Lack of clear ownership over AI risk and governance creates a risk that Chief Information Security Officers (CISOs) will be unfairly held accountable for AI security incidents without corresponding authority to control AI systems. Experts emphasize that while CISOs should oversee AI security boundaries—including reviewing AI deployments, access controls, and monitoring—AI risk management must also involve business, legal, and technology leaders, reflecting AI’s cross-functional impact. To avoid reactive blame and governance gaps, organizations need to define and connect responsibilities across functions proactively before incidents occur.
