Author: Lenin Lopez
When we recently asked which AI governance issue presents the greatest challenge for boards, one response was notable: oversight and accountability.
That's understandable. Companies have spent the past several years developing AI policies, establishing governance committees and determining where responsibility for AI should sit at the board level. However, as AI becomes embedded across more business functions, one question will prove challenging for many boards: Who is actually accountable?
We previously discussed how companies are developing governance structures to oversee AI and the questions boards should consider asking management. Establishing an oversight structure is only the beginning. The next challenge is ensuring that responsibility doesn't become diluted as AI spreads throughout an organization.
This article discusses:
- The difference between AI oversight and accountability
- Where responsibility can become blurred as AI governance becomes increasingly cross-functional
- Why accountability should extend down to individual AI use cases and the business processes where AI is deployed
- What boards can do to gain visibility into that accountability structure
Oversight and accountability aren't the same thing
A company may have a well-defined board oversight structure without having clear accountability. The board may oversee AI strategy, an Audit Committee may oversee AI-related enterprise risk and a Technology Committee may receive reports concerning significant AI initiatives. Management may also establish a cross-functional AI committee involving legal, compliance, technology, cybersecurity, privacy, human resources and business leaders.
All those efforts may represent good governance, but they don't necessarily address the accountability question.
Oversight, ownership and execution serve different functions. The structure will vary by company, but all responsible parties should understand their roles. For example, for most companies, the board provides oversight of AI. Management establishes the governance framework and assigns accountability to team members within the enterprise. Business leaders own particular AI applications and the risks associated with their deployment. Legal, compliance, cybersecurity and other functions may provide review, while internal audit or a risk team may independently assess whether the system operates as intended.
When everyone owns AI, does anyone own it?
Bringing those perspectives together is understandable. That said, there's also a potential downside. When companies distribute responsibility across a large committee, accountability can become diffuse. Legal may assume Technology owns the issue. The Technology team may view a particular use case as a business decision. Leadership may assume that because an AI tool was approved centrally, that same group that approved it is also responsible for monitoring its risks.
Shared responsibility shouldn't become diluted accountability.
Recent research underscores that companies are still working through this issue. Morgan Stanley reported that approximately 90% of surveyed AI governance executives said their organizations had defined, or were in the process of defining, where responsibility for AI governance and risk management resides. Yet fewer than half reported that the responsibility had already been fully allocated across corporate functions, senior executives and the board.1
Rather than just asking, "Who oversees AI?" boards may want to ask more specific questions:
- Who has ultimate executive responsibility?
- What responsibilities belong to the AI governance committee, and which remain with individual business units?
- Who can approve or reject high-risk uses?
- Who monitors compliance after approval?
- Who is accountable if an approved AI application begins operating differently than anticipated?
Those questions move the conversation from governance structure to accountability.
Accountability is moving into core corporate processes
The accountability question becomes even more complicated as AI moves beyond discrete applications and into established corporate processes.
The Securities and Exchange Commission's Investor Advisory Committee highlighted this issue at its September 10, 2026, meeting. A panel examining AI and the public markets information ecosystem discussed how issuers are beginning to use AI to collect and reconcile data, draft and revise narrative disclosure, benchmark disclosures against peers, identify inconsistencies and manage review and filing workflows. The committee's agenda identified potential concerns including factual accuracy, omissions, hallucinations, source traceability, automation bias and, notably, responsibility under disclosure controls.2
The example is instructive beyond public company securities disclosure. Many corporate processes already have established owners and accountability structures. Introducing AI into those processes shouldn't obscure that responsibility. If AI helps draft disclosure, reconcile financial information or identify inconsistencies, someone must remain accountable for validating the output.
Remarks at the SEC meeting reinforced this point. SEC Chairman Paul Atkins emphasized that AI should complement rather than substitute for human judgment and specifically identified the risk of errors and hallucinations in disclosures that investors rely on. The broader principle applies when companies incorporate AI into employment decisions, customer interactions, cybersecurity, product development or other significant business processes.3
As a result, while one of the first questions should be "Who owns AI?" the follow-on question should be "Who remains accountable for the process where AI is being used?"
Follow accountability down to the use case
Enterprise-level accountability is only part of the equation. Consider a company with dozens, or potentially hundreds, of AI applications. Some may be relatively low-risk productivity tools. Others may affect customer decisions, financial processes, employment decisions, regulated activities or products.
Saying that the chief information officer, chief AI officer or AI governance committee "owns AI" doesn't necessarily establish accountability for each application. For material or higher risk uses, companies should consider whether an identifiable business owner is responsible for the AI application throughout its lifecycle.
That person doesn't need to understand every technical aspect of the model. However, there should be an understanding of basic points, like why the company is using the technology, what information it relies on, what risks were identified, what controls were required and whether those controls continue to function properly.
In a recent study, only 41% of surveyed companies reported having a formal inventory of AI models with assigned ownership fully in place.1 Performing an inventory of what AI tools a company has in its stable can be much more than a compliance exercise. An effective inventory can help answer three fundamental governance questions: What AI are we using? What risks does it present? Who owns it?
Without answers to those questions, meaningful board oversight becomes considerably more difficult.
Accountability matters when something goes wrong
Governance structures are easiest to describe when everything is working. Their real value becomes apparent when something goes wrong.
Suppose an AI-enabled system produces inaccurate information that results in a significant customer issue, an employee enters sensitive information into an AI platform or management discovers that statements previously made about the company's AI capabilities are no longer accurate. The accountability framework should help determine who investigates, when Legal and senior management become involved, what triggers escalation to the board, whether public disclosures need to be reconsidered and whether the company should notify its insurance broker or carriers.
These questions are becoming more consequential as AI-related litigation develops. Gallagher's 2026 D&O Databox™ Mid-Year Report noted that allegations involving AI in business appeared in 13% of securities class actions filed during the first half of 2026. These lawsuits are another reason accountability matters. As more public companies incorporate AI into their business strategies, allegations involving AI are increasingly finding their way into securities litigation.
The lesson for boards isn't that every AI problem will become a D&O claim. It's that unclear accountability becomes considerably more consequential once an issue escalates. Regulators, plaintiffs' firms and insurers may be interested not only in what happened, but in who was responsible, what controls existed, what information was escalated and how management and the board responded.
The accountability structure should be understood
It's unlikely that boards are clamoring to insert themselves into the approval of individual AI applications. They shouldn't be that deep in the weeds. That said, boards should ideally have sufficient visibility to understand whether management's accountability framework is functioning.
Periodic reporting might address significant and high-risk AI applications and their owners, policy exceptions, material incidents or near misses, testing or internal audit findings, emerging regulatory and litigation developments and significant changes to the company's AI risk profile.
Reporting should also extend beyond risk. Ideally, boards should also understand whether significant AI investments are delivering their intended return on investment. Accountability ultimately applies to both sides of the equation: Who owns the risk, and who owns the outcome?
Test the framework before you need it
One practical way to evaluate accountability is to test it. Boards have become accustomed to cybersecurity tabletop exercises. A similar approach can be useful for AI governance.
Management might present a scenario involving an AI-related privacy issue, inaccurate customer output, discriminatory result or potentially misleading public statement and walk through the organization's response. Who identifies and owns the issue? Which functions become involved? What triggers escalation? When is the board notified? Who evaluates disclosure and potential insurance implications?
The exercise may reveal that the company's written governance framework looks considerably clearer on paper than how it actually operates when called upon. That's useful information to discover before an actual incident.
Parting thoughts
AI governance is maturing quickly. The first stage for many companies is typically recognizing AI as an enterprise risk. The next may be developing policies, establishing governance committees and determining where board oversight should reside. Accountability is a key element in that maturation.
Boards should be able to answer relatively simple questions: Who oversees AI? Who owns AI risk within management? Who owns our most significant AI applications? How are problems escalated? How do we know the system is working?
If those questions are difficult to answer, the company may have an accountability gap worth addressing.
