At a board meeting, a hospital's CISO is asked who owns AI. She says she does, because she assesses the tools. The DPO says he does, because patient data are involved, and the operations manager points to IT, because IT rolled out Copilot. All three are right about their own part, and nobody knows who decides whether the transcription tool in the outpatient clinic stays.
This is perfectly normal, and the answer is not one owner but one owner per decision. AI governance is a series of decisions, and each one needs someone to take it, people to feed into it and people who see the outcome.
Why isn't "the DPO does AI" an answer?
Because under the GDPR the data protection officer has an oversight role: informing, advising and monitoring compliance. That role requires independence. Whoever decides that a tool is allowed cannot also check independently whether that decision was right.
Much the same applies to the CISO and IT. The CISO assesses risk, but only the outpatient clinic knows whether a risk is acceptable for its work. IT can roll out a tool and measure its use, but IT does not decide which data come up in a consultation. As soon as one of the three does everything, the business drops out of the decision and the decision becomes a technical setting.
Who does what?
Job titles vary between organisations; the division of work much less so.
| Role | Decides on | Provides | Sees |
|---|---|---|---|
| Board | The framework, the risk appetite, who holds which role | Time and a mandate | The quarterly figures: tools, the share of use through allowed tools, what still has no decision |
| Owner in the business (department head, process owner) | Whether a tool may be used for this work: the status per tool | The context: which work, which data | The tools in use in their own work and their status |
| DPO | Nothing; checks and advises | The assessment of the processing, the DPIA, the lawful basis | The register, the measurement and its design |
| CISO | The security risk of a tool and the requirements for vendors | The risk assessment per tool | Observed tools, risk bands, notices shown for tools without a decision |
| IT | Rollout, settings, measurement | Visibility of what is used and a record of each status | The dashboard and the Inbox with new tools |
| Procurement | Contract, data processing agreement (DPA), licences | The contractual facts per vendor | Which tools are purchased and which are in use without a contract |
| HR | AI literacy, the place of AI in job profiles and codes of conduct | Training and a record of it | Who has received which briefing |
| Team leads | How the decision is applied in their own team | The alternative in practice, the team's questions | What the team uses and where it gets stuck |
| Works council | Consent to arrangements that affect employees | Employees' perspective on the design | What is recorded and who sees it |
| Employee | What happens while they work: continue, switch to the alternative, adjust | The behaviour behind the figures | The organisation's decision when a tool opens, highlights on sensitive data |
Three things stand out. The DPO decides nothing, and that is deliberate. The business decides the most, and that is the role most often left unassigned. And the employee appears at the bottom as a decision-maker, not as a subject.
Which decisions really sit with the board?
Fewer than boards often think, and weightier ones.
The board sets the framework: which kinds of data never go into an AI tool, which environment is the preferred one, how much risk the organisation accepts in return for which benefits. It assigns the roles in the table, by name. And it reviews the figures regularly, at organisation level: which tools are in use, what share of use goes through allowed tools, how many tools still have no decision and whether that number is falling.
What the board does not do is decide on individual tools; a board that tries becomes the bottleneck every new tool has to wait for. The questions a board should ask every quarter are in our main article on AI governance.
Where do the works council and the employee fit in?
The works council does not review which tools are allowed. It reviews arrangements that affect employees: the processing of their data, a system that can monitor behaviour, sometimes a mandatory training programme. Measuring AI use should therefore reach the works council early; a decision about a translation tool for client correspondence usually need not. Where that line lies is explained in our article on when the works council must be involved.
The employee is the last row and the most important one. All the decisions above come together in one moment: someone opens a tool, or types something sensitive. If they then see what the organisation has decided, with the alternative alongside, the governance works. If they see nothing, it exists only in a document.
That is also why HR and team leads appear in the table: AI literacy under Article 4 of the AI Act is an obligation on the organisation, and a separate article covers who is responsible for AI literacy.
What does this look like in the hospital?
After the board meeting the table gets filled in, and then things move quickly.
IT shows that the transcription tool has been opened on eleven devices and has no decision yet, alongside Copilot, ChatGPT and a summarising tool nobody knew about. The CISO assesses the transcription tool: vendor outside Europe, trains on input, no DPA. The DPO establishes that consultations involve health data and that the processing cannot continue as it is. Procurement reports that there is no contract.
The head of the outpatient clinic, as owner, decides: not allowed, with the transcription feature in the approved environment as the alternative, and a request to procurement to find a tool that comes with a DPA. HR adds one line to the guidance for doctors. The works council receives the design of the measurement, not the decision about the tool.
Nobody did anything extraordinary. The only difference from the previous meeting is that every step now has a name attached.
BeeSensible supports exactly that part. The extension shows which AI tools are opened in the organisation, with no user ID and no content; an administrator sees in the Inbox which tools still have no decision; and the owner's decision goes into the AI register, with the owner listed as responsible. Who holds which role is for the organisation to decide: the product does not decide on its behalf and blocks nothing of its own accord.
This is the list where the owner records the decision: a status per tool.
