Name the Business Accountable Executive for an AI system
Draft
Name the Business Accountable Executive for an AI system
Layer 4. Control CLSClassification and thresholds
Allocation
| L4-CLS-06 | |
|---|---|
| Decides | AI Governance Board |
| Consulted | CIO and business unit head |
| Executes | Business Owner |
| Evidence | Register entry naming a person, never a body |
In plain terms
Put one person’s name against one system. That person is accountable for the composite decision to deploy and operate it.
What is being judged
Who has both the standing to say no and enough proximity to know what they are accepting. Those pull in opposite directions, and the judgment is where they meet for this system.
Too senior and the accountability is nominal: an executive accountable for forty systems is accountable for none of them in any way that changes behavior. Too junior and the name cannot decline a system the business wants.
The role is per system and always a person. A body in this field means no one is accountable, which is the failure the composite accountability model exists to close.
What this decision does not cover
It does not assign the Model Owner, who is accountable for the model as a technical artifact. Those are different people and neither substitutes for the other.
When it fires
On event. When an initiative is determined material at L4-CLS-03, before the first stage gate. On change of role holder, because accountability does not transfer silently. On material change of the system’s business owner.
On cycle. Reviewed annually against the register.
What you need before deciding
The determination record. Who owns the business process the system operates within. Whether the candidate can describe what the system does without reading from a document.
How this goes wrong
Naming at go-live: the entire build ran without an accountable person and the name attached at the end belongs to whoever was available. The Layer 5 metric exists for this. The accountable executive who has never seen it: a name in a register belonging to someone who could not describe the system’s failure mode. Accountability by title: the role is assigned to a job title rather than a person, so it transfers on reorganization with nobody deciding it should.
Related decisions
Upstream L4-CLS-03.
Downstream L4-RSK-03 composite acceptance, L4-AUT-01 through L4-AUT-05, L5-05 gate.
Metric Layer 4 metric 1, Layer 5 metric 2.
Instrument references
No instrument requires one named person per AI system. ISO/IEC 42001 clause 5.3, COBIT EDM03 and NIST GOVERN 2 all require defined accountability in general terms. Recorded as KL-19, the requirement expected to be most resisted.
Correction
The maintainer answers corrections. There is no service level. Responses are best-effort and opportunistic within a reasonable time: a correction raised on a Monday is answered that week or sooner.