What roles and responsibilities does an AI governance program need to define?

An AI governance program must define and resource AI roles, responsibilities, and reporting lines, including a named risk owner or accountable executive for each deployed AI system. These definitions ensure clear accountability and effective management of AI risks throughout the system's lifecycle.

Specific roles and responsibilities that need to be defined include:

• Top management is responsible for demonstrating leadership, establishing an AI policy, documenting the AI Management System (AIMS), and assigning roles, responsibilities, and authorities for AI governance. This aligns with the NIST AI RMF GOVERN function, which emphasizes culture, policy, accountability, and oversight.
• Risk owners/accountable executives must be assigned for each deployed AI/agent system, with documented roles, responsibilities, and lines of communication for AI risk. This is a critical control under NIST-GOVERN-2.1.
• Data & Memory Governance roles are responsible for managing training data lineage (consent, license, bias evaluation), RAG corpus governance (source vetting, freshness, poisoning monitoring), agent memory persistence, PII handling, data residency and sovereignty, data classification propagation, and retention and right-to-erasure. This aligns with ISO/IEC 42001 A.7 for data governance.
• Roles involved in AI impact assessment processes are needed to assess the impacts of AI systems on individuals, groups, and society across the lifecycle. This cross-maps to NIST-MAP-5.1.
• Roles for human oversight of AI systems, including defining override authority and the boundary of agent autonomy, are necessary. This relates to ISO/IEC 42001 A.9 and NIST-GOVERN-3.2.
• Responsibilities for managing third-party relationships in the AI value chain, such as model providers, data providers, and tool/plugin vendors, must be established. This aligns with ISO/IEC 42001 A.10 and NIST-GOVERN-6.1.
• Roles responsible for monitoring, measurement, analysis, and evaluation of the AIMS, including internal audits and management reviews, are crucial for performance evaluation. This cross-maps to NIST-MEASURE-3.1.