About One In Six Companies Say No Executive Owns AI Governance

Estimated reading time: 5 minutes

Large companies are naming a head of AI security, a new IANS and Artico Search benchmark finds. Ownership of AI governance is less settled. Between 15% and 19% of security chiefs say no single executive is accountable for it.

The share holds across small, midsize, and large companies.

The figures come from the 2026 Security Organizational Design Report by IANS and Artico Search. IANS sells security research and advisory services. Artico is an executive search firm. The full report draws on more than 1,400 CISOs and security staff surveyed in 2025 and 2026.

The AI questions are new this year. “These were answered by the CISOs only, not staff,” IANS Senior Research Director Nick Kakolowski told me. They numbered 249 at companies under $1 billion in revenue and 192 at $1 billion to $10 billion. Another 73 lead security at companies of $10 billion or more.

Who Owns AI Governance Depends On Company Size

At companies under $1 billion, the CISO most often holds primary accountability for AI governance, at 26%. The chief information officer (CIO) follows at 20%.

At $1 billion to $10 billion, the CIO leads at 38%. The CISO holds it at 11%.

At $10 billion and above, a chief AI officer or head of AI most often owns it, at 22%. The CIO follows at 18%. The CISO holds it at 7%.

The Head Of AI Security Arrives At Large Companies

Sixty-five percent of $10 billion-plus companies have assigned a head of AI security. That includes 18% with a dedicated role and 47% that combine it with another leadership job. Smaller companies are less likely to have the role at all. Where they do, they usually combine it with another job. At companies under $1 billion, 38% combine it, and 6% make it a dedicated role.

The report calls it one of the fastest-emerging roles in this year’s data. “Head of AI Security is the new role most frequently mentioned by respondents,” Kakolowski said. Respondents name emerging roles in several places, including write-in answers, he said.

Boards trail further behind. Only 21% of $10 billion-plus companies have fully implemented a board committee on AI ethics or responsible AI. Below $10 billion, the figure is 9%. Between 43% and 48% have no such committee planned.

The Deputy CISO Is Rarely The Successor

The report’s executive summary calls the deputy CISO the CISO’s “right hand and successor.” Fifty-eight percent of $10 billion-plus companies have one.

The promotion rarely follows. “Anecdotally, we rarely see Deputy CISOs elevate to the CISO role at F250 enterprises,” Steve Martano, an IANS faculty member and partner in Artico Search’s cyber practice, told me. Companies use a departing CISO as a chance to bring in a fresh perspective, he said. Internal candidates then compete against sitting CISOs who already present to boards.

Artico runs those external searches.

“When someone is named the Deputy CISO, they are often developed and treated as a successor,” Kakolowski said. “That does not directly translate to them actually becoming the successor.”

AI Governance And The Insurance Question

The survey did not ask whether insurers question companies about AI governance at underwriting or renewal.

Insurers are already writing AI into their terms. Beazley has confirmed affirmative AI cover in its cyber and technology errors and omissions policies. QBE has introduced sublimits for LLM-jacking, in which criminals run AI on stolen keys. And a proposal form only captures what an applicant knows and declares.

When an AI-related loss becomes a claim, someone has to answer for the controls behind it. At up to one in five companies, CISOs say nobody holds that job.

FAQ – AI Governance

Who owns AI governance at large companies?

At companies with $10 billion or more in revenue, a chief AI officer or head of AI most often holds primary accountability, at 22%, according to IANS and Artico Search. The CIO follows at 18%.

How often does the CISO own AI governance?

At 26% of companies under $1 billion, 11% at $1 billion to $10 billion, and 7% at $10 billion or more.

How many companies have no AI governance owner?

Between 15% and 19% of CISOs, depending on company size, say no single executive is accountable.

What is a head of AI security?

A security leader responsible for AI risk. Sixty-five percent of $10 billion-plus companies have one, 18% as a dedicated role and 47% combined with another job.

Do boards oversee AI?

Only 21% of $10 billion-plus companies, and 9% of smaller ones, have fully implemented a board committee on AI ethics or responsible AI.

How many CISOs answered the AI questions?

514 CISOs: 249 at companies under $1 billion, 192 at $1 billion to $10 billion, and 73 at $10 billion or more.

Related Cyber Insurance Posts

• Many Hacked Supermarket Fridges Had Reached End Of Life, Danfoss Says
• Nobody Owns The Password. Passpack CEO Chris Skipworth Explains The Credential Gap Sitting Inside Your Next Renewal – PODCAST(Opens in a new browser tab)
• Most AI Agents Don’t Say Who They Are. The Business Usually Carries The Loss.
• When Your AI Calls The Insurer’s AI, Who Owns The Mistake?(Opens in a new browser tab)
• Many Hacked Supermarket Fridges Had Reached End Of Life, Danfoss Says