4.2.1. Cross-Functional Governance Structures
💡 First Principle: AI risk is simultaneously technical, legal, ethical, operational, and reputational, so no single function can see all of it. Governance works when every relevant perspective is represented in decisions and when one named person is accountable for each AI system's outcomes. Representation without accountability produces discussion; accountability without representation produces blind spots.
A typical structure has three layers:
- Executive oversight: an executive sponsor or committee (sometimes the board's risk committee) sets AI principles, risk appetite, and policy, and resolves escalated decisions.
- AI governance council or board: a cross-functional body that maintains policy, approves high-risk use cases, reviews incidents, and tracks the AI inventory. Representation typically includes business leaders, technology and data, legal, compliance, risk, privacy, information security, HR (for workforce impacts), and sometimes ethics or customer advocacy.
- Operational ownership: for each AI system, a named business owner accountable for outcomes, supported by technical owners, data stewards, and risk partners.
A responsibility matrix (RACI: Responsible, Accountable, Consulted, Informed) clarifies roles for key decisions. A simplified example:
| Decision or activity | Business owner | Data science / engineering | Legal and compliance | Security and privacy | AI governance council |
|---|---|---|---|---|---|
| Approve high-risk use case | R | C | C | C | A |
| Define acceptable error rate and oversight | A | C | C | I | C |
| Build and test the solution | C | A/R | C | C | I |
| Privacy and data use assessment | C | C | R | A | I |
| Monitor production performance and fairness | A | R | I | I | I |
| Respond to AI incident | A | R | C | R | I |
Clear accountability standards mean that every AI system in the inventory has one accountable owner, that approval authority is defined by risk tier, and that decisions are recorded. The AI governance function also maintains the AI inventory (which systems exist, their purpose, owner, risk tier, and status) and the tool classification register from 2.2.4.
⚠️ Exam Trap: When asked how to establish AI governance, prefer options with cross-functional representation (business, technical, legal, compliance, risk, security, privacy) and a single clearly accountable owner per system. Options that assign governance solely to IT, solely to data science, or to a committee with no defined decision authority are distractors.
Reflection Question: A company's AI governance committee consists of the CIO and three data scientists. What perspectives are missing, what risks might the committee fail to see, and how would you restructure accountability?
