Who should claim AI leadership in the enterprise?

AI has outgrown its original owners

Before GenAI became commercially available in 2023, AI programs sat with CIOs, CTOs, chief data officers and analytics teams who managed models, infrastructure, integration and security. Since then, multiple departments across businesses have bought or built AI tools for their work, often faster than central IT can assess them.

Business leaders should own the results of AI they deploy in their operations. CIOs and CTOs should own architecture, integration and service reliability. Finance should assess whether the expenditure is justified. But holding a CIO accountable for the outcomes another business unit controls creates responsibility without authority.

Consider an insurer using AI to settle claims. The CIO can ensure that the system works and the CISO can secure the underlying data. But who decides which claims the team can settle without human review, what error rate is acceptable or how they correct wrongful denial? Those decisions belong to the executive responsible for claims and are subject to legal and risk requirements.

The responsibility for a company's overall AI direction and risk appetite rests with the CEO. McKinsey's 2025 survey, "The state of AI: How organizations are rewiring to capture value," found that CEO oversight of AI governance was most closely associated with stronger self-reported financial impact. The growing reach of AI into business decisions reinforces the need for some form of C-suite involvement.

Will the chief AI officer role endure?

The chief AI officer (CAIO) emerged as a response to fragmented ownership. In IBM's 2026 CEO study, "Rewiring the C-suite," 76% of the 2,000 surveyed CEOs reported having a CAIO, compared with 26% a year earlier. IBM also reported higher AI investment returns among organizations with CAIOs, though this correlation doesn't establish that appointing a CAIO produced those returns.

The strongest case for appointing a CAIO is to coordinate AI activity across an enterprise. A large organization can have hundreds of projects, competing vendor contracts and separate teams attempting to solve similar problems. A CAIO can set shared standards, establish priorities and help direct scarce technical expertise toward the most valuable projects. To be effective, the role needs sufficient authority to influence investment, enforce common controls and eliminate duplication.

However, the role can also introduce another management layer without resolving underlying questions of authority. A CAIO who promotes adoption but can't question weak business cases will add overhead. Giving the role approval authority over every departmental deployment can create a bottleneck. The structure should reflect the organization's size, complexity and maturity. A CIO supported by an executive steering group might suffice in a smaller business, whereas a large enterprise might need a full-time CAIO with clear decision rights.

One accountable owner for each decision

Organizations can't sensibly assign AI policy, operational risk and ethical safeguards to one role or office. Legal and compliance must interpret statutory duties and privacy requirements. The CISO sets security requirements. Risk leaders establish assessment methods and challenge exceptions. HR addresses workforce consequences. Business executives remain accountable for the outcomes and risks associated with the systems they use.

The chart below sets out a proposed division of responsibilities among senior executives, with one accountable owner for each major decision and defined roles for implementation and specialist advice.

NIST's AI Risk Management Framework offers a structure for identifying, measuring and managing risks. The EU AI Act imposes obligations that vary according to the type of system and its intended use. Practical AI controls need to reflect both to be appropriate for organizations and their AI systems. Businesses need an inventory of deployed systems, documented approval thresholds, testing, access restrictions, incident procedures and ongoing monitoring.

Controls should reflect the consequences of errors. An internal summarization tool warrants basic data protection and checking. A system influencing lending, employment or medical decisions requires more rigorous validation, documentation, mechanisms for challenging decisions and ongoing oversight.

The new governance task: Managing AI agents

The growing use of autonomous AI agents introduces another layer of accountability for business leaders. An agent can search records, send messages, write code or trigger transactions without requiring human approval at every step. The risks depend as much on the permissions an organization grants to an agent as on the accuracy of the agent's outputs. Written instructions can't replace technical restrictions on what an agent can access or change.

In October, JPMorgan described restrictions on unauthorized external agents seeking access to customer accounts. The concerns included control over credentials, transactions and liability when software acts on someone's behalf. Similar questions arise wherever agents can alter critical records, commit money or communicate with customers.

Managing these risks requires clear decisions about the scope of an agent's authority. Leaders must determine which actions it can perform, set limits on cost and duration, log activity and ensure that controls can stop or reverse agent actions where possible. Consequential decisions might require human approval or independent checks. Keeping a person nominally "in the loop" provides little protection if that employee lacks the time, evidence or authority to intervene.

As AI assumes more routine tasks, managers will increasingly be responsible for supervising exceptions, verifying outcomes and investigating failures. They need enough technical understanding to assess system capabilities and limitations, recognize failures and know when to challenge outputs. They also need the judgment to retain human accountability even when execution is automated.

Autonomous agents also complicate the economics of AI. They can make repeated model calls, use search tools and retry unsuccessful tasks, consuming resources that might bear little relation to the value of the work performed. The cost of completing a task successfully therefore matters more than the cost of any individual model call.

Finance should require budgets by application or business unit, alert thresholds and a measure of cost per completed task. Technology leaders should supply usage data and enforce controls such as routing routine work to smaller models, reducing repeated input, caching where appropriate and stopping runaway sessions. Business owners must decide whether each task justifies the resources it consumes.

Beyond controlling operating costs, companies must establish whether their AI investments are producing meaningful financial returns. McKinsey's "The state of AI in 2026" survey reported widespread AI use but relatively few companies attributing substantial earnings gains to it. Time saved does not automatically translate into financial savings. It creates value when employees produce more, service improves, costs fall or revenue rises. Boards should require evidence of these benefits and discontinue AI projects that fail to deliver them.

People and management must change together

Unaccounted business costs can undermine the financial benefits of automation. After pursuing AI-driven savings in customer service, Klarna acknowledged in May 2025 that the effort had gone too far and moved to preserve customer access to human representatives. The lesson? Assessments of efficiency should account for the cost of mistakes, complaints, corrections and lost trust.

Adapting the workforce to AI requires more than employee training. Some employees will spend less time drafting or processing work and more time checking results and handling difficult cases. Supervisors must establish escalation rules, assign responsibility for exceptions and assess the quality of completed work. Businesses will also need to reconsider how they measure productivity and evaluate individual and team performance.

This shift places new demands on leadership. Executives need enough technical understanding to question claims about AI capabilities; commercial judgment to link deployment to measurable results; knowledge of security, privacy and regulatory requirements; and the ability to coordinate functions with different incentives. They must communicate clearly about job changes, involve employees in redesigning work and make difficult calls when a promising tool fails to meet expectations.

Leaders must also be prepared to revisit decisions as AI technology and its economics evolve. A build-versus-buy calculation can shift as tools improve, but internally developed software still requires ongoing maintenance and security oversight. A highly capable frontier model might be too costly for a simple task. Effective leadership therefore requires regular reviews of the assumptions underlying AI investments, alongside their actual performance.

Kashyap Kompella, founder of RPA2AI Research, is an AI industry analyst and advisor to leading companies across the U.S., Europe and the Asia-Pacific region. Kashyap is the co-author of three books, Practical Artificial Intelligence, Artificial Intelligence for Lawyers and AI Governance and Regulation.