Do you need help & advice with AI & Automation or Cybersecurity?
Try this at your next management meeting. Ask who is responsible for how the business uses AI.
What usually happens is a short silence and then a look towards whoever deals with IT. And if you ask them, they will look back at you. One consultant put it perfectly: the CEO pointed to the IT manager, and the IT manager pointed back to the CEO.
That is not two people avoiding a job. It is a genuine structural problem, and it has an answer.
Why does it end up with IT?
Because it arrived through a computer, and anything that arrives through a computer gets handed to IT.
Which would be reasonable if the questions were technical. They are not. Should we let staff put client documents into ChatGPT? Is it acceptable for a subcontractor’s details to sit on an American server? Do we tell clients we use AI on their work?
Those are business decisions with commercial and legal consequences. Your IT provider or IT manager cannot make them, because they do not have the authority to. So they do the only thing they can, which is keep the systems running and wait for somebody to decide.
The line that explains all of it: IT governance fails when IT teams are asked to govern decisions they do not have the authority to make.
So who should own it?
A director owns the risk. Somebody else does the work. Those are two jobs, not one.
This is where most advice on this subject goes wrong, including most of what we have written before. “Appoint someone to own AI” sounds like one action. It is two, and collapsing them is why it never quite happens.
| Who | What they are actually on the hook for | |
|---|---|---|
| Accountable | A director or owner, by name | The decisions. What is allowed, what is not, what we tell clients, what we sign on a form. Cannot be delegated |
| Responsible | The AI Champion | The work. Keeping the list, checking what suppliers are selling, helping colleagues, flagging problems upward |
| Supporting | IT, internal or external | Making the decisions technically real. Permissions, accounts, controls |
Neither of the first two needs to be technical. The accountable person needs to be senior enough that their decision is final. The Champion needs curiosity, common sense and a bit of protected time.
What does the Champion actually do?
Four things, none of which require knowing how any of it works.
| The job | |
|---|---|
| 1 | Keep the list. One spreadsheet of every AI tool in use, every idea somebody has had, and what the risk is |
| 2 | Be the funnel. Every supplier with AI in the pitch comes through them. Not to be blocked, to be checked |
| 3 | Help colleagues. Know what is approved, know what must never go in, be the person people ask first |
| 4 | Report up. Monthly, two things: what is being used that was not last month, and anything that worries them |
Point two is the one that pays for itself. Businesses without a funnel end up buying four overlapping tools, none of them properly set up, because four different people were sold to separately.
We have written the role up as a one page job spec you can hand to somebody. It is free and there is nothing to fill in.
What happens if nobody owns it?
Everybody owns it, individually, and none of them knows that.
Until somebody’s name is on this, AI in your business belongs to whoever happens to be using it. Every member of staff is making their own decision about what is safe to paste into a website, based on nothing, and none of them thinks of it as a decision.
You find out when somebody asks you a question you cannot answer. A cyber insurance renewal asking how you govern AI use. A Cyber Essentials assessment where the honest answer has changed. A main contractor’s questionnaire asking which third parties handle their information.
Those arrive with deadlines. “Whoever deals with our IT” is not an answer to any of them.
[VIDEO_PLACEHOLDER]
So, what now?
Two names on a piece of paper. A director who is accountable for the decisions, and somebody who does the work. Then tell both of them, which is the step that gets missed.
If the honest answer is that nobody in the business has the time to keep on top of what changes, that is what an AI Manager is for: an outside AI consultant working alongside your Champion so they are not doing it alone. The basics are in getting started with AI in your business.
Frequently asked questions
Who should be responsible for AI in a small business?
A director is accountable for the decisions. Somebody else, often called an AI Champion, does the day-to-day work.
Neither needs to be technical. Splitting the two is the part that makes it actually happen, because “appoint someone to own AI” is two jobs pretending to be one.
Should our IT company own AI governance?
No, and it is not fair to ask them to.
Whether staff may put client documents into a public AI tool is a commercial and legal decision, not a technical one. IT cannot govern decisions it has no authority to make. What IT should do is make your decisions technically real.
What is an AI Champion?
Somebody inside your business who keeps track of how AI is being used, day to day.
They keep the list, check what suppliers are pitching, help colleagues use approved tools safely, and tell the accountable director when something looks wrong. Not a technical role and not a full-time one.
Does the AI Champion need to be technical?
No. Curiosity, common sense and enough standing to say no to a supplier matter far more.
Office managers, operations coordinators and estimating leads often make better Champions than technical staff, because they talk to every part of the business and can see where the time goes.
Can we just add this to our IT manager's job?
You can add the Champion work to almost anybody’s job, including theirs, as long as they get protected time for it.
What you cannot do is hand them the accountability. That has to sit with somebody who can make a decision stick.
Last reviewed: 17 August 2026.
Related
- AI browsers at work: why we still say no
OpenAI has said the core flaw may never be fixed. - AI agents, and whether your business should use one
An agent does not answer, it acts. Where liability sits when one gets it wrong. - Every Microsoft Copilot explained
Seventeen products share the name. Which one you already have.
