Enterprise AI Governance Remains Fragmented as CIOs Shoulder Accountability

Enterprises are deploying AI widely, but organizational structures for managing the technology remain unclear, according to research from Thoughtworks released this week. The consultancy polled 3,200 CIOs in July and found that decision-making authority over AI initiatives is distributed across multiple stakeholders rather than consolidated under a single owner.

The survey identified CEOs, central IT teams, executive leadership, and dedicated AI roles as the primary influencers on AI-related decisions and spending. However, this fragmented approach creates a disconnect between control and accountability: 94% of U.S. CIOs said their teams would be held responsible for security breaches or compliance failures caused by AI tools deployed elsewhere in their organization.

Visibility Without Authority

While nearly all technology executives report having full or high visibility into AI tools deployed across business units, that visibility does not translate into meaningful control. The pressure on CIOs is substantial—61% told AI platform Writer earlier this year that they feared losing their jobs if they failed to guide their organizations through an AI transition.

Thomas Squeo, CTO of Thoughtworks Americas, emphasized the importance of aligning decision-making authority with responsibility. "Organizations should probe their AI ownership models to ensure the people making decisions about AI have the authority and information they need," he told CIO Dive.

Emerging Governance Approaches

In response to distributed ownership, more than half of CIOs are planning to embed technology leads into business units. Just under half are considering expanding the CIO role to oversee enterprise AI strategy and implementation across the organization.

Most CIOs believe their organizations are adequately prepared to govern AI, yet 88% acknowledged that adoption is moving faster than governance capabilities can keep pace. Thoughtworks recommends assigning security, privacy, and compliance responsibilities to relevant control owners throughout the business rather than centralizing all oversight.

Squeo outlined a collaborative approach to AI governance: "Changes to roles and workflows involve people, business and technology leaders together. Finance gets visibility into consumption and value, and business units make local decisions within agreed guardrails."

Building Scalable AI Frameworks

Rather than seeking a universal ownership model, Squeo suggested that CIOs focus on making AI adoption repeatable across the enterprise through a shared technology environment with streamlined architecture and controls. This approach reduces the need for case-by-case approval of every AI initiative.

"I see the CIO as the person connecting local adoption to enterprise scale," Squeo said. "Making sure what works in one part of the business can grow without losing the architecture and controls that made it reliable."