Where Are the AI Governance Roles? An Early-Stage Empirical Mapping of Presence, Absence, and Structure in Organisational AI Oversight

Abstract

Purpose: This research investigates where formal responsibility for artificial intelligence (AI) lies within organisations and how the presence, absence, or structure of that responsibility affects their ability to govern AI effectively. Method: The study surveys 351 organisations across sectors and regions to examine AI governance roles. It focuses on authority, resources, and organisational integration, using hierarchical cluster analysis to identify governance configurations. Findings: The results indicate that formal AI governance roles are unevenly distributed and often weakly integrated into organisational structures. When these roles exist, they are usually placed below the executive level, lack sufficient authority, and differ greatly in the resources available to them. A cluster analysis reveals four governance configurations—Governance Absence, Symbolic Governance, Operational Governance, and Institutionalised Governance, indicating that governance capacity is primarily influenced by how well these roles are embedded in the structure, rather than just their presence. Implications: The findings suggest that AI governance may be better understood as a structural and organisational design issue, with potential implications for accountability and oversight. However, the relationship between governance configurations and outcomes, such as ethical risk and compliance, remains an area for future research. Originality: The study takes an absence-based approach to AI ethics, establishing a baseline for future research on governance maturity, compliance, trust, and ethical risk.

1. Introduction

Artificial intelligence (AI) technologies are increasingly being adopted in organisations’ decision-making processes across industries, with implications for outcomes in areas such as finance, healthcare, public administration, and digital markets. There is an increasing desire to create more comprehensive policy frameworks and ethical principles that emphasise accountability, openness, justice, and human oversight (Floridi & Cowls, 2019; OECD, 2022; Papagiannidis et al., 2025). A growing number of frameworks and standards are designed to implement AI governance within organisations, moving beyond general ethical principles. Key examples include the National Institute of Standards and Technology AI Risk Management Framework (NIST, 2023), which provides guidance on risk management and governance, as well as international standards such as ISO/IEC 42001 (ISO, 2023b) for AI management systems and ISO/IEC 23894 (ISO, 2023a) for AI risk management.

Both industry and academia emphasise the importance of algorithmic auditing and responsible AI practices, underscoring the need for governance tools such as auditability, documentation, and accountability frameworks (Raji et al., 2020; Koshiyama et al., 2024). Together, these frameworks shift the conversation from theoretical principles to practical implementation, assuming that organisations have the necessary governance responsibilities and capacities.

Nonetheless, it remains unclear, in particular, whether organisations truly possess such governance capacities. There is growing advocacy among policymakers and practitioners for formal AI governance roles, such as Chief Artificial Intelligence Officers, AI Ethics Officers, and Algorithmic Auditors (Gopal et al., 2025). However, there is insufficient empirical evidence on the existence, structure, and responsibilities of these AI oversight roles.

The absence of empirical evidence is important. Conversations regarding ethical risks in AI systems generally emphasise concerns such as skewed data, flawed models, or deficiencies in governance within existing frameworks (Hanna et al., 2024; Papagiannidis et al., 2025). Nonetheless, ethical hazards may also arise during the initial stages of organisational design. In these cases, the responsibility for AI is either ambiguously defined, unassigned, or not included within the institution (Hanna et al., 2024).

This paper aims to address this gap by shifting focus from presumed governance capacity to its empirical verification. Instead of assessing how effectively governance operates, the study first questions whether governance responsibility even exists within organisations.

Accordingly, the research is guided by the following key question:

Where is formal responsibility for AI located within organisations, and what insights do its presence, absence, and structural configuration reveal about organisational AI governance capacity?

To explore this, the paper presents a cross-sectoral and multi-regional empirical analysis of AI governance roles, investigating their presence, structural placement, authority, and resource distribution. It also identifies patterns of governance maturity across organisations. This approach reframes AI governance from a question of performance to one of structural design.

This study operationalises the central question by investigating five specific dimensions of AI governance: (i) the existence of formal governance roles, (ii) sectoral variations, (iii) geographical disparities, (iv) structural attributes of roles, and (v) developing governance maturity profiles. The aspects are articulated in the study questions outlined in Section 3.

This document is structured as follows: Section 2 examines the literature on AI ethics and governance, emphasising a deficiency in the distribution of accountability. Section 3 articulates the study questions, while Section 4 delineates the methodology. Section 5 and Section 6 present the findings, followed by limitations and conclusions.

2. Literature Review

2.1. Normative AI Ethics and the Presumption of Organisational Capability

In the last decade, the rapid expansion of artificial intelligence has prompted significant scrutiny of its ethics and appropriate utilisation. Central frameworks underscore concepts such as accountability, openness, fairness, explainability, and human oversight, as commonly defined in ethical guidelines and governance toolkits (Floridi & Cowls, 2019; OECD, 2019; European Commission, 2019). These initiatives have influenced the dialogue on ethical AI and have impacted regulatory systems. This literature typically assumes that firms have the internal capacity to assign responsibility, coordinate oversight, and respond to governance demands (Morley et al., 2020; Prem, 2023).

This assumption is often implied rather than explicitly stated, but it is present in much of the literature and in operational frameworks that emphasise governance functions, executive accountability, internal training, risk management, and audit processes.

Emerging positions such as Chief Artificial Intelligence Officer (CAIO), AI Ethics Officer, and Algorithmic Auditor are being introduced alongside traditional roles, including Chief Information Officer and Chief Risk Officer (Schmitt, 2024) for implementations. This development indicates a shift towards formalising AI governance.

Despite recognition of these roles, there is limited empirical evidence on their actual adoption, their positioning within organisations, or the authority and resources they are granted. The literature frequently transitions from ethical principles to assumed execution without investigating the existence of these governance positions or the ambiguity around accountability for AI oversight (Mittelstadt, 2019; Morley et al., 2020). The literature outlines what organisations should do to govern AI but offers little empirical evidence on the actual presence and implementation of this governance. This raises an important question: how can we empirically assess organisational AI governance? One way to know this is to investigate whether responsibility for AI is formally assigned and integrated into organisational structures through designated roles and governance functions. This approach allows for a shift from theoretical expectations to empirical validation.

2.2. Gaps in Accountability, Responsibility, and Governance

Accountability is a key principle in AI governance, often discussed with transparency, fairness, and explainability (Frimpong, 2025; Floridi & Cowls, 2019; Mittelstadt, 2019). In organisational contexts, accountability goes beyond a normative requirement; it involves how responsibility is assigned, distributed, and enacted within institutions (Bovens, 2007; Wieringa, 2020). This study views accountability as a result of governance design, focusing on the formal assignment of responsibility for AI systems and how well it is supported by organisational structures (Raji et al., 2020; Koshiyama et al., 2024).

Existing literature on algorithmic accountability highlights the difficulties of identifying responsible actors within complex socio-technical systems (Bovens, 2007; Frimpong, 2025; Wieringa, 2020). Much of this research emphasises mechanisms like transparency, auditability, and contestability, assuming that accountable actors can be easily identified within organisational structures.

However, accountability in practice can be diffuse, fragmented, or poorly institutionalised across different organisational units (Rahwan, 2018; Burrell, 2016). This indicates that accountability relies not just on mechanisms but also on structural design—specifically, how responsibility for AI oversight is formally assigned and integrated into the organisation.

Therefore, this study focuses on a key structural condition for accountability—the presence and configuration of roles responsible for AI governance—rather than directly measuring accountability outcomes.

2.3. Organisational AI Governance and Role Emergence

Building on this perspective, organisational AI governance should be viewed as both a set of principles and a measurable structural arrangement. Specifically, looking at the presence and configuration of defined governance roles helps assess if responsibilities are clearly assigned and integrated within the organisation. This approach allows for an empirical examination of governance capacity rather than relying on assumptions. It shifts the focus from expected implementations to whether governance is clearly established through identifiable roles, reporting lines, authority, and resources. Many reports recommend establishing roles such as Chief AI Officers, ethics boards, and responsible AI leads (Tedeneke, 2023; Deloitte, 2022). Scholarly research underscores the need to integrate ethical and governance considerations into AI development (Shneiderman, 2020; Wirtz et al., 2019).

Nonetheless, there is a lack of empirical evidence regarding the existence and structure of these jobs. The majority of the study is confined to singular examples, particular industries, or prominent organisations, yielding less understanding of overarching trends. Moreover, discussions of these roles often overlook essential aspects, including seniority, reporting relationships, authority, and resource availability.

2.4. Symbolic Governance and Institutional Adoption

Organisational and institutional theory offers a valuable framework for understanding the emergence of governance roles related to artificial intelligence (AI). In particular, the concept of symbolic governance suggests that organisations may establish formal structures not solely to implement meaningful change but also to convey legitimacy to external stakeholders (Meyer & Rowan, 1977).

This theoretical perspective is essential for the following empirical analysis. The presence of formally designated AI governance roles may indicate genuine governance capacity or may simply reflect a symbolic adoption, where roles exist without the necessary authority, resources, or organisational integration. Understanding the difference between these scenarios is key to assessing governance maturity and determining if formal structures lead to effective governance.

2.5. Ethics of Absence and the Empirical Blind Spot

The current literature reveals a notable deficiency in the allocation of accountability for AI within organisations. Although frameworks delineate ethical standards and responsibilities, the structure of duty remains ambiguous. This gap underscores the necessity for absence-based ethics, indicating that ethical hazards may arise not solely from governance failures but also from the absence of governance frameworks.

We differentiate between the lack of formal governance roles and the broader absence of governance in organisations. AI-related oversight can be integrated into existing managerial functions, like risk and compliance, or managed through policies, procedures, technical tools, and committees that may not be specifically labelled as “AI governance.” This study focuses on formal role-based governance as a clear aspect of organisational design, while acknowledging that governance can also take embedded or informal forms that this approach might not fully capture. In this study, “governance absence” means there are no formally designated roles or clear responsibilities for overseeing AI, not a lack of governance mechanisms in general.

Collectively, the existing literature highlights a significant empirical gap. Although normative AI ethics frameworks outline the components of responsible governance and accountability, research explores how responsibility may be distributed; there is a structural under-examination about whether responsibility for AI is inherently assigned within organisations. This lack of evidence informs the current study’s focus on the existence, non-existence, and arrangement of AI governance roles within organisations, as formalised in the subsequent research questions.

3. Analytical Framework and Research Questions

This study focuses on a central analytical question (CRQ):

Where is formal responsibility for AI located within organisations, and what insights do its presence, absence, and structural configuration reveal about organisational AI governance capacity?

To address this question, we focus on two core analytical sub-questions (ASQ):

• ASQ1: Governance Presence and Distribution

What is the extent of formal AI governance roles in organisations, and how do these vary across different institutional contexts?

• ASQ2: Structural Embedding and Governance Capacity

How are these roles structured in terms of authority, resources, and integration within organisations, and what governance configurations result from these structures?

Operational Dimensions

To address these questions, the study conducts an analysis of five key dimensions:

• Existence of formal AI governance roles (prevalence)
• Sectoral variation
• Geographical variation
• Structural characteristics (authority, reporting, resources)
• Governance maturity profiles (cluster analysis)

Instead of viewing each dimension as a separate research question, the study combines them into a cohesive analysis of organisational AI governance.

4. Methodology

4.1. Research Design

This study uses a quantitative, cross-sectional research design to map formal AI governance roles in organisations. It aims to descriptively and exploratively analyse roles such as Chief Artificial Intelligence Officer (CAIO), AI Ethics Officer, Responsible AI Lead, and Algorithmic Auditor.

Given the absence of an existing dataset on AI governance roles, the goal is not to achieve statistical generalisation but to establish a foundational empirical baseline. The study examines (i) the existence of these roles, (ii) their adoption across various sectors and regions, and (iii) how they are integrated within organisations. This method enables exploratory inference and typology creation, acknowledging that results are suggestive rather than representative of the entire population.

A survey-based design is appropriate for three primary reasons: it emphasises organisational governance roles; a cross-sectional methodology facilitates systematic comparisons across industries and regions; and essential governance attributes can be precisely captured through structured self-reporting by organisations.

The primary unit of analysis is the organisation itself, not individual respondents.

4.2. Sampling Strategy and Scope

4.2.1. Sampling Approach

The research uses a targeted multi-sector sampling strategy, supplemented by snowball sampling, to reach organisations in AI-intensive areas and senior respondents involved in AI activities. This approach focuses on a wide range of sectors and regions rather than aiming for representativeness within any specific industry or location, aligning with the study’s exploratory goals and enabling comparisons across sectors and regions.

The integration of targeted and snowball sampling is appropriate for exploratory mapping when a defined sampling frame is lacking; however, it may introduce selection bias, as participation is often higher among organisations with greater visibility, engagement, or awareness of the subject matter (Etikan et al., 2016). Thus, the prevalence estimates presented in this study should be seen as reflective of the sample’s patterns rather than representative of the population as a whole. The methodology aims to emphasise breadth and exploratory understanding rather than statistical generalizability.

4.2.2. Identification of Organisations and Recruitment of Participants

A total of around 1100 organisations were reached via direct invites and network-based dissemination. The final dataset has 351 legitimate organisational responses.

Due to the absence of a global register of organisations with explicit AI governance responsibilities, entities were identified pragmatically through a targeted mapping approach. Over seven months, we assembled a list using publicly available resources and professional networks. Our approaches included:

• Exploring corporate websites with an emphasis on sections related to AI, Data, Innovation, Digital, Risk and Compliance, and Governance.
• Researching professional networking and job-search websites (such as LinkedIn, Indeed, Glassdoor, Google Careers and company career pages) to identify roles or governance functions related to AI.
• Consulting publicly available business profile websites (e.g., Crunchbase, Bloomberg company profiles, and Reuters company profiles) to validate organisational context and AI-facing functions.
• Reviewing organisational newsrooms, press releases, annual reports, ESG/sustainability reports, and statements on corporate governance.

We carried out specific keyword searches using combinations like “responsible AI lead,” “AI governance committee,” “AI ethics officer,” “model risk AI,” “algorithm/audit,” “CAIO,” “AI risk compliance,” and “AI policy,” along with sector and country-specific terms.

Organisations were included in our list if they demonstrated active use of AI or governance relevance, such as automation initiatives, responsible AI declarations, or ongoing recruitment for AI governance roles. We then selected potential survey participants based on their seniority and connection to AI-related operations, with a focus on roles in technology, data, innovation, risk, and governance. The survey link (Google Forms) was distributed through direct email invitations, and recipients were encouraged to forward it to other qualified representatives to extend our reach. This strategy emphasised both breadth and relevance within organisational contexts, aligning with the study’s initial purpose of empirical mapping.

All identification was based entirely on publicly accessible information and direct engagement.

4.2.3. Sectoral Coverage

Organisations were picked from a varied range of areas where the implementation of artificial intelligence is either well-established or undergoing rapid expansion, including:

• Banking, financial services, and insurance
• Healthcare and pharmaceuticals
• Telecommunications and technology
• Retail and e-commerce
• Logistics and supply chain
• Manufacturing and mining
• Energy and utilities
• Consulting and professional services
• Public sector and government institutions

This selection facilitates the examination of how regulatory impact, operational risk, and organisational complexity influence the establishment and structuring of AI governance roles.

4.2.4. Geographical Coverage

Responses were collected from organisations headquartered or operating across six major regions:

• Europe
• North America
• Asia-Pacific
• Africa
• Latin America and the Caribbean
• Middle East

This global viewpoint provides a thorough assessment of geographic variations and inequalities in the acceptance of AI governance positions.

4.3. Respondents and Inclusion Criteria

To ensure legitimacy at the organisational level, respondents were mandated to meet the following criteria:

• Assume a senior management or leadership position overseeing AI implementation, digital strategy, data governance, risk management, compliance, or innovation (e.g., CIO, CTO, CDO, Head of Data, Head of Risk/Compliance, Innovation Lead).
• Represent an organisation that either actively employs AI systems or is in the process of implementing AI/ML technology.
• Possess a comprehensive awareness of the organisational governance structures, reporting systems, and policy requirements pertaining to AI.

These requirements guarantee that the feedback embodies organisational frameworks and governance structures rather than personal perspectives or interpretations.

4.4. Data Collection and Survey Instruments

Data were gathered using a standardised online questionnaire created through Google Forms, specifically tailored for this study to evaluate organisational-level AI governance roles and their integration. The survey comprised six sections.

• Organisational profile (sector, size, geography).
• Status of AI adoption and functional applications.
• Presence of formal AI governance positions.
• Characteristics of the highest AI governance position.
• Governance resources.
• AI governance maturity and contextual application.

The survey used categorical and ordinal response formats suitable for early-stage empirical mapping (Dillman et al., 2014). Organisational profiles were captured with single-choice categorical items. AI adoption status was assessed using a three-category item:

• Yes, (AI/ML use)
• No (AI use)
• Plans to adopt within 18 months.

Measurements

The study measured formal AI governance roles by asking whether organisations held specific positions, such as Chief Artificial Intelligence Officer (CAIO), AI Ethics Officer, Responsible AI Lead, Algorithmic Auditor, AI Risk/Compliance Officer, and AI Governance Committees. Respondents answered “Yes,” “No,” or “Not sure” for each role, highlighting both the absence of roles and any uncertainty regarding governance. They were also asked to indicate the total number of distinct AI governance roles in their organisation (0, 1, 2, 3, 4+, or “Not sure”).

Respondents provided information about the highest AI governance role’s seniority (e.g., C-suite, VP/Director, senior manager, manager, or committee without a formal leader), its reporting line (e.g., CEO, board of directors, CIO/CTO, CRO, CCO, CDO, HR executive), and its mandate. The mandate was assessed using a checklist of governance functions related to responsible AI, including AI strategy, AI ethics, implementation of Responsible AI, risk management, compliance, algorithmic auditing, data governance oversight, and internal AI literacy/training.

Governance capacity was measured by looking at resources and decision-making authority. Resources were classified based on whether AI governance had a dedicated team (5+ people), a small team (2–4 people), a single individual, shared responsibilities, no dedicated resources, or an uncertain status. Decision-making authority was assessed on a scale ranging from high authority (the ability to approve or veto AI systems) to moderate authority (an advisory role), low authority (limited to documentation/compliance), and very low authority (a symbolic role).

The survey included a checklist of governance mechanisms such as AI ethics policies, risk assessment processes, model documentation standards, algorithmic audits, bias monitoring, incident reporting, cross-functional governance, and training programmes. Respondents could also select options for the absence of these mechanisms or indicate uncertainty.

Respondents assessed their organisation’s AI governance maturity on a five-point Likert scale (1–5). The survey also gathered data on AI usage intensity and risk exposure, asking about the number of AI/ML systems deployed (1–3, 4–10, 11–20, 21–50, more than 50, or “Not sure”) and the criticality of AI systems (low-supportive, medium-operational, high-stakes, mixed, or “Not sure”).

Before complete implementation, the questionnaire underwent pre-testing with a select group of professionals (n = 8–12) possessing expertise in AI, data governance, and organisational risk functions. The pre-test sought to evaluate the clarity, relevance, and interpretability of the questions. Feedback resulted in slight modifications to phrasing and response options to enhance clarity and diminish ambiguity.

4.5. Data Preparation and Analytical Strategy

After data collection, we screened responses for completeness and consistency, using each survey response as a single organisational observation. We conducted descriptive analyses on the entire sample and structural analyses on organisations with at least one formal AI governance role. Responses labelled “Not sure” were included to highlight governance visibility gaps, while cases with missing or ambiguous responses on key variables were excluded for analyses needing ordered interpretation, reducing the sample size for some analyses.

The analysis focused on the two main questions (ASQ1 and ASQ2), using each empirical dimension to assess the presence of governance and its structural embedding.

The analysis focuses on identifying patterns and differences without making causal claims or generalising findings to the larger population.

4.6. Cluster Analysis and Typology Development

We utilised hierarchical clustering via the Ward (1963) method with Euclidean distance, as this technique is optimal for exploratory typology construction and minimises within-cluster variance. This methodology is appropriate for preliminary mapping research intended to generate profiles that facilitate subsequent hypothesis formulation and evaluation (Dillman et al., 2014).

It categorises organisations by reducing the overall variation within each cluster, quantified as the sum of squared deviations between each organisation’s governance profile and the average profile of its cluster:

$${W= \sum (distance between each organisation and its cluster centre)}^2$$

The study constructs each organisation’s profile using standardised governance indicators. Consequently, organisations with analogous governance systems are categorised together, whereas those with disparate configurations are assigned to separate clusters.

Table 3A presents aggregated governance indicators: role formalisation, authority, resource allocation, mandate breadth, and governance maturity. Together, these indicators reflect the level of institutionalisation of AI governance.

The complete survey instrument, along with the corresponding response options, is provided in Appendix A.

4.7. Ethical Consideration

The study adhered to the Office for Human Research Protections (1979) ethical guidelines and conducted an organisational survey of senior professionals using non-sensitive information. Participation was voluntary, with participants informed about the study’s purpose and the use of aggregated data; no personal information was collected. Respondents could request a summary of the results, which would be kept separate from the analysis dataset. Data were analysed and presented in aggregate to minimise re-identification risks, ensuring safe anonymised reporting to participants.

5. Results

5.1. Sample Characteristics (Contextual Overview)

In this study, the level of AI adoption functions as a contextual variable rather than as an outcome metric. It is utilised for subgroup analysis and governance maturity assessment, without suggesting any causal correlations between AI adoption and formal governance responsibilities.

Figure 1 indicates that 73% of organisations in the sample are currently using AI, while 14.0% plan to adopt it within the next 18 months. This shows that most organisations are already encountering or will soon face AI-related governance challenges.

Figure 2 shows the distribution of organisations by size. The sample includes medium (32%), large (21%), and very large organisations (29%), as well as smaller firms (12%) and global enterprises (6%). This variety enables a comparison of governance structures across different organisations.

Figure 3 shows the geographical breakdown of the sample: Europe (37%) and North America (22%) have the largest shares, followed by Asia-Pacific (14.%), Latin America and the Caribbean (10%), Africa (9%), and the Middle East (8%). This distribution allows for regional analysis but is not globally representative.

Collectively, these characteristics establish a foundational context for the ensuing analysis of artificial intelligence governance structures.

5.2. Governance Presence and Distribution

The first dimension of analysis examines the presence of and variation in formal AI governance roles across organisations.

The findings show that not all organisations have established formal AI governance roles. Some have titles such as Chief Artificial Intelligence Officer (CAIO), Responsible AI Lead, or AI Governance Committee, while many others either do not have formal roles or incorporate these responsibilities into existing functions.

5.2.1. Sectoral Variation

Table 1. Sectoral Distribution of Surveyed Organisations.

Sector of Organisation Respondents Operate In	Frequency	%
Banking/Financial/Insurance	68	19.37%
Public Sector/Government	43	12.25%
Consulting/Professional Services	36	10.26%
Retail/E-commerce	34	9.69%
Mining/Manufacturing	32	9.12%
Healthcare/Pharmaceuticals	31	8.83%
Telecommunications/Technology	26	7.41%
Sports/Entertainment	24	6.84%
Logistics/Supply Chain	22	6.27%
Education	16	4.56%
Energy/Utilities	9	2.56%
Agriculture/Farming	6	1.71%
Hospitality	2	0.57%
Transportation	1	0.28%
Building and construction	1	0.28%
Total	351	100%

shows the distribution of organisations across different sectors. It includes both highly regulated sectors like banking, healthcare, and the public sector and less regulated sectors such as retail, consulting, and logistics.

AI governance roles are more common in highly regulated industries due to higher regulatory exposure and risk sensitivity. In contrast, less regulated sectors often have informal or fragmented governance structures. This indicates that institutional pressures may affect how formal governance roles are established.

5.2.2. Geographical Variation

Table 2. Regional Variation in the Adoption of AI Governance Roles (%).

Region	CAIO	AI Ethics Officer	Responsible AI Lead	Algorithmic Auditor	AI Risk/Compliance Officer	AI Governance Committee
Africa	0.0	3.1	21.9	0.0	15.6	18.8
Asia-Pacific	18.4	12.2	22.4	4.1	2.0	38.8
Europe	13.0	8.4	27.5	3.8	11.5	26.7
Latin America/Caribbean	5.6	2.8	22.2	0.0	27.8	19.4
Middle East	7.4	7.4	22.2	0.0	18.5	18.5
North America	11.8	2.6	40.8	1.3	11.8	27.6

and Figure 4 show significant regional differences in AI governance roles. North America and Europe have higher adoption rates for formal roles like Responsible AI Leads and governance committees.

In contrast, Africa and Latin America have fewer executive-level roles, with governance often part of operational or compliance functions. There is also a notable absence of Algorithmic Auditors, highlighting the underdevelopment of formal AI auditing across regions.

These findings are descriptive and do not imply causation, but they reveal systematic variations in governance across contexts, suggesting the need for further investigation.

Figure 4’s heatmap highlights notable regional inequalities in the creation of official AI governance roles. North America and Europe exhibit significantly higher levels of institutionalisation, particularly among Responsible AI Leads and AI Governance Committees. North America exhibits the highest density of Responsible AI Leads, signifying a governance strategy that emphasises operational accountability and integrates these positions into AI development and execution frameworks.

These studies provide preliminary patterns rather than precise population estimates. The heatmap provides an initial empirical visualisation of variations in organisational AI governance frameworks across different regional contexts. It underscores the influence of geographical contexts, regulatory sophistication, and organisational capability on the formation of AI governance positions. Although the insights are preliminary, they provide a foundation for understanding spatial disparities in AI governance.

5.3. Structural Embedding of AI Governance

The second analytical dimension looks at how AI governance is integrated into organisations. This includes aspects like seniority, reporting structures, mandates, resource allocation, and decision-making authority.

The percentages in Panels A–E below are calculated from surveyed organisations that have reported at least one established AI governance role. Totals presented may vary from the overall sample size.

The findings reveal that structural embedding varies significantly across organisations, with important implications for governance capacity.

5.3.1. Seniority and Organisational Positioning

Panel A indicates that AI governance roles are mainly found at the Vice President/Director or managerial levels, with few in the C-suite. This implies that AI governance is generally viewed as an operational task rather than a strategic leadership role.

Panel A. Seniority of the Highest AI Governance Role	Frequency	%
Vice President/Director	95	27.07%
Senior Manager	58	16.52%
Manager	48	13.68%
Committee without formal leader	43	12.25%
C-suite (CAIO, CIO/CTO with explicit AI mandate)	22	6.27%
Not sure	18	5.13%
Total	284	80.91%
Invalid	67	19.09%
Total	351	100%

5.3.2. Reporting Structures

Panel B shows that governance roles are usually integrated into existing organisational structures and report to positions such as Chief Risk Officer, CIO/CTO, or other senior executives. It is uncommon for these roles to report directly to the CEO or board, indicating that governance is seldom centralised at the highest decision-making levels.

Panel B. Reporting Line (Reports to)	Frequency	%
Not sure	79	22.51%
Chief Risk Officer	48	13.68%
CIO/CTO	32	9.12%
HR Executive	30	8.55%
Board of Directors	29	8.26%
CEO	27	7.69%
Chief Compliance Officer	21	5.98%
Chief Data Officer	16	4.56%
Total	282	80.34%
Invalid	69	19.66%
Total	351	100%

5.3.3. Mandate and Functional Scope

Panel C indicates that governance mandates often combine strategy, ethics, risk management, compliance, and operational oversight. While this highlights the comprehensive approach to AI governance, it may also lead to a diffusion of responsibility.

Panel C. Primary Mandate	%
Responsible AI implementation (operational focus)	12.1%
AI strategy (strategic focus)	11.7%
Combined ethics and Responsible AI	5.1%
AI risk management (including compliance)	7.45
Mixed or multi-functional mandate *	63.7%
Total	100%
* Roles that combine multiple functions, including strategy, ethics, audit, risk, compliance, training, or data governance.

5.3.4. Resources and Capacity

Panel D shows significant differences in resource allocation. Some organisations have dedicated governance teams, while others have shared responsibilities or very few staff. This unevenness indicates that governance capacity varies widely between organisations.

Panel D. Resources Allocated to AI Governance	Frequency	%
Small team (2–4 people)	69	19.66%
Dedicated team (5+ people)	65	18.52%
Not sure	57	16.24%
Shared responsibilities across teams	56	15.95%
No dedicated resources	24	6.84%
Single individual	13	3.7%
Total	284	80.91%
Invalid	67	19.09%
Total	351	100%

5.3.5. Decision-Making Authority

Panel E shows that most governance roles operate in an advisory capacity, with few having the authority to make significant decisions, such as approving or vetoing AI systems. This reveals a gap between responsibility and control.

Panel E. Decision-making authority (level of authority)	Frequency	%
Moderate: Advisory role but influential	113	32.19%
High: Can veto or approve AI systems	58	16.52%
Low: Limited to documentation/compliance	56	15.95%
Very low: Symbolic role	39	11.11%
Not sure	19	5.41%
Total	285	81.2%
Invalid	66	18.8%
Total	351	100%

5.3.6. Visibility and Clarity

A key observation from all panels is the high number of “Not sure” responses, indicating a lack of clarity about governance structures. This suggests fragmented responsibilities and weak organisational integration.

These results show that governance capacity relies not just on having defined roles but also on how those roles are organised, supported, and empowered within the organisation.

5.4. Governance Maturity Profiles (Cluster Analysis)

A cluster solution was chosen on the basis of interpretability, internal coherence, and conceptual relevance, rather than purely statistical optimisation (Dubes & Jain, 1980; Everitt et al., 2011). The cluster analysis uses standardised governance indicators focusing on key aspects of AI governance: (i) formal roles (number of governance roles), (ii) governance authority (decision-making power), (iii) resource allocation, (iv) mandate breadth (number of governance functions), and (v) self-assessed governance maturity.

All variables were normalised for comparability. Hierarchical clustering was performed using Ward’s (1963) method with Euclidean distance, which helps minimise within-cluster variance and is effective for exploratory typology development.

The number of clusters was chosen based on interpretability and coherence rather than statistical criteria, resulting in governance configurations that are analytically derived instead of statistically optimal partitions.

Table 3. (A) Empirical AI Governance Cluster Profiles (Standardised Indicators). Cluster centroids represent the average governance profile of organisations within each cluster. All indicators are standardised. (B) Interpretative Labels and Descriptions of AI Governance Clusters.

(A)
Cluster	n (%)	Role Formalisation (Mean)	% with No Formal Roles	Governance Authority (Mean)	Resources (Mean)	Governance Maturity (Mean)
Cluster 1	72 (20.5%)	0.00	100.0%	0.06	0.00	2.94
Cluster 2	87 (24.8%)	0.33	66.7%	1.46	1.11	1.92
Cluster 3	113 (32.2%)	1.23	5.3%	2.78	2.21	2.57
Cluster 4	79 (22.5%)	1.76	1.3%	3.51	3.10	3.81
(B)
Cluster		Label		Description
Cluster 1		Governance Absence		No formal AI governance roles; minimal authority and resources; governance largely informal or undefined
Cluster 2		Symbolic Governance		Limited formalisation with weak authority and resources; governance structures exist but lack substantive capacity
Cluster 3		Operational Governance		Governance roles embedded within operational functions; moderate authority and resources but limited strategic integration
Cluster 4		Institutionalised Governance		Strong formalisation with higher authority, dedicated resources, and broader organisational integration

Note: Role formalisation is measured by the number of distinct AI governance roles (0–6). Governance authority indicates decision-making power on a scale from low (symbolic) to high (approval/veto authority). Resource allocation shows the extent of dedicated governance capacity. Governance maturity is self-assessed on a Likert scale (1–5). All variables were standardised before clustering for comparability.

A presents the results of the clustering procedure, showing the empirical cluster profiles based on standardised governance indicators.

For ease of interpretation, the clusters derived from the empirical analysis have been appropriately labelled and are described in Table 3B.

The cluster solution, detailed in Table 3B, identifies four distinct governance configurations: Governance Absence, Symbolic Governance, Operational Governance, and Institutionalised Governance. These configurations vary in role formalisation, authority, resource allocation, and organisational embedding, demonstrating that AI governance exists on a continuum of institutional development rather than as a binary condition.

The interpretative labels were assigned based on the positioning of clusters in standardised governance indicators, focusing on role formalisation, authority, and resource allocation. These labels aid in analysis but do not suggest fixed organisational categories. Therefore, the cluster solution serves as an exploratory typology, simplifying complex governance structures into clear profiles.

Interpretation of Governance Profiles

Here, we outlined the governance configurations identified in the analysis, based on the empirical cluster profiles (Table 3A) and their interpretative labels (Table 3B).

The cluster solution indicates that organisations differ not only in the presence of a Chief AI Officer (CAIO) or an ethics officer but also in their governance configurations, which vary in terms of role formalisation, embedding, resourcing, and authority.

The Institutionalised Governance profile encompasses organisations that exhibit robust governance characterised by significant authority, ample resources, and a sense of maturity. In contrast, Governance Absence denotes that organisations lack formal roles for AI oversight, leading to unassigned responsibilities.

Two intermediate profiles are more common: Symbolic Governance and Operational Governance. Symbolic Governance is characterised by roles that are only weakly institutionalised, often lacking adequate resources and authority, indicating that governance is primarily nominal. Operational Governance consists of organisations that have defined governance roles within their operational divisions and exhibit a moderate level of authority and resources yet lack the senior-level backing found in the Institutionalised category.

Overall, mature and institutionalised AI governance is rare; many organisations fall into transitional or low-capacity governance configurations. This typology offers a basis for benchmarking across sectors and regions and paves the way for future research on how these governance profiles affect compliance, stakeholder trust, and ethical incident rates.

These profiles are interpretative constructs derived from empirical clustering and are intended to support analytical understanding rather than represent fixed or exhaustive categories.

6. Discussion

This study investigates where formal responsibility for AI lies in organisations and what this indicates about their capacity for AI governance. By moving from theoretical expectations to empirical evidence, the findings provide a clear understanding of the actual structure of AI governance in various organisations.

6.1. Governance Presence and Distribution (ASQ1)

The findings indicate that formal AI governance roles are inconsistently established across organisations. While some have positions like Chief Artificial Intelligence Officer (CAIO) or Responsible AI Lead, these roles are not widespread and are often part of other areas such as risk, compliance, or IT.

This shows that role-based governance is not yet a standard practice, despite strong pressures for responsible AI. The lack of formal roles does not mean there are no governance mechanisms; it highlights how organisations vary in how they formalise and signal their governance responsibilities.

Differences across sectors and regions support this view. Organisations in highly regulated fields such as finance, healthcare, and the public sector often have more formal governance structures, which align with institutional theories and regulatory pressures (OECD, 2022; Wieringa, 2020). In contrast, less regulated sectors tend to have more informal arrangements.

Geographical differences also play a role. Regions like North America and Europe generally show higher adoption of formal governance roles, while other areas may have less structured governance.

These findings challenge the assumption that organisations have clear and formalised governance capacities. Instead, governance appears to be context-dependent, uneven, and often incomplete.

6.2. Structural Embedding and Governance Capacity (ASQ2)

The findings show that governance capacity is significantly influenced by the structure of AI governance roles within organisations. Key points include:

• Role Positioning: Most AI governance roles are situated below the executive level, limiting their strategic impact. This suggests that AI governance is often seen as an operational task instead of a key organisational priority.
• Authority: Many governance roles have limited authority, serving mainly in advisory capacities rather than as decision-makers. Few have the power to veto or approve AI systems, highlighting a disconnect between accountability and control. This reinforces ongoing concerns that accountability mechanisms are challenging to implement in complex socio-technical systems (Bovens, 2007; Raji et al., 2020).
• Resource Allocation: There is a significant disparity in how resources are allocated for governance. Some organisations have dedicated teams, while others depend on shared responsibilities or single individuals, indicating that effective governance requires both role existence and organisational commitment.
• Fragmented Ownership: The prevalence of “Not sure” responses across various governance areas indicates weak internal communication and fragmented ownership of responsibilities, which poses challenges for effective governance.

The cluster analysis reveals four governance maturity profiles: Governance Absence, Symbolic Governance, Operational Governance, and Institutionalised Governance. This illustrates that organisations vary not only in the presence of governance roles but also in the extent to which governance is embedded.

Notably, fully developed governance systems (Institutionalised Governance) are rare. Many organisations exist in transitional states (Symbolic or Operational Governance), where governance structures lack the necessary authority, resources, or integration to function effectively.

These insights underscore the idea that AI governance is primarily a structural and organisational design issue, rather than just an ethical or technical one. Accountability arises not merely from having governance mechanisms but from their proper embedding and alignment within the organisation.

Contribution to Literature

This study enhances the AI governance literature by treating governance as an empirical and structural phenomenon rather than just a normative concept. It offers one of the first multi-regional analyses of AI governance roles, addressing a critical gap in understanding organisational governance capacity. The study introduces a three-dimensional framework—governance presence, structural embedding, and governance maturity—to better understand how AI responsibility is organised within institutions. Additionally, it creates an exploratory typology of governance configurations, highlighting that variations in AI governance are influenced not just by roles but also by differences in authority, resources, and organisational integration. These contributions lay the groundwork for future research on how governance structures impact accountability, compliance, and ethical risk.

6.3. Implications for AI Governance Research

This study emphasises the need to examine how AI governance responsibilities are actually assigned and implemented in practice, rather than merely outlining what organisations should do.

It introduces a three-dimensional framework for governance:

• Presence—Are roles established?
• Structural embedding—How are roles positioned and resourced?
• Governance maturity—How do these elements work together?

This framework encourages future research to connect governance structures with outcomes like ethical incidents, regulatory compliance, stakeholder trust, and organisational performance.

Additionally, the study introduces the concept of absence-based ethics, highlighting that ethical risks can stem from a lack of governance or weak institutionalisation, shifting the focus from accountability mechanisms to the essential preconditions for accountability.

6.4. Implications for Theory, Management, and Policy

The findings emphasise the importance of integrating organisational design and institutional theory into AI governance research. Governance should be viewed as a configurational system influenced by authority, resources, and organisational structure, rather than just a set of principles.

For managers, the results indicate that establishing formal AI governance roles without adequate authority, resources, or integration may not effectively mitigate ethical and regulatory risks. Successful governance requires intentional structural design, including clear reporting lines, decision-making authority, and organisational support.

For policymakers, the findings point to potential issues with relying too much on assumptions of organisational self-governance. Regulatory frameworks often expect organisations to have the capacity to implement governance mechanisms, but the reality of limited governance and symbolic practices suggests that this assumption is flawed, especially in less-regulated sectors or regions.

Future research should focus on how governance profiles change over time and how different configurations impact measurable outcomes. Longitudinal and mixed-method studies will be crucial for advancing this research area.

7. Limitations

This work provides an initial empirical mapping of AI governance roles and structures, along with some limitations that should be acknowledged.

The study used a cross-sectional survey approach, capturing organisational governance at a particular point in time. The findings do not indicate any temporal changes. Longitudinal studies are necessary to understand how organisations evolve from inadequate governance to the implementation of formal structures.

The sampling technique emphasises broad representation across many sectors and geographies rather than guaranteeing statistical representativeness within specific groups. This method is suitable for preliminary mapping; nevertheless, it indicates that the prevalence figures are indicative rather than definitive.

The data are derived from self-reports by senior respondents. The study may be affected by common method bias, as the data come from single respondents within each organisation via a self-reported survey. Despite selecting respondents based on their seniority and knowledge of governance structures, this reliance on a single informant can introduce bias or lead to an incomplete understanding of governance arrangements. Future research should consider using methodological triangulation, such as combining survey data with document analysis (like governance policies and organisational charts), conducting in-depth interviews with multiple stakeholders, or utilising public disclosures to validate AI governance roles and their structure.

The findings should be viewed within the context of when the data was collected. The study took place during a period of rapid changes in AI regulation, notably amid initiatives such as the EU AI Act. As regulatory expectations evolve, organisations are likely to adjust their governance structures, clarify roles, and enhance oversight. Therefore, the governance configurations noted in this study are a snapshot in time and may shift as regulations, industry standards, and organisational capabilities develop.

This research primarily examines the existence and organisation of AI governance roles, rather than their efficacy or results. Consequently, it fails to demonstrate causal linkages between governance profiles and outcomes, such as ethical incidents or regulatory compliance. These constraints correspond with the study’s exploratory objective and provide potential directions for future research to expand upon the presented findings.

8. Conclusions

This study provides an early, multi-regional mapping of AI governance roles and their structural attributes. It highlights the importance of “governance absence” as a distinct organisational state, not just a failure in execution. This shift in focus allows for an analysis of the structural presence of governance, rather than just its effectiveness.

This study offers a cross-sectoral and multi-regional examination of formal AI governance responsibilities inside organisations spanning diverse sectors and locations. It documents the existence, structure, and deficiencies of these positions, shifting the emphasis of AI governance research from theoretical proposals to real-world organisational realities.

The results indicate that formal AI governance positions are implemented and established only to a limited extent and are not implemented effectively or adequately. Senior leadership roles and specialised audit tasks are rare, with many organisations relying on advisory or operational positions that have limited authority and resources. Many organisations operate without designated AI governance, despite extensive use of the technology.

The research delineates four maturity stages of AI governance: Absence of Governance, Symbolic Governance, Operational Governance, and Institutionalised Governance. This classification indicates that mature governance structures are uncommon, with most organisations exhibiting transitional or low-capacity arrangements.

The paper presents the concept of absence-based ethics, emphasising that ethical concerns often emerge prior to governance failure, namely at the juncture where governance is not structurally designated. This undermines prevalent assumptions in AI ethics and accountability discourse that assume the existence of formal governance.

The findings caution organisations against regarding AI governance as a trivial formality. Effective governance requires authority, resources, and explicit structural coherence. The findings suggest that policymakers’ expectations regarding organisational fitness for governance may be baseless, especially in less-regulated sectors.

This study establishes a solid foundation for understanding how organisations administer—or fail to administer—AI systems. By emphasising governance deficiencies, it facilitates further research into the effects of various governance structures and their correlations with ethical, regulatory, and organisational outcomes. The governance maturity profiles developed in this study offer a significant empirical foundation for subsequent inquiries into regulatory compliance, ethical considerations, and trust outcomes across various organisational and national contexts.