Who Owns the Risk? The Roles Behind a Working AI Risk Management Policy

A functioning AI risk management policy names four roles. An AI Governance Committee holds executive authority over high-impact decisions. An AI Operational Committee runs the framework day to day. A System Owner is accountable for each individual AI system. A Mechanism Owner is accountable for each governance process those systems depend on. Everything else in the policy, the classification tiers, the risk register, the escalation paths, sits idle until those four roles have names attached to them.

Most firm AI policies I review get the substance mostly right and the roles almost entirely wrong. They describe assessment methodology in careful detail, then assign it to "the firm" or "management" or a committee that meets when someone remembers to schedule it. Responsibility spread across a group is responsibility that nobody carries.

Importing the entire enterprise apparatus is the wrong correction. The four-role structure was built by organizations that develop their own AI and answer to regulators in several jurisdictions at once: Microsoft runs a hub-and-spoke model with an Office of Responsible AI, an Aether Committee, a dedicated engineering enablement group, and a Responsible AI Council seated at senior leadership.⁷ A firm that buys its tools rather than building them needs a fraction of that machinery, and paying for the full version puts money where it does no work. What follows is the complete map of the roles and the job each one does. The right-sizing section near the end covers the compressed version most firms should build.

The Test for Whether a Role Is Real

The question worth asking about any assignment in a policy is a simple one. When the contract analysis tool starts producing bad output on a Friday afternoon, whose phone rings? Not a distribution list. Not a practice group. One name, identified in advance, before anything went wrong.

Single-threaded ownership does not mean one person does the work alone. It means one person is unambiguously accountable for making sure the work happens.

Committees advise, review, and escalate. Individuals answer. The failure mode is familiar to anyone who has watched a firm adopt new technology: the KM team assumes IT is monitoring the tool, IT assumes the practice group is reviewing outputs, and the practice group assumes someone signed off at the management level. Nobody is wrong about their own scope, and the system goes ungoverned.

Tier One: The AI Governance Committee

The Governance Committee sits at the executive level and handles decisions carrying strategic weight or substantial risk. Under a well-drafted risk management policy it does four things:

• Approves or rejects risk acceptance for high-impact systems and novel use cases
• Reviews critical incident reports and confirms that systemic problems were remediated
• Resolves disputed impact classifications escalated from the operational tier
• Keeps the firm's AI deployment strategy aligned with its stated risk posture

In a law firm this is usually the management committee, the executive committee, or a standing subcommittee reporting to one of them. What matters is that the people in the room can commit firm resources and accept risk on the firm's behalf. Placing this authority with a technology committee that controls no budget signals that AI governance is a technical housekeeping matter rather than a business one.

Two failure signals are worth watching for. If every question reaches this committee, the delegation structure below it has collapsed and the committee becomes a bottleneck. If nothing ever reaches it, the oversight has become decorative.

Tier Two: The AI Operational Committee

This is where most governance decisions get made. The Operational Committee maintains the AI risk register and keeps it current across every system the firm runs. It reviews and confirms risk assessments and impact classifications for medium and high impact systems. It evaluates risks escalated for severity, novelty, or systemic reach, and decides how each one gets treated. It publishes guidance on risk identification methods, assessment criteria, and control selection. It reports findings, trends, and control weaknesses upward.

The composition tends to include the practice technology or KM lead, the general counsel or ethics counsel, the CISO or IT director, and a partner or two from practice groups using the tools daily. The meeting cadence runs more frequently than the executive tier because the decision volume is higher.

The position of this committee is what makes it useful. It sits close enough to the work to understand how a given tool behaves in practice, and high enough to notice when three separate systems are showing the same failure pattern. A firm without this tier either escalates everything or governs nothing.

System Owners: One Name Per System

Every AI system in the firm has exactly one System Owner. That person is accountable for the system's risk management across its full life, from the first impact classification through deployment, monitoring, and eventual retirement.

Under the risk policy, a System Owner identifies and documents risks during planning, development, and operation; proposes the impact classification; implements required controls and monitors whether they work; keeps risk documentation and the risk register current; and escalates material risk changes or control failures to the Operational Committee.

System Owner is an ownership allocation, not a job title. Only the largest organizations staff it as a dedicated position. In a law firm, the litigation technology manager might own the document review platform while continuing to do the job she was hired for. A practice group leader might own the drafting assistant his group relies on. The requirement is that a specific person is accountable, not that the firm stands up a governance department.

The people best suited to this work are practitioners who understand the system deeply, the ones who know what data it touches and how it behaves at the edges. Governance specialists reviewing documentation from a distance cannot substitute for that knowledge.

One discipline matters more than firms expect. When ownership transfers, document it. Someone leaves, someone changes roles, a system gets handed off in a hallway conversation, and it becomes a governance orphan that nobody reviews and nobody retires.

Mechanism Owners: Someone Owns the Machinery

This is the role firms most often leave out. A Mechanism Owner is accountable for a governance process itself operating effectively and improving over time.

The risk assessment process is a mechanism. The AI system inventory is a mechanism. The incident reporting workflow, the exception process, and the monitoring dashboard are all mechanisms. Each one needs an owner for the same reason each system does. Without ownership, mechanisms decay quietly. Templates go stale. Workflows turn into bottlenecks that teams route around. Dashboards stop being read.

Mechanism Owners ensure the assigned mechanism meets its intended purpose, maintain documentation describing how it functions and how it should be used, implement and oversee the controls embedded in it, monitor its performance and report to the Operational Committee, and recommend improvements based on what practitioners report back.

That last duty is the valuable one. The people using a mechanism are the first to notice when it stops matching reality. Feedback from System Owners to Mechanism Owners should be a formal input to the process, not a hallway conversation that goes nowhere.

For most firms the practical starting assignment is the inventory. Give the AI system inventory one owner and a review cadence before building anything more elaborate on top of it.

The AI Governance Lead Works Both Tiers

Between the executive tier and the practitioners doing the work sits the AI Governance Lead. This person chairs or staffs the committees, maintains the inventory, drives policy development, runs the review calendar, and translates executive decisions into operational practice.

Without that bridging function, governance splits into two disconnected halves. Leadership sets policies that do not survive contact with how the firm works, and the teams building and buying AI tools make choices that nobody at the top hears about. IBM's model illustrates the pattern at scale: a central AI Ethics Board for strategic oversight, supported by trained AI ethics focal points embedded in each business unit who handle routine questions locally and escalate the rest.⁵

Escalation Rights and the Exception Process

Two provisions keep the whole structure honest.

The first is a direct escalation right. Any person in the firm can take a concern straight to the Governance Committee when normal channels are inadequate or serious harm is possible. Governance structures can be captured by the functions they are meant to oversee, and someone who spots a real problem should not have to work through people who have reasons to keep it quiet.

The second is a formal exception process. Requests go to the Operational Committee with a documented business justification, a risk analysis, alignment with the firm's stated risk tolerance, and any compensating controls. Exemptions granted are temporary and conditional. Exception patterns get reviewed periodically, because repeated requests against the same requirement mean the requirement does not fit how the firm works.

Build the exception path from day one. A policy with no release valve produces workarounds, and workarounds are how shadow AI takes hold inside a firm.

Right-Sizing for a Firm That Is Not AmLaw 100

A thirty-lawyer firm cannot sustain two standing committees, and it does not need to. Risk does not scale down with headcount, but structure does.

A firm that buys its AI rather than building it also carries a narrower set of obligations, since model development and validation duties sit with the vendor. What remains is selection, classification, oversight, and the duty to supervise. That is a much smaller job than the one Microsoft and IBM are staffing for, and it does not require standing committees to do well.

In a smaller firm the three tiers compress. An existing governance or risk committee absorbs tier one responsibility for AI alongside its other work. The AI Governance Lead handles tier two coordination directly rather than convening a separate body. One person may own four systems and three mechanisms. What stays constant is that each system and each mechanism has exactly one owner, authority matches impact, and a defined path exists to the next level up.

Build the structure for where the firm is now. When the Governance Lead becomes the bottleneck, that is the signal to distribute. When the tool portfolio outgrows a spreadsheet, that is the signal to formalize.

Why These Roles Carry Professional Responsibility Weight

For law firms, the ownership question is not purely an operational preference. ABA Model Rule 5.1 requires partners and lawyers with comparable managerial authority to make reasonable efforts to ensure the firm has measures in effect giving reasonable assurance that all lawyers conform to the Rules of Professional Conduct.¹ Model Rule 5.3 extends a parallel obligation to nonlawyer assistance, which is where firm-deployed AI tools sit most comfortably.²

The phrase "measures in effect" is doing real work in that sentence. A measure that nobody owns is not in effect. The comment to Rule 5.1 acknowledges that a small firm of experienced lawyers may need only informal supervision and periodic review, while larger firms or those facing recurring ethical difficulty require more elaborate structures.³ That is proportionality stated in the language of professional responsibility, and it lines up with how a risk management policy scales oversight to impact.⁶

Where to Start

Firms that have not yet written a risk management policy usually assume the roles come last, after the framework is drafted. Reverse the order.

List every AI system the firm currently uses, including the ones nobody approved. Put one name next to each. Put one name next to the inventory itself. Name the body that will hear escalations and the person who convenes it. That work takes an afternoon, and it produces something more durable than a twenty-page policy with no owners in it.

The rest of the framework, the classification criteria, the assessment methodology, the treatment pathways, and the monitoring requirements, has somewhere to attach once the names exist. InGlobo AI helps law firms build that ownership map first, then the policy that sits on top of it.