WHAT’S INSIDE
Governance Is Established When a Named Party Can Say No and Make It Hold
Every function in the organization has a plausible claim to AI governance. Legal owns regulatory exposure, cybersecurity owns the threat surface, compliance owns the control framework, risk owns the register, and the data teams own the models. The result in most organizations is that everyone participates and no one decides; deployments proceed on the path of least resistance, and the governance question surfaces only after something has shipped.
This guide sets out the six ownership models in current practice, the decision rights that must be assigned regardless of model, the criteria for choosing among them, and the failure patterns that predict which structures will not hold, framed throughout by the ARISE Framework™, in which ownership is the first artifact of the GOVERN domain. IBM’s 2025 research found that 97 percent of organizations with an AI-related breach lacked AI access controls, the kind of control that exists only where someone is accountable for it.
The decision rights that must land somewhere. Six decisions recur in every organization deploying AI: approval to deploy, risk acceptance, policy and standards, vendor and procurement gates, incident authority, and budget, each of which must name one accountable party in a single sentence.
The six operating models. CISO-led, legal or compliance-led, risk-led, data and AI function-led, the dedicated AI governance office, and the federated committee, each with the context it fits and the failure mode to watch for, including why a committee without authority is the most common failure.
A five-step path to settled ownership. A sequence aligned to ARISE: name the decisions, choose the model deliberately, build the RACI beneath it, place compliance at intake rather than at pre-deployment review, and test the structure against live scenarios before validating it annually.
Appendix A, the decision-rights worksheet. Eleven questions completed in a single leadership session across authority today and structure and placement, where the only acceptable answer is one named role and “the committee,” “it depends,” or silence are themselves findings.
