Many organisations use AI tools in their security operations, but few have defined who is responsible when things go wrong.
AI rarely arrives through a management decision. An employee pastes a text into ChatGPT, HR has a tool summarise CVs and a developer lets an assistant write code. The whitepaper from Abnormal AI, shared by JARVISS, calls this shadow AI. This is where AI governance begins: the set of policies, processes and responsibilities that ensures AI systems are developed and used responsibly.
The research cited in the whitepaper is clear. Only 32 percent of organisations use AI extensively in their security programmes, and nearly two thirds have no AI governance policy at all. That is a serious problem, because AI is increasingly making decisions on threat detection, access control and incident response.
Who does what?
The whitepaper asks whether the CISO should own AI governance, or whether that responsibility belongs with a Chief AI Officer. The answer depends on the context. What is clear is that AI governance affects the security leader’s domain, regardless of the formal reporting lines. At executive level, the CISO bears primary responsibility for AI security risks. Security engineers and SOC teams handle it day to day: they monitor model performance, validate outputs and report anomalies that may point to model drift or an attack.
To divide these tasks properly, the whitepaper recommends a RACI matrix. It sets out who is responsible, accountable, consulted or informed. Regulation also differs by region, and the EU AI Act is already in force. Organisations that wait until the rules are fully settled will have to build controls into systems that are already in production. That is why the whitepaper argues for a modular framework that can adapt to regional requirements.
Want to know which twelve functions a full AI governance framework must cover and how to fill in the RACI matrix in practice? Download the whitepaper “Defining AI Governance Responsibilities” via jarviss.be and decide this week who in your organisation is accountable for AI.