A lack of consensus over who owns AI risk in the organisation represents a key governance risk for the UK, as rules around AI usage are still being hashed out.

There is little consensus over who owns the management of artificial intelligence risk in the organisations in the UK, according to a poll conducted by Airmic.

Organisations are divided between the chief executive officer and the chief information security officer as the primary owner of the risk, with equal numbers of respondents (24%) to Airmic’s poll assigning the risk to these two senior C-suite members.

The association says the results point to a lack of consensus on a key governance question, as the UK’s Department for Science, Innovation and Technology seeks views from industry on a draft Code of Practice on AI cyber security.

“For such a Code of Practice on AI cyber security to be most effectively adopted, we have proposed that it should sit within the globally respected UK Corporate Governance Code published by the Financial Reporting Council," said Julia Graham, CEO of Airmic. "This would crucially frame AI cyber security as a business subject, rather than a purely technological subject.”

Other respondents to Airmic’s poll said the primary owners of AI risk in their organisations are the chief technology officer, the chief compliance officer, legal counsel and, in one instance, the transformation director.

Hoe-Yeong Loke, head of research, Airmic, commented: “The government has rightly framed the code with pro-business, pro-innovation aims in mind, so as to strike a good balance with the need for better regulation for AI risks. This means the business as a whole should be considered as the stakeholder, rather than just the IT team, crucial as their role is. Only then can the code get the buy-in of board directors and the C-suite.”

---