Ask a CIO who owns AI governance at their bank, and the honest answer is often some version of “it depends which model you mean.” The customer-service copilot sits with the digital team. The fraud model sits with the risk function. The credit-decisioning model has technology building it and risk validating it, with compliance reviewing both after the fact. Each of these arrangements made reasonable sense in isolation, at the time each model was introduced.
Regulators, increasingly, are not interested in whether each arrangement made sense in isolation. They are interested in whether the institution, as a whole, can explain why three different models produce three different standards for the same category of decision – and fragmented ownership is precisely why most institutions currently cannot.
This Is Not an Org Chart Problem. It Is a Control Failure.
The instinct, when ownership is fragmented, is to treat it as an internal coordination issue – something to tidy up eventually, once there’s time. That instinct is exactly backwards. When AI governance is split across the CIO’s technology function, the CRO’s model risk team, compliance, and the business units actually using the models, the result is not just organisational untidiness. It is unclear accountability for outcomes, gaps in control coverage that sit precisely at the seams between functions, and inconsistent standards for what “production-ready” even means from one team to the next.
Regulators increasingly treat fragmentation itself as the finding – not a footnote explaining how a different finding happened.
The Pattern That Surfaces This Gap
It rarely surfaces through a single dramatic incident. It surfaces the way most control failures do – quietly, until someone asks a specific question. A regional bank running fraud detection, credit decisioning, and a customer-service copilot, each governed by a different function with no shared definition of production-ready, typically discovers the gap only when a regulator asks why three different models produced three different confidence thresholds for what is functionally the same customer risk category. The finding that follows is never “the models were wrong.” It is “the institution could not explain why they disagreed” – and that finding lands on both the CIO and the CRO, regardless of which function technically owned which model.
Why the Fix Isn’t Simply “Pick One Owner”
The instinctive fix – assign AI governance entirely to one function – solves the accountability-clarity problem but creates a different one. A CIO who owns AI governance alone tends to build technically excellent monitoring infrastructure without the risk appetite and regulatory context that makes it defensible in an examination. A CRO who owns it alone tends to build a rigorous risk framework that technology can’t practically implement at the pace models are being deployed. Neither version, on its own, produces a governance model both functions will actually run day to day.
What Joint Accountability Actually Looks Like in Practice
The workable version is not shared ambiguity dressed up as collaboration – it is a specific division of accountability across a common architecture, where each function owns distinct layers rather than a vague joint responsibility for everything:
The CRO, with CIO input, owns the risk taxonomy and acceptable-use policy – the definitions that make “high-risk” and “production-ready” mean the same thing across every business line.
- The CIO owns lifecycle governance – the actual development, validation, and deployment standards models are built against.
- Both are jointly accountable for continuous production monitoring – the CIO for the technical infrastructure, the CRO for what it needs to detect.
- Both are jointly accountable for the audit trail and outcome ownership that ties every AI decision back to a named, defensible standard.
Why This Has to Happen Before the Next Model Ships, Not After the Next Finding
The fragmented-ownership pattern rarely gets fixed proactively – it usually gets fixed reactively, in the weeks after an examination has already surfaced the gap, under considerably more pressure and scrutiny than it would have taken to address in advance. Every additional AI model a fragmented governance structure ships is another point of inconsistency an examiner can ask about later. The institutions handling this well are treating joint CIO/CRO accountability as a prerequisite for the next model going into production – not a remediation project that starts after a finding forces it.
The question worth asking this quarter is not whether your institution has an AI governance policy. It is whether your CIO and CRO could sit in the same room today and give an examiner the same answer, in the same language, about why any two of your production models are governed differently.
How This Conversation Usually Starts and How It Should
In most institutions, this conversation only starts after something has already gone wrong – an examination finding, an internal audit flag, or a near-miss that made it to a risk committee. That timing is the problem. Waiting for a trigger event means the CIO and CRO are having this conversation defensively, with a specific finding to explain, rather than proactively, with the freedom to design an accountability split that actually fits how the institution operates. The better version of this conversation happens as a standing quarterly review – CIO and CRO jointly walking through every AI model currently in production, confirming ownership at each of the four governance layers is still assigned to a named individual, and catching the drift toward fragmentation before a regulator does it for them.
The institutions that get ahead of this don’t necessarily have fewer AI models in production than their peers, or a more generously staffed governance function. They have simply made the CIO/CRO joint review a standing item rather than a reactive one – which turns fragmented ownership from an inevitable byproduct of moving fast into a gap that gets caught within a quarter, not within an examination cycle.
The full joint CIO/CRO mandate, including the specific accountability split by governance layer, is set out in Paper 5 of Maveric’s CIO Mandate Series:
AI Compliance and Regulatory Governance: A CIO & CRO Mandate for Global Banks
