AI risk ownership: what governance gap are teams missing?

TL;DR: 92% of organisations use AI in day-to-day operations, but only 42% have a formal AI policy, 38% have assigned an owner for AI risk, and 59% of security leaders do not know how fast they could shut down a compromised system, according to Lumenova AI. The gap is no longer about adoption; it is about accountable control of AI systems already embedded in business operations.

Editorial analysis by NHI Mgmt Group, based on content published by Lumenova AI: “ISACA Poll: AI Risk Ownership Is the Missing Link in Enterprise AI Governance”.

By the numbers:

• 92% of organisations now use AI in day-to-day operations, but only 42% have a formal, comprehensive AI policy guiding how employees actually use it.
• Only 38% of enterprises have assigned a specific executive or board member to own AI risk, leaving AI risk ownership undefined.
• 59% of security leaders do not know how quickly they could shut down an AI system if one were compromised.

Key questions

Q: What breaks when AI adoption outpaces governance?

A: What breaks first is attribution.

Q: Why does AI risk ownership matter more than more policy documents?

A: Ownership matters because policy only works when someone can enforce it under pressure.

Q: How can organisations tell whether AI governance is actually working?

A: Organisations can tell AI governance is working when they can inventory every agent, explain its purpose, show who owns it, and prove that permissions are tightly scoped.

Practitioner guidance

• Define a single accountable owner for each AI use case Assign named ownership for production AI systems, including approval, monitoring, escalation, and shutdown authority.
• Require disclosure of all employee AI use Create a disclosure rule for approved and unapproved AI tools, then tie the inventory to data handling, retention, and access review.
• Test AI shutdown and containment paths Run exercises that prove who can suspend an AI system, what dependencies it has, and how quickly the service can be isolated without losing evidence.

Bottom line: AI governance is failing at the handoff between adoption and ownership, which leaves organisations unable to prove who is responsible for what AI does.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →