Who Owns Enterprise AI Governance? A Practical Operating Model
Imagine hiring an employee who can read thousands of documents in seconds, detect patterns across databases, draft customer responses and trigger actions across the business. Now imagine giving that employee access to everything on day one.
That is effectively what happens when enterprises deploy AI without clear permissions, data boundaries or accountability. The central governance question is not only what AI can do, but what it can access, what it can disclose and who answers when it fails.
India’s Digital Personal Data Protection (DPDP) Act, 2023 raises the stakes as AI tools connect to customer records, employee information and internal systems. Ownership of AI governance is therefore a business decision—one that must align privacy, security, risk and operational accountability.
In short: A central governance body should set enterprise standards and risk thresholds, while named leaders across business, technology, data, security, legal and privacy functions carry defined decision and oversight responsibilities. Where AI processes digital personal data in India, the model should incorporate applicable DPDP requirements.
This article provides general information and practical guidance only. It is not legal advice, and organisations should obtain advice based on their specific circumstances and applicable laws.
Why Is Enterprise AI Governance Important?
Enterprise AI governance is the system of decision rights, policies, roles and controls used to direct and oversee AI across an organisation. It matters because AI now supports customer service, marketing, software development, analytics and core operations—and may combine data from several sources, influence decisions and act through connected applications.
Regulation reinforces the need for discipline. The EU AI Act applies a risk-based approach to AI, while India’s DPDP Act governs the processing of digital personal data.
For organisations operating in India, the result is clear: AI governance must connect business objectives with data protection, access management, security and accountable decision-making. The DPDP Act provides a useful lens for seeing how those responsibilities translate into day-to-day decisions.
How Does the DPDP Act Affect AI Governance?
The DPDP Act matters whenever an AI workflow processes digital personal data covered by the law. This can include customer names, contact details, identifiable employee records, support conversations and other information linked to an individual.
The Act does not automatically ban AI from accessing personal data. Instead, organisations should assess whether the proposed processing is authorised under applicable requirements and confirm that all relevant obligations are addressed.
The DPDP Rules, 2025 provide further detail on areas such as notices, security safeguards and breach notifications. Their provisions have phased commencement dates, so organisations should assess the requirements applicable to them at each stage.
For AI governance, this means asking four questions before a system is deployed:
- What data can the AI access? Limit access to information necessary for the approved task rather than giving a model unrestricted access to databases, files or employee records.
- Why is the data being processed? Document the purpose and assess the applicable legal basis, including consent where required, alongside the organisation’s obligations under the Act.
- Where does the data go? Understand whether prompts, uploaded files or outputs are stored by an AI provider, used for model improvement, or shared with other services.
- Who is accountable? Assign clear ownership for use case approval, access management, system oversight and incident response activities.
Consider an AI assistant that summarises customer support tickets. The DPDP question is whether its processing of personal data is permitted and appropriately safeguarded. The governance question is how the organisation enforces that answer—by limiting the data it can access, controlling retention and monitoring how the tool is used.
The regulatory requirement and the governance response are therefore two parts of the same decision. DPDP obligations define what must be protected; the AI governance framework determines the approvals, access rules, vendor checks, monitoring and accountability needed to protect it.
What Controls Should an AI Governance Framework Include?
An AI governance framework should cover the complete AI lifecycle: discovery, risk classification, approval, deployment, monitoring, change and retirement. At minimum, it should include the following five controls.
1. Maintain an AI inventory. Record approved tools, models, owners, purposes, connected systems and the categories of data they process. Include employee use of third-party AI tools.
2. Classify use cases by risk. A tool that drafts generic marketing copy is different from one processing sensitive customer records or influencing hiring decisions. Match review requirements to the potential impact.
3. Apply least-privilege access. Give AI applications and agents only the data and permissions needed for their assigned tasks. Use role-based access, approved data sources and restricted integrations.
4. Review vendors and data flows. Check storage, retention, model-training settings, subprocessors, security commitments and contractual responsibilities before sharing company or personal data.
5. Monitor and reassess. Log relevant access and actions, test output quality, investigate incidents and review permissions when a system changes. Approval should not be permanent if the model, data or purpose changes.
The NIST AI Risk Management Framework provides a useful structure through its Govern, Map, Measure and Manage functions. Enterprises can adapt these functions to existing privacy, cybersecurity and compliance processes. But controls are effective only when the organisation is clear about who sets them, who applies them and who is accountable for the outcome.
Who Should Own Enterprise AI Governance?
No single function can govern enterprise AI effectively on its own. The operating model should divide decision rights clearly: central coordination for consistency, named use-case owners for outcomes, and specialist teams for implementation, challenge and assurance.
AI governance council: define standards and oversight
A cross-functional council—typically representing IT, cybersecurity, legal, privacy, compliance, data and business functions—defines approval criteria, risk tiers, common standards and escalation routes.
Business and process owners: own use cases and outcomes
The team sponsoring an AI use case defines its purpose, identifies affected users, validates outputs and owns the resulting business process. It cannot transfer this accountability entirely to the technology team or vendor.
Technology, data and security teams: implement safeguards
Technology, data and security teams implement identity controls, permissions, logging, secure integrations, data safeguards and technical monitoring. They also test whether a model or agent can access more information—or perform more actions—than its role requires.
Legal, privacy and compliance teams: interpret obligations
These specialists interpret legal and regulatory obligations, challenge higher-risk use cases and advise on safeguards. For every AI system, the operating model should name who may approve, restrict, suspend and retire it.
How Can Enterprises Put AI Governance into Practice?
To put enterprise AI governance into practice, start with an AI inventory, classify use cases by risk, assign named owners, apply least-privilege access, review vendors and data flows, and monitor systems throughout their lifecycle. These steps connect enterprise AI strategy with responsible AI governance and day-to-day risk management.
For organisations handling digital personal data in India, AI governance should address relevant DPDP obligations as part of its design and oversight approach from the beginning.
Clear decision rights and auditable controls help teams scale AI without sacrificing privacy, security or trust.
Need help designing an enterprise AI governance framework or operating model?
Explore Claritus Consulting’s Generative AI Solutions.
Frequently Asked Questions on Enterprise AI Governance
1. What is enterprise AI governance?
It is the set of decision rights, roles, policies and controls used to approve and oversee AI across an organisation.
2. Who is ultimately accountable for AI governance?
Executive leadership retains overall accountability, while operational responsibilities are assigned to the governance council and named business, technology and risk owners.
3. Does the DPDP Act prohibit companies from using personal data with AI?
No. The Act does not impose a blanket ban on AI processing personal data. Organisations must assess the applicable requirements and ensure that the processing is lawful, appropriately secured and consistent with relevant obligations.
4. Can employees paste customer information into public AI tools?
They should not do so unless the tool and use case have been reviewed and authorised under company policy. Organisations should assess data exposure, provider retention and training settings, access permissions and applicable legal obligations.
5. Should AI agents have the same access as the employees using them?
Not automatically. Agent permissions should be limited to the tasks they need to perform. Sensitive information and consequential actions may require additional approval and monitoring.
6. Who is responsible if an AI system exposes personal data?
Responsibility depends on the circumstances and applicable law, but an organisation should not assume that responsibility disappears because a third-party model or vendor was involved. Clear ownership, vendor agreements, security controls and incident procedures are essential.
Official Sources:
