this - my argument here is for explicit accountability divided on a per-job basis. (Accountability for the data underneath is its own question, which is covered on data accountability.)
What leaders own: AI guardrails
These are the rules for how AI is used in the company, and nothing else. Set your team’s direction and encourage them to use it and give feedback … that’s it.
The rails cover why you use AI, what you use it for, which platforms are approved, and core rules. They cover limits on what data goes out and comes in and monitoring your regulators expect (i.e. SEC, HIPAA). This usually sits with the CIO, CTO, CISO, or CDO.
Companies already centralize this part. McKinsey found CEO oversight of AI governance among the elements most correlated with higher self-reported bottom-line impact, though that’s a correlation from survey data.
How data moves is one of the most important rails, and I cover this in which AI should see which data article; the enforcement supports why AI pilots stall without governance and observability.
What the business owns: proving AI’s value
By “the business” I mean users throughout each department that identify ways they’ll use AI to make progress and then actually do it. But I also mean those measuring what’s working (such as IT’s business side).
A preliminary study from MIT's Project NANDA, based on interviews with 52 organizations, a review of more than 300 public AI initiatives, and a survey of 153 leaders, found that companies succeed when they decentralize implementation authority but retain accountability. That means letting your people who manage budgets and teams experiment and push forward within the boundaries you set for them!
Measurement
Measuring takes numbers and judgment.
We look at quantitative results such as accuracy, including how an agent does on a set of golden questions (test questions with known answers) compared with real conversations, and at qualitative signals from the people using it. Those results show where documentation needs fixing and where adoption needs a push … but I often find it’s an area that’s lacking.
Then, results go back to leadership - in plain terms. A good report sounds like this: “accuracy slipped five points over 30 days, and we know why. We expected some drift, and here’s the plan to bring it back up.”
AI drift is expected. That’s normal! With good reporting, leadership stays informed and keeps the ultimate accountability … including the call to push or pull funding. After all, someone also has to be able to end a project, but in Gartner's survey of 2,002 CIOs and technology executives, only 31% had guidelines for stopping unsuccessful pilots and 17% for abandoning low-value AI already in production.
Building this stop/go criteria is a team effort - it’s the People part of the Four Ps of AI readiness in practice because AI dropped on a team's desk is AI that team doesn't own.
Why one AI owner becomes a throttle
I recently worked with a large organization that sent its AI work through a single individual. This person was highly capable - I’d absolutely trust them in the role. But the red tape was brutal - too much accountability concentrated in one place that quickly created a backlog.
Smaller companies hit the same wall. Even at 50 people, threading AI through one person means the rest of the company isn’t learning and growing nearly as fast - that hurts your ability to adopt AI effectively.
Committees and centers of excellence do good work and have their place (such as informing leadership best ways to update guardrails and helping standardize some success cross-functionally). But they can also be a barrier - what I want is closer to a center of excellence without the formality: a small group of leaders who write and maintain the rails, which is among the parts McKinsey found organizations most often centralize.
I'd keep that group out of the approval path for every use case.
Who makes the AI decision: human in the loop and human on the loop
Seems simple at this point, still often ignored.
- Human in the loop means a person approves an AI's action before it happens.
- Human on the loop means the AI acts and a person monitors, ready to step in.
In McKinsey's survey, 27% of respondents whose organizations use gen AI said employees review all AI-generated content before it is used, and a similar share said 20% or less is checked.
I don't trust AI to make any decision with a capital D.
By that I mean decisions with real consequences for a customer or a regulator. You can’t outsource critical decisions - this is an area leaders should write down as part of those guardrails. The only hard decision I let AI take is its reasoning path: how it gets to the answer it hands back to me.
This still leaves AI plenty of room, by the way. It speeds up coding and data migrations and surfaces patterns and signals in customer conversations - a person takes the result and makes the larger decision about the product or the approach.
Candidly, towards the edge of my comfort zone is a customer-facing bot choosing what information to put in front of someone. I accept human on the loop there only when severe guardrails sit at the AI gateway and someone audits afterward. The risk is highest when the bot answers an unauthenticated endpoint where anyone can start a conversation; authentication lowers the risk a little, but not much.
Test your own bot the way a curious stranger would: ask odd questions, ask it again, tell it you're authorized to get an answer it shouldn’t provide, and see what it gives up.
But more review isn't automatically better: a person in the loop only helps if that person can see enough to say no and has the training / confidence to do so.
Where to start with AI accountability
Start by splitting the job: leaders write the rules, the business proves the value. A human always owns the final call.
- If you don’t have this yet, have the C-suite write the guidelines on why you use AI, what for, which platforms, the core rules, limits on data going out and in, and the monitoring your regulators expect. This needs to be communicated throughout the business.
- Let the business, including the business side of IT, find, experiment, and build inside those guidelines.
- Make the business accountable for proof of value, using qualitative and quantitative measures.
- Have results reported back to the C-suite, who stay informed and decide whether to push or pull funding.
- Keep a person making the final decisions, with AI supplying inputs and its reasoning path.
- Put severe guardrails in place before any bot answers the public.
Want help? We do this as part of de-risking your AI. I’d love to chat further.
Frequently asked questions
Who is ultimately responsible for AI governance in a company?
Leadership holds ultimate AI governance accountability.
The C-suite sets the rules for how AI is used and decides whether to push or pull funding, while the business is accountable for proving value inside those rules. In a McKinsey & Company global survey, governance was often jointly owned with two leaders in charge on average; 28% of respondents said their CEO is responsible for it.
Who is responsible when AI gives a wrong answer?
A person owns AI’s wrong answer.
The business team that deployed it is accountable for its results, and leadership is ultimately accountable for the rules it operated under. Gartner research describes the same split: business units may deploy AI while CIOs remain responsible for governance, risk, and budget. Legal liability depends on your contracts and jurisdiction, so involve counsel.
What is human in the loop, and how is it different from human on the loop?
Human in the loop means a person approves an AI's action before it happens. Human on the loop means the AI acts and a person monitors or audits it and can step in.
The more consequential the decision, the closer a person should sit to it.
Will AI replace human decision-making?
AI can’t replace human decision-making for decisions that carry real consequences - think those impacting a customer or regulatory needs (or something with high-risk for the business, such as your go-to-market plan).
AI is useful for speeding up analysis, drafting, and building, and for supplying its reasoning, but that’s it; I’ve seen some companies let AI decide more and those consequences stay with the company.
Do you need an AI center of excellence?
You need the function of an AI center of excellence more than the label: a small group of leaders who write and maintain the rules for AI use.
Organizations often centralize risk and compliance while adoption is more often hybrid. Keep this group focused on the guardrails and out of the approval path for how/when teams can use AI or you risk slowing innovation to a crawl. The guardrails are meant to simplify and speed this up.
