Skip to content

Roles & Responsibilities

Ready

Word Markdown

Purpose. Defines each governance role in enough detail that it can be put in a job description, recruited for, and assessed against — rather than assumed.

When to use it. Alongside the RACI, when appointing people into roles, and during onboarding.

How to use it. For each role, name a real person and confirm they know they hold it. The most common finding in a first governance audit is a role defined on paper that its supposed holder has never heard of.

Closes assessment gaps

This template addresses Q01, Q25, Q26, Q32 in the readiness assessment.

The template

Data roles

Data Owner

Accountable for a data domain's definitions, quality, access, and risk.

  • Approves access to the domain, particularly Restricted data.
  • Sets and monitors quality thresholds per Data Quality Standard.
  • Accepts or escalates risk relating to the domain.
  • Approves use of the domain's data for AI training.

Typically held by: the senior business leader who owns the process the data comes from — not IT, and not the team who happens to store it.

Data Steward

Responsible for day-to-day custody of a domain.

  • Maintains business definitions and the data catalogue entry.
  • Monitors quality and triages issues.
  • First point of contact for questions about the data's meaning.

Data Custodian

Responsible for technical operation: storage, backup, access enforcement, encryption, and monitoring. Usually sits in engineering or platform.

AI roles

AI Accountable Owner (per system)

Accountable for one AI system's outcomes and compliance across its whole lifecycle.

  • Ensures classification, assessment, and documentation are complete.
  • Signs off deployment and material change.
  • Owns monitoring, incidents, and eventual retirement.
  • Answerable if the system causes harm.

This role cannot be a committee

Every AI system needs one named human. If your answer to "who is accountable for this system?" is a team name, you do not yet have an accountable owner.

Model Developer / ML Engineer

Responsible for building within AI Development & Deployment Standard: documenting data, evaluating performance and bias, producing the Model Card / Model Risk Documentation, and raising risks they discover rather than routing around them.

Product Owner

Responsible for the use case: whether the system should exist, how it affects users, transparency to those users, and designing oversight that works in the real workflow.

Governance & assurance roles

Governance Lead

Accountable for the programme: maintaining frameworks and registers, running the committee, reporting, and driving remediation. The role that makes governance an operating function rather than a document set.

Responsible for lawfulness: regulatory interpretation, DPIAs, lawful basis, contracts, and the independence to say no. Note that a DPO's statutory independence limits how far they can also own delivery.

Security

Responsible for protecting systems and data, including AI-specific threats — see Control Library & Assurance Map.

Internal Audit

Accountable for independent assurance. Must not have designed or operated the controls being assured.

Appointment record

Role Holder Appointed Deputy Confirmed aware
Governance Lead [name] [date] [name] [ ]
Data Owner — [domain] [name] [date] [name] [ ]
AI Accountable Owner — [system] [name] [date] [name] [ ]

Adaptation notes

  • Small organisations: One person may hold several roles. The only combination to avoid is someone assuring their own work — keep independent review genuinely independent, even if that means an external reviewer once a year.
  • Regulated financial services: Map these to your senior management regime responsibilities, and check whether any of them must be held by a certified or approved person.
  • Where a statutory DPO exists: The DPO advises and monitors; they should not also own the processing decisions they oversee, as that compromises the independence the role requires.

Not legal advice

These templates are a head start, not a substitute for professional judgement. Adapt them to your jurisdiction, sector, and risk appetite, and have qualified counsel review anything material before you rely on it.