Who should own AI governance within an organization, security, legal, or a dedicated team?

Most mature organizations have moved toward a cross functional ownership model rather than assigning AI governance to a single department. Legal and compliance teams typically take the lead on defining regulatory requirements and understanding how frameworks like emerging AI specific legislation apply to the organization's particular use cases. A dedicated AI governance or risk function, where one exists, generally sets overall policy and coordinates across departments. Security's role has grown significantly within this structure as governance has shifted from being primarily a policy exercise toward something that increasingly requires technical enforcement.

This shift matters because policy decisions about acceptable AI use, data handling boundaries, and required approvals only have real effect if something is actually verifying they are being followed in production. That verification work, including guardrail enforcement, runtime monitoring, and adversarial testing, sits squarely within security's traditional skill set rather than legal or a purely policy focused governance team's, which is why security has increasingly become a core stakeholder rather than a downstream consulted party in AI governance discussions.

The practical division tends to work best when legal and governance define what the rules should be based on regulatory and business risk considerations, and security implements and continuously verifies the technical controls that make those rules operationally real.

Akto sits at that implementation layer. Akto Argus turns policy into enforceable guardrails and continuous monitoring for homegrown AI applications, and Akto Atlas does the same for employee AI usage, which is the translation work that otherwise never gets done.