Topic starter
09/07/2026 12:34 pm
TL;DR: AI governance programmes are failing when boards, security, privacy, legal, audit, and engineering share responsibilities without clear decision rights, according to Knostic’s analysis of stakeholder roles, EU AI Act timelines, and NIST/OECD-aligned operating models. The governance gap is not policy volume but auditable ownership, runtime enforcement, and measurable accountability across the AI lifecycle.
Editorial analysis by NHI Mgmt Group, based on content published by Knostic: “Primer: AI Governance Roles and Responsibilities”.
Key questions
Q: How should teams assign accountability in AI governance RACI models?
A: Teams should give each major AI decision a single accountable role, even when many functions are consulted.
Q: Why do AI governance programmes need both policy and runtime controls?
A: Policy defines intent, but runtime controls decide whether that intent is enforced where AI actually operates.
Q: What are the signs that an AI governance RACI is failing?
A: Common signs include duplicated approvals, stalled launches, unclear incident ownership, and evidence that cannot be tied back to a named decision maker.
Practitioner guidance
- Define one accountable owner per AI decision Assign a single accountable role for approvals, exception handling and incident decisions so the same use case does not drift between board, security, privacy and engineering ownership.
- Tie governance artifacts to runtime controls Require that every policy, DPIA or model card is paired with an enforceable control such as PBAC, logging, redaction or platform gating before deployment.
- Map roles to regulatory milestones Update the RACI against EU AI Act dates, NIST guidance and internal rollout stages so ownership changes before obligations become active.
Bottom line: AI governance fails when responsibility is distributed but no single role can defend the decision or the evidence behind it.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
09/07/2026 12:39 pm
AI governance fails when decision rights are shared but not owned: a matrix is only useful if every approval, exception and incident path has a single accountable role. The article shows that board oversight, security controls, privacy review and legal mapping all need distinct ownership, not overlapping consensus. The practitioner lesson is that auditability comes from accountable decisions, not more stakeholders at the table.
A few things that frame the scale:
- 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations align AI governance with both the EU AI Act and NIST AI RMF?
A: Organisations should treat the EU AI Act as the mandatory compliance baseline and the NIST AI RMF as the operational framework that turns governance into repeatable controls. The practical move is to map AI use cases, assess risk, assign ownership, document safeguards, and maintain evidence for audits. That combination helps teams satisfy regulatory obligations while building a defensible AI governance programme.
👉 Read our full editorial: AI governance roles and decision rights need clearer RACI models