Who really controls AI in an organization?

It’s all fun and games until the person in charge of managing your organization’s AI subscriptions decides to leave.

The above scenario is not so far-fetched. As companies increase their investments in GenAI and AI agents, it may seem natural to designate the responsibility for the tools to one tech-savvy person in the organization. But what happens when that person’s time at the company comes to an end?

Zander Deitz, VP of sales at AI and SaaS portfolio management company Productiv, told IT Brew that documentation comes in handy for companies in the era of AI, especially when transitioning AI-related responsibilities from one person to another.

“If you don’t have a good system in place that is easy for someone to pick up and understand on day one, whether it’s the person directly managing AI or some other process…you’ve just backlogged their work by months,” Deitz said.

Whose AI is it anyways? So, who’s ultimately responsible for an organization’s AI products and subscriptions? Deitz said the answer will vary from organization to organization.

“If it’s a smaller startup-type company, this is going to typically fall immediately on the CIO or CISO,” Deitz said. “They’re going to be in charge of building a governance policy when it comes to AI, selecting approved tools, reviewing embedded AI within applications, [and] ensuring contract terms are in line with what their policy is.”

A larger organization may have more resources for managing AI responsibilities, Deitz said, adding that a C-suite security leader may be responsible for this, or tasks might even be delegated to a specific AI task force.

Neuralogics Group CTO Christian O. Petersen cautions against dumping the responsibility of AI products and applications solely on the IT department.

“All AI needs to have both the business owner and a tech owner. That’s really fundamental,” Petersen said. “And it’s never been more important than now because…we’re moving towards a future where there’s nothing we do in a business that’s not going to be somewhat or largely AI-powered.”

Documentation. Petersen said documentation is essential for AI governance, and that companies need to approach it from both a business and tech perspective. On the business side, Petersen said companies need to identify the objectives of the department using an AI application and how AI contributes to them.

“Now you actually have complete agreement on why we have this AI in the first place,” Petersen said. “Based on that, it’s really easy to decide what it [is] that we want to use it for. Are there things we don’t want to use it for?”

On the tech side, Petersen said departments should also document which AI tools can access which data. Having this information written down informs incoming employees about who’s responsible for overseeing and securing AI.

“There’s no surprises,” Petersen said. “We know why we have it. We know what it’s supposed to do. We know how we’re supposed to use it.”

What’s at risk? Unclear documentation of AI within the organization can cause problems for organizations down the line, according to Deitz.

“You don’t necessarily have to have rigid policies against everything, but if you don’t know what’s going on and what people are using approved and unapproved [tools], and if you’re not bringing those unapproved things behind SSO [single sign-on], you expose yourself to giant lawsuits if somebody puts sensitive data into a system, even by accident.”