Share with your CISO
PwC’s latest Global Digital Trust Insights survey exposes a governance gap that puts security leaders directly in the crosshairs: only 17% of organizations formally assign AI risk ownership to the CISO, while 29% hand it to the CIO or CTO, 11% split it across functions, and a third have created a dedicated AI role entirely. The pattern that emerges is familiar: diffuse accountability that collapses onto the security leader the moment something breaks, even when the CISO had no authority over the system that failed.
What this means for your business
The Arup deepfake incident is the cleanest illustration of the accountability trap. A finance employee was deceived into wiring $25 million via a fraudulent video call, a failure of payment-approval process design, not of firewall configuration. Yet in organizations without explicit ownership maps, that incident lands on the CISO’s desk anyway because “security” is the residual category when no one else claims the loss. If your organization is still treating AI risk as a cybersecurity problem by default, you’re not managing it, you’re just assigning blame in advance.
The structural argument here is sound, and it cuts against a tempting shortcut. Giving the CISO full AI governance ownership feels tidy, a single throat to choke, a clean org chart line. But AI risk is genuinely plural. Whether a hiring algorithm introduces discriminatory bias is a legal and HR question. Whether an AI-generated customer communication creates regulatory exposure is a compliance question. Whether an AI agent has excessive access to financial systems is a security question. Collapsing all three into the CISO role doesn’t create accountability; it creates a single point of failure dressed up as ownership. The experts quoted by PwC and TechTarget, whose consulting practices benefit from selling governance frameworks, are nonetheless correct that the solution is clarity of scope, not consolidation of scope.
The decision every CISO already owns right now is whether to push for written authority before the next incident or wait and negotiate from wreckage. Boards and CEOs will grant review and veto rights over AI deployments when asked before something breaks; they almost never grant them after. The leading indicator to watch is whether your organization’s AI deployment process currently has a mandatory security review gate with documented CISO sign-off. If it doesn’t, the governance conversation hasn’t happened yet, and the next failure will retroactively make the security budget look like the responsible party.
Based on reporting from Unclear AI risk ownership could leave CISOs in familiar scapegoat role, originally published 2026-10-09 06:50:00.
