Governance & Accountability ยท GOV-05
Named owners for each use of AI
Every use of AI has named owners for the business outcome, the data, the technology and its assurance, recorded where others can find them.
Why it matters
When something goes wrong, or a decision is needed, the question is always who owns this. Named owners per use turn organisation-wide accountability into something that works in practice.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | Ownership is assumed rather than assigned; often only the person who set it up knows. |
| 2 Developing | Some uses have a named owner, usually technical, but business and data ownership are gaps. |
| 3 Defined | Every use of AI has named business, data, technical and assurance owners in the inventory, and ownership changes hands formally with residual risk accepted. |
| 4 Managed | Ownership is checked when people move roles, and gaps are caught and filled within a set time. |
| 5 Optimising | Owners actively manage their uses against measures, and ownership arrangements are improved from experience. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- GOV-05.1 Every use of AI has named business, data, technical and assurance owners recorded in the AI inventory (GOV-06).
- GOV-05.2 Ownership of a use of AI is handed over through a formal, recorded step.
- GOV-05.3 The receiving owner records acceptance of the use's residual risk.
Assessment questions
- For a given use of AI, who owns the business outcome, the data and the technology?
- What happens to ownership when one of those people leaves or moves role?
- Ownership fields in the AI inventory
- Evidence that ownership is updated on staff changes
- Ownership handover records with residual risk acceptance
How to reach Level 3
- Define the four owner roles for each use of AI: business, data, technical and assurance, with a short description of each.
- Name an owner for each role for every use and record them in the AI inventory (GOV-06).
- Set a handover process for when an owner changes, in which the receiving owner reviews and records acceptance of the residual risk.
Common pitfalls
- Naming a team or mailbox as owner instead of a person.
- Letting ownership lapse when people move roles, leaving uses with no owner.
Starter artefacts
- Owner role descriptions for business, data, technical and assurance owners
- Ownership handover form with residual risk acceptance
Cross-references
| Algorithmic Transparency Recording Standard | Tier 2 Owner and responsibility direct |
|---|---|
| EU AI Act | Art 26(12) partial; Art 17 partial |
| ISO/IEC 42001 | 5.3 direct; A.3.2 direct; A.4.6 partial; A.10.2 partial |
| JSP 936 Part 1 | para 49b direct; para 87 partial; para 100 partial; para 102 direct; para 103 partial; para 125 partial |
| MITRE AI Maturity Model | P1.1 direct; P3.2 direct |
| NIST AI RMF 1.0 | GOVERN 2.1 direct; GOVERN 3.2 partial; MEASURE 2.8 partial |
| UK Data and AI Ethics Framework | Transparency 2 partial; Accountability 1 direct; Accountability 9 direct; SAT 1.9 direct; SAT 3.4 partial; SAT 3.10 direct |
| UNESCO AI Maturity Framework | 2.2 partial; 5.1 direct |
direct: this control at Level 3 meets the item. partial: it covers part of it.