Most AI failures in organisations are not technical. They happen because nobody was clearly responsible for the decision to use a tool, or for checking it afterwards.
What the frameworks expect
EU AI Act. Duties attach to roles: provider, deployer, importer, distributor. A company can hold several roles at once. Deployers must assign human oversight to people with the competence and authority to do it.
ISO/IEC 42001. The AI management system standard puts responsibility on top management: an AI policy, defined roles, and resources.
NIST AI RMF. The first of its four functions is “Govern”: accountability structures, policies and a culture of risk management that run through the other three.
UK. There is no AI statute, but existing duties apply. In financial services, senior managers’ accountability under the Senior Managers and Certification Regime extends to AI used in their area.
A workable structure
The board sets risk appetite for AI, receives regular reports and approves high-risk uses.
An AI committee drawn from legal, risk, data protection, security, technology and the business reviews proposed uses, keeps the inventory and escalates.
A named owner for each system is accountable for its use, monitoring and retirement. The owner should not be the person who built it.
If no one can say who would switch a system off, no one owns it.
What to do
Write down who approves a new AI use, who owns each system, and who can stop it. Put AI on the board agenda at least twice a year. For a smaller business the committee can be three people and a monthly meeting; the point is that the decisions are made and recorded.
This article is general information on the law as at November 2026. It is not legal advice and has not been updated since that date. See the terms of use.