An AI governance lead runs the process that decides which AI uses a company allows: the policy, the intake and risk classification of each use case, the inventory of AI in use, and the record of who approved what. Titles vary from AI governance manager to head of AI governance and responsible AI lead.
The title suggests the person who says no. Of the 14 postings read for this page, none gives the role a written right to block an AI use case, and 12 make it the author of the policy everyone else applies. So before anyone takes this seat, or creates it, the useful question is who holds the no, and what it rests on.
Who says no, and on what basis
A refusal needs a basis someone else can check. Three bases show up in the postings and the rules behind them.
The law. Article 5 of the EU AI Act has banned a list of practices since 2 February 2025, among them social scoring and emotion recognition at work, with fines of up to €35 million or 7% of worldwide annual turnover, whichever is higher, under Article 99(3). That’s the one no the law makes for you. High-risk uses, such as AI in hiring, credit scoring or education, carry heavier duties. Since the Digital Omnibus, Regulation (EU) 2026/1744, took effect in July 2026, those duties start on 2 December 2027 for the uses listed in Annex III, and on 2 August 2028 where the AI sits inside a regulated product. Classification at intake still matters now, because it decides which clock a use case is on.
The company’s risk appetite. Everything the law allows is a judgement call against appetite, and appetite is set above the governance lead. AstraZeneca’s head of data and AI risk in London escalates “where risks exceed agreed appetite”. At ABN AMRO the head of AI model risk sets the Risk Appetite Statement for the models in scope. NIST’s AI Risk Management Framework says in GOVERN 2.3: “Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment” (NIST AI 100-1).
A validation gate. A model can fail validation, and model-risk teams in banks hold that gate. It’s the one place in the postings where a no comes with a procedure attached.
So who says it? In the postings, a no travels by one of two roads: a model-risk validation gate, or a forum, a council or a named executive. Guardian Life’s head of AI governance prepares materials so that “enterprise governance forums” can decide. Dotmatics’ head prepares “decision-ready materials” for its AI Governance Council. The clearest sentence comes from an OpenAI compliance programme manager posting: “Obtain decisions from the authorized owners for legal interpretation, external representations, and risk acceptance.” The governance lead holds the pen and the record. The veto usually sits elsewhere.
A RACI for AI decisions
R does the work, A has the final say, C is consulted, I is informed. Each row comes from what the 14 postings assign, cross-checked against NIST’s GOVERN function.
| Decision | Governance lead | Legal | Security | Engineering | Business owner |
|---|---|---|---|---|---|
| Intake and risk tier of a use case | R | C | C | C (submits it) | A |
| AI policy and standards | R | C | C | C | A (at an exec forum or board committee) |
| What the law requires | C (turns it into controls) | A | I | I | I |
| Approving a vendor’s AI | R | C (contract) | R (security review) | C | A |
| Accepting residual risk | R (documents, escalates) | C | C | C | A |
| Running controls and handling incidents | R (tracks, reports) | C | R | R | A |
| The AI inventory | A | I | C | C (declares what it runs) | I |
| AI literacy training | R | C | C | I | A (makes it mandatory) |
Two columns are missing on purpose. Model risk, where it exists, takes the validation row out of this table. Mercury writes that split down: “Data & AI Governance will establish enterprise governance and responsible-use standards, while Model Risk Management will retain responsibility for model inventory, tiering, validation, and model-risk oversight.” Internal audit tests the whole thing afterwards. Deutsche Telekom’s control-testing team in Brno hires an AI expert for exactly that “independent assurance”.
The governance lead holds an A in one row only, the inventory. That matches what the employers wrote.
Where model risk stops and governance starts
On 17 April 2026 US bank supervisors replaced the guidance that model-risk teams had worked from since 2011. The Federal Reserve’s SR 26-2 “supersedes and replaces SR letter 11-7”, and the OCC’s bulletin on the same guidance says: “Generative AI and agentic AI models are novel and rapidly evolving. As such, they are not within the scope of this guidance” (OCC Bulletin 2026-13).
So at a US bank the copilot, the agent and the vendor chatbot fall outside the model-risk machinery, and by default they land on whoever owns AI governance. Mercury, a US fintech whose governance lead reports to the Chief Risk Officer, handles it with a sentence in the posting: governance must “Coordinate with Model Risk Management to determine when an AI use case meets the definition of a model”. Somebody has to decide that question first, and it’s worth knowing who before your first agent goes live.
European banks can land elsewhere. ABN AMRO’s head of AI and analytics model risk in Amsterdam runs a team of about eight to ten, reports through model risk to the CRO, and covers “all generative AI models”. There, generative AI gets a validation gate with a team behind it.
The same Fed guidance defines what a real challenge needs: people with expertise, independence, “as well as the organizational standing and influence to effect any change” (SR 26-2 attachment). That’s a regulator describing authority. Quote it when someone offers you the governance seat without any.
What fourteen postings hand the governance lead
The 14 postings, read on 24 October 2026, came from banks and fintechs, an insurer, a pharma group, a life-science software firm, OpenAI, two consultancies, HMRC and Deutsche Telekom’s services arm in Brno. Eight were based in Europe.
- 12 make the role write or own the policy, standards or operating model.
- 0 say in plain words that the role can block or approve a use case. 6 name who decides instead.
- 2 draw the boundary in writing: Mercury’s model-risk split and OpenAI’s “authorized owners”.
- 6 name the EU AI Act. Of the eight European postings, four do.
- 6 warn about speed. JPMorgan’s London governance lead has to embed governance “without becoming a bottleneck”; HMRC’s head of AI assurance must support “responsible acceleration rather than unnecessary delay”.
- 4 write in some form of influence without authority. Dotmatics asks for “15-20 years” of experience and then says the head works “without direct line authority”.
The speed warnings have a reason. In IBM’s 2025 breach study, “One in five organizations reported a breach due to shadow AI”, and in KPMG’s 2025 survey of more than 48,000 people, 57% of employees said they hide their use of AI. A review queue that takes a month teaches people to skip it.
Reporting lines are all over the place. Synchrony and HMRC put the role under a Chief AI Officer, Mercury and ABN AMRO under the CRO, Dotmatics under a VP of information security, Pliant in Berlin inside legal and compliance, where AI governance shares a desk with data protection. IAPP’s 2025 profession report found that “50% of AI governance professionals are typically assigned to ethics, compliance, privacy or legal teams”.
Six of the 14 print a salary. Synchrony’s SVP, Head of AI Governance lists $200,000 to $330,000 base, plus an incentive target of 25% of salary and an equity target of 25%. Mercury’s senior manager lists $225,800 to $282,300 in its biggest US cities, Guardian Life $152,290 to $250,195, and the OpenAI compliance role $216,000 to $240,000 plus equity. In Europe HMRC’s deputy director starts at £86,000, and the Brno posting names no salary at all, only an annual bonus and meal vouchers of 160 CZK per working day. Across IAPP’s 2025 salary survey, technical AI governance roles in the tech sector had a median of $221,000.
What governance must own in writing
Without the items below, the seat is advisory only, whatever the title says. Each is cheap to agree before the first incident and expensive to argue for after it.
- Decision rights. One page: what you can stop alone, what goes to a forum, and who has the last word. “No production without a completed intake” is a fair thing for governance to own outright. OpenAI’s “authorized owners” sentence above is a usable template for the rest. For an AI product, the AI product manager writes the same split onto the launch checklist: one name who can stop the launch, one who can approve it.
- A named risk owner per tier. Residual risk gets signed by an executive or the business owner. Your name goes on the line that says the review happened.
- The model-risk boundary. Who decides whether a use case is a model, and who validates generative AI and agents. After the OCC bulletin, a US bank that leaves this unwritten has quietly given it to you.
- Legal as the interpreter, with a response time. Counsel says what the law requires. Pliant sends that question to two external law firms; your job is to make sure someone asks it, and that the answer arrives before the launch date.
- Specialists stay specialists. HMRC’s posting has the wording: the role “will not replace existing specialist functions such as data protection, cyber security, legal, commercial, architecture, risk or ethics”. Copy it.
- Controls stay with the teams that run them. Engineering and security operate the controls and the incident response; governance tracks them. OpenAI’s posting keeps “implementation and operation of controls with the appropriate functional owners”.
- A review deadline and a fast lane. Publish how long a review takes, give low-risk internal use a same-week route, and report approval time next to shadow-AI findings. Otherwise the fastest path in the company runs around you.
- A headcount trigger. Mercury’s senior manager will “Eventually, build and lead” a team. Tie that “eventually” to a number of use cases per quarter. In IAPP’s survey, 10 of 671 organisations said they won’t need more AI governance staff in the next 12 months.
If you’re designing where AI governance reports, or you’ve been offered the seat, coaching for Chief AI Officers is where we work through the decision rights, the board line and the boundary with risk and legal. It draws on 35+ fractional CTO engagements since 2019.
Seats that share the AI decisions
- VP of AI vs Chief AI Officer: who carries the AI mandate
- Director of AI: the enterprise seat that sets AI priorities
- AI program manager: the risk register next to yours
- AI QA engineer: where eval evidence comes from
- Head of AI: who owns AI inside engineering
- Technical program manager: delivery across teams
