AI Governance Explained: Who Decides What in Your Organization

Every AI tool at work raises the same quiet questions: who said yes to it, who checked the data it sees, and who acts when it gets something wrong. AI governance is the set of people, rules and checks that decide which AI an organization uses, for what, and who answers when it goes wrong. It is less a document than a map of decisions: who sets the direction, who says yes to a new use, who checks the risks and the data, who buys the tools, who watches them once they run, and who acts when something breaks. NIST, the US standards agency, puts it plainly in its 2023 AI Risk Management Framework: roles, responsibilities and lines of communication should be documented and clear to everyone in the organization.¹

In a typical setup, leadership sets the direction and carries final responsibility, one named owner approves each new use, and specialists in risk, privacy, IT and legal run the checks. This guide, one of our explainers on AI at work, sets out that map as a plain table, compares three ways to organize it, and shows what a small firm can drop.

Prefer to watch? The video covers the same ground as this article.

VideoAI Governance Explained: Who Decides What at WorkWiserHours

What is AI governance, and where does an AI policy fit?

AI governance is the structure that decides how an organization uses AI; an AI policy is one thing that structure produces. The OECD’s AI Principles, adopted in 2019 and updated in 2024, say organizations developing, deploying or operating AI should be held accountable for its proper functioning, based on their roles and the context.² Governance is how an organization turns that accountability into names and routines.

The difference matters in practice. A policy tells staff which tools and data they may use, and writing the AI use policy itself has its own guide. Governance answers the questions behind it: who wrote the policy, who can change it, who approves an exception, and who notices when people work around it. The gap shows up as shadow AI, the tools staff use without approval: a policy with nobody behind it to say yes quickly is easy to ignore. If finance wants an AI tool that reads invoices, the policy says supplier data needs approval; governance says who approves, how fast, and who checks the tool later.

NIST lists what sits inside the structure. Its Govern function asks for documented policies, an inventory of AI systems, clear roles, staff training, processes for third-party tools and for incidents, and ongoing monitoring with a set review frequency.¹ Those are the main components of an AI governance framework, whatever name a company gives them.

Myth

Once we have an AI policy, our AI governance is done.

Fact

A policy is one output. Governance is the people who write it, approve exceptions, change it and notice when it is ignored.

To test this, ask who could approve a new AI tool for your team tomorrow. If nobody can answer, the rules have no governance behind them.

Who is responsible for AI governance in a company?

Final responsibility sits with senior leadership: NIST’s framework says executive leadership should take responsibility for decisions about AI risks, and names management, senior leadership and the board as the key actors in AI governance.¹ The day-to-day work, though, lands in very different places, and surveys show no settled pattern.

The study

Limited evidence

Asked who leads AI governance, 671 respondents gave no single answer

The IAPP, a professional association for privacy and AI governance, asked respondents which function held primary responsibility for AI governance. Privacy and legal and compliance teams each led in 22% of organizations, IT in 17%, data governance in 10%, with smaller shares for ethics and security teams. About three in four organizations said they were working on AI governance.³

Read the split with care. The survey was run by an association of privacy and AI governance professionals, and its public summary does not say how respondents were found; if many work in privacy, the privacy share may be inflated. The report was also written with Credo AI, which sells AI governance software. The authors’ own reading fits the data: there is no clear best practice for organizing an AI governance team, and AI raises risks that need several functions to work together.³

Picture a mid-sized logistics firm where IT bought a chatbot licence, HR wants AI to screen job applications, and sales has started using an AI note-taker. Each team believes another one is checking. That is the failure governance exists to prevent, and the fix is rarely a new department: it is one accountable name per decision.

A decision map: who typically owns each part of AI governance

AI governance comes down to seven recurring decisions, and each works best with one accountable owner and a few people consulted. The table below is our mapping, built from NIST’s Govern function and Singapore’s Model AI Governance Framework; neither prescribes job titles, so treat the names as typical defaults, not rules.

It uses the RACI method for assigning roles: one Accountable person per row, plus who does the work and who is consulted or told.

Three rows carry most of the weight. Buying matters because most organizations use AI that others built: NIST asks for policies on third-party AI and contingency plans for failures in vendor systems judged high-risk, and it places procurement with people who have financial, legal or policy authority.¹ Monitoring matters because tools change after approval; Singapore’s framework asks for monitoring and reporting so the right level of management knows how deployed AI is performing.⁴ Incident response matters because the first hour is when nobody knows whose problem it is.

Singapore’s framework also lists the roles that can be allocated: assessing and managing the risks of deploying AI, deciding the right level of human involvement in AI-assisted decisions, maintaining and reviewing deployed models, and making sure staff are trained.⁴ If your map has a gap, it is usually one of those.

ISO/IEC 42001, the international standard for AI management systems published in 2023, takes the same approach at the level of a whole system: it specifies what an organization must set up, run and keep improving, built around policies, objectives and the processes that reach them.⁵ Its full text is sold by ISO, so this guide relies only on public summaries of it.

Here is the table at work: when marketing asks for an AI image generator, the AI owner decides, privacy checks whether customer photos go in, IT vets the vendor before anyone signs, and the team reports problems once the tool runs.

Start by filling the rows that are empty today.

Centralized, federated or hybrid: where AI decisions sit

Organizations place AI decisions in one of three broad patterns: a central team decides everything, business units decide within central rules, or the two share the work. Microsoft’s 2026 guidance for teams building AI agents describes all three and says most organizations blend them rather than pick one.⁶ It was written for AI agents, and Microsoft sells AI products, so read it as practitioner guidance, not research.

1. Centralized: one central team sets the rules, delivers the AI work and monitors it (main risk: a queue of requests)
2. Hybrid: central standards, with delivery and oversight shared with teams (main risk: unclear decision rights)
3. Federated: teams own their AI work inside central guardrails; the center steps in by exception (main risk: standards drift)

In the centralized model, one team sets the rules, delivers the AI work and monitors it: consistent and easy to see into, but it becomes a bottleneck as requests grow. In the federated model, business units own their AI work and the center sets guardrails, stepping in only when something falls outside them; it scales, but standards can drift. The hybrid sits between, with central standards and shared delivery, and its risk is coordination: shared ownership needs clear decision rights.⁶

The same guidance suggests choosing by maturity and risk rather than copying another company’s chart. Early on, or for high-risk and customer-facing uses, it favors central control; as teams gain skill and controls can be enforced automatically, more can move outward. Some things stay central in every model, such as the security baseline and data-protection controls.⁶ Singapore’s framework makes a similar point from the ethics side: where relying entirely on a central mechanism is not optimal, a decentralized one can bring ethical judgment into day-to-day decisions, with top management and the board still involved.⁴

Lower-risk useHigher-risk useTeams new to AITeams with skills and guardrails

Teams new to AI, Lower-risk use: Centralbuild skills and standards first

Teams new to AI, Higher-risk use: Centralreview every use

Teams with skills and guardrails, Lower-risk use: Local, inside central rulesfederated or hybrid

Teams with skills and guardrails, Higher-risk use: Central or hybridshared, with clear decision rights

An illustrative case: a bank keeps credit-decision AI under one central review, while letting its marketing team approve its own drafting tools against a central list. That is a hybrid by design. The warning sign is a hybrid by accident, where nobody chose who decides.

So place each decision by its risk. High-stakes uses go to the center; low-risk drafting help can be approved closer to the work.

Does a small business need AI governance?

Yes, but a small business needs only the decisions and can skip the committees. NIST notes that small and mid-sized organizations may face different challenges from large ones, depending on their capabilities and resources.¹

The IAPP report notes that larger companies can split AI governance tasks across several roles, while smaller ones look for people who can cover all of them, and that a formal governance committee may be irrelevant for a small company.³ In a firm of 15, the seven rows may hold only two or three names.

Take an illustrative accounting practice with 12 staff. The managing partner is accountable for strategy and for approving any new AI use. The office manager keeps the list of tools, handles purchases and checks client-data rules with the firm’s external data protection adviser. Each team lead watches how the tools perform in their work and reports problems the same day. That is governance: a short list of names, one approval route and one place to report mistakes, reviewed once a year.

What a small firm should not skip is the incident route. A tool that drafts client emails can send a wrong figure or expose client data, and the first question will be who decides what happens next.

What the law adds, by country

Laws rarely tell organizations how to structure AI governance, but some set duties that need an owner. The EU AI ActEU AI Act: The European Union's law on artificial intelligence, adopted in 2024, which sorts AI uses by risk: some practices are banned, high-risk uses such as screening job applicants carry duties, and others need only transparency. Its duties start on different dates.Full entry in the glossary is the most detailed, and its duties fall on deployers: any organization using AI under its own authority, except for purely personal use.⁷ The rules below are EU law; outside the EU, your obligations depend on national law.

In the EU, once the high-risk rules apply, organizations that deploy high-risk AI, which includes many uses in hiring and managing workers, must give the job of human oversight to staff who have the competence, training and authority it needs. They must monitor the system, keep its logs for at least six months unless other law says otherwise, report serious incidents to the provider and authorities, and, as employers, tell workers’ representatives and the workers affected before such a system is used at work.⁷ The July 2026 amendment moved the start of these high-risk rules from 2 August 2026 to 2 December 2027 for uses such as employment.⁸ The same amendment softened, but kept, a duty that already applies: providers and deployers must take measures to support the AI literacyAI literacy: The skills, knowledge and understanding to use AI systems in an informed way, including how they work, where they fail and how to check what they produce. In the EU, the AI Act requires organizations that provide or use AI to take steps on their staff's AI literacy.Full entry in the glossary of staff who operate or use AI for them.⁸

Each of those duties maps onto a row of the table: oversight onto approval and monitoring, incident reporting onto incident response, and the worker notice onto whoever owns AI use in HR. For the full timeline, see the EU AI Act’s risk tiers and deadlines.

Outside the EU, much official guidance is voluntary. NIST’s framework is voluntary in the US.¹ Singapore’s model framework, also voluntary, says adopting it does not exempt organizations from existing laws.⁴ Wherever you are, check what your national data protection regulator and any sector regulator require.

When to bring in a lawyer:

• Now: if an AI tool may have harmed someone or exposed personal data, involve your legal adviser or data protection officer the same day; in the EU, serious incidents with high-risk systems must be reported once the high-risk rules apply (from December 2027 for uses such as employment).
• Soon: before AI helps decide who is hired, how people are paid or how their work is rated, ask whether that use counts as high-risk where you operate and what notice workers must get.
• Routine: at each annual review, confirm which national rules cover the places where your staff and customers are.

The bottom line

AI governance is a list of decisions with a name next to each: strategy, approving uses, assessing risk, data, buying, monitoring and incidents. Surveys show no standard owner, so choose yours on purpose, give each decision one accountable person, and keep high-risk uses under central review. A small firm can do this on one page, as long as the incident route is on it.