Who should own AI in your business?

AI should be owned by a named executive who is accountable for a business outcome, supported by a standing group that includes the person who buys the technology, the person who owns the data, the person who owns the process being changed, and someone who can say no on legal and regulatory grounds. In a mid-market business, that named executive is usually the COO or the CEO. It is almost never the CIO alone, because the CIO cannot be both the person who selects the tool and the person who carries the blame when it goes wrong. That is not a governance structure. It is a single point of failure with an org chart drawn around it.

Most businesses have not made that choice deliberately. Schellman’s 2026 State of AI Governance Report found that 42% of organisations place AI purchasing and adoption authority with the CIO or head of IT, 16% with a Chief Data Officer or AI Officer, and only 10% with the CEO. The report’s own conclusion is blunt: in most of these organisations the same executive who decides whether to bring in a new AI tool is the one held accountable if that tool creates a compliance failure. So if you want to know who should own AI in your company, start with a harder question. Who currently gets fired if it goes wrong, and did anyone actually decide that, or did it just happen?

Why the CIO ends up holding it

There is nothing sinister in how this happens. AI arrives looking like software. Software is procured by IT. IT has a budget line, a vendor list, a security review process and a person whose name goes on the contract. So the request lands on the CIO’s desk and the CIO does the sensible thing, which is to evaluate it the way they evaluate everything else.

The problem is that AI is not procured like software once it is running. A CRM that goes down is an IT incident. A model that quietly produces a biased shortlist, or an agent that emails a customer something it should not have, is a legal incident, a commercial incident and a people incident at the same time. The CIO can tell you whether the system is up. They usually cannot tell you whether the process it has replaced was any good in the first place, because that process belongs to somebody else.

This is the gap that shows up in the failure numbers. RAND’s analysis found 80.3% of enterprise AI projects fail to deliver promised business value, broken down as 33.8% abandoned before production, 28.4% reaching production but underdelivering, and 18.1% running without ever recovering the investment. Only 19.7% deliver on the business case. Almost none of those failures are technical. They are failures of somebody not owning the outcome that the technology was supposed to change. I have written about the five patterns that produce most AI failures elsewhere, and unclear ownership sits underneath at least three of them.

The four patterns that actually appear

In businesses between 50 and 10,000 people, you see four ownership patterns. They are not equally good, and only one of them holds up when a non-executive director asks a direct question.

Pattern one: IT owns it

The CIO or IT Director selects, buys, deploys and is accountable. This is the 42% case. It works fine at the pilot stage, which is precisely why it survives so long. IT can stand up a tool, get ten enthusiastic people using it, and show a demo that genuinely impresses.

It breaks at scale. A March 2026 survey of 650 enterprise technology leaders found 78% of enterprises have AI agent pilots but under 15% reach production. The reason is rarely the technology. A pilot runs on hand-picked data, hand-picked people and no governance. Production requires the process owner to change how their team works, the data owner to guarantee quality at volume, and someone to accept regulatory risk. IT cannot instruct any of those people. They have no authority over them. So the pilot sits there, working perfectly, going nowhere. If that sounds familiar, the four specific mechanisms are laid out in why AI pilots fail to scale.

Pattern two: nobody owns it

This is more common than anyone admits. Larridin’s research found 17% of organisations report no clear owner at all. VentureBeat’s survey of enterprise leaders put the figure at 17% too, saying nobody holds formal accountability yet.

In practice “nobody owns it” does not mean nothing is happening. It means five departments are each running their own tools on their own credit cards, and the first anyone at board level hears about it is when something breaks. The test is simple. Ask your finance team for a list of every AI subscription the business is paying for. If they cannot produce it in a day, you are in pattern two whether or not you think you are.

Pattern three: you hire a Chief AI Officer

16% of organisations have gone this way, putting authority with a Chief Data Officer or AI Officer. This can work and often does in businesses above a few thousand people with genuine data complexity.

Below that, it usually goes one of two ways. Either the role has real budget and real authority over process change, in which case you have effectively created a COO with a different title, or it does not, in which case you have hired an internal advocate with no power. The second outcome is worse than pattern one, because it creates the appearance of ownership while the accountability stays exactly where it was. The honest question when someone proposes this is: what will this person be able to stop? If the answer is nothing, do not create the role.

Pattern four: named executive owner, standing cross-functional group

One executive is accountable for a specific business outcome that AI is meant to move. Not “AI adoption”. Something like reducing quote turnaround from four days to one, or cutting manual data entry in claims handling by half. That person chairs a group with four seats that must be filled: technology, data, the process owner whose department is being changed, and someone with the standing to say no on legal or regulatory grounds.

The group does not build anything. It decides what gets attempted, what gets stopped, and what evidence counts as proof. The named executive reports the outcome to the board. The CIO still buys the technology, still runs security review, still owns the integration. What the CIO no longer does is carry the business risk of a decision they did not have the authority to make alone.

This is the pattern that survives a board question, and it is worth being precise about why. Board questions are accountability questions wearing a strategy costume. When a non-exec asks “what’s our AI strategy”, what they want to know is who they should be looking at when it does not work. BCG found CEOs estimate 35% of their performance evaluation depends on achieving AI ROI, against boards’ own estimate of 27%. The CEO already knows the answer is them. Pattern four at least gives them a structure to point at rather than a name.

The test: can you answer three questions in one sentence each?

Forget frameworks. If your ownership structure is real, three questions have short answers.

Who is accountable if an AI tool we bought causes a compliance failure? One name. If the answer takes a paragraph, or if it is the same person who signed the purchase order, you have pattern one.

Who decides an AI project should stop? Somebody must be able to kill a project that is not working without it being a career risk. If nobody can stop things, everything runs forever, which is how you get the 18.1% that never recover the investment.

What evidence would prove this worked, and who agreed it counts? PwC’s Global CEO Survey of 4,454 CEOs across 95 countries found 56% report seeing neither revenue gains nor cost reductions from their AI initiatives, with only 12% achieving both. A large share of that is not failed technology. It is nobody having agreed in advance what success looked like, so there is nothing to measure against afterwards. If you are being asked for this now, how to prove AI ROI to your board covers the measurement side.

Grant Thornton’s 2026 AI Impact Survey found 78% of business executives lack strong confidence they could pass an independent AI governance audit within 90 days. Read that as a symptom rather than a compliance statistic. You cannot pass an audit on who owns what if nobody wrote it down.

What to do on Monday

Three things, in order, none of which require a consultant.

Write one sentence naming the executive accountable for AI outcomes and the specific outcome they are accountable for. If you cannot write it, that is the finding. Send it to the person named and get them to agree in writing.

List every AI tool the business is currently paying for, with the budget holder next to each. Finance can usually produce most of this from card statements in an afternoon.

Decide what the four seats in the group are and who fills them. Technology, data, process, veto. The veto seat matters most and is the one people skip.

Governance is the sixth of the six pillars our free AI readiness audit measures, alongside Data, Process, People, Technology and Strategy. Thirty questions, 7 minutes, a score out of 120 with a band for each pillar. The Governance questions ask the uncomfortable ones directly: who is responsible, who decides, who would be held to account. Most people find the Governance band is their lowest, and it is usually the cheapest one to fix, because fixing it costs a meeting and a document rather than a licence fee.

If your Data band is the low one instead, the data readiness checks to run first are the better starting point.