AI governance in our company – who is responsible?

Have you, following the DPO and CISO, already appointed an "AI Officer"? For most organizations this will not be necessary for tackling compliance of the AI developments, but you still need to have appropriate governance. After having discussed our 11 principles for a responsible use of AI and risk assessments, we now explain what you should look out for and what steps you should take in terms of governance for ensuring a legal and ethical use of AI. This is part 5 of our AI series.

In simple terms, governance concerning a legal and ethical use of AI means that a company defines who has which tasks, powers and responsibilities in relation to the use of AI and the implementation of AI projects and which rules and procedures need to be complied with. This ensures that everything runs smoothly, that important goals can be achieved and that no unwanted risks are taken. Achieving this with regard to compliance is not easy, especially in the field of artificial intelligence, for three reasons:

• First, AI affects many topics and areas of the company. Sales can use AI, as can customer service, research and development, human resources and so on. Even with regard to specific questions, such as whether a certain application is permissible, answers must be sought in a wide variety of legal areas – from data protection to intellectual property law to unfair competition law to contract and criminal law.
• Second, there is still a lot of uncontrolled growth when it comes to AI in many companies. In contrast to the introduction of cloud technologies, for example, which in many places was driven "bottom-up" from IT, artificial intelligence is a technology where "business" and even the management itself comes up with new ideas – and wants them to be implemented.
• Third, from a legal perspective, there is little transparency regarding the tools and infrastructure used for the deployment of AI and the corresponding knowledge. Which version of ChatGPT is suitable from a data protection perspective, and which version of Microsoft Copilot? Our list discussing the various offerings in part 2 of our series resulted in huge feedback from far beyond Switzerland, which shows that there are still a lot of unanswered questions here and that many do not really know what they should and may do.

How is a compliance or legal department that is suddenly swamped with requests supposed to provide a reasonable answer within a reasonable time? This has to settle down and, above all, be regulated and organized, i.e. companies have to define their guidelines (not only legally, but also technically, such as the platform issue) and regulate responsibilities and procedures. This is what we currently do most often with our clients, apart from assessing specific projects, providers and tools.

One other remark: Proper governance is not only necessary with a view of ensuring compliance, but all other goals an organization may have, as well. While we in the following will focus on compliance governance, similar processes, rules and structures will also help in achieving other goals in relation to the use of AI.

Who is responsible for AI compliance?

This raises the question of who in the company is responsible for the topic. At least with regard to legal issues, this has not really been determined in many places. However, we are seeing certain trends among our clients. They include the fact that the topic of AI compliance is now primarily assigned to those who already take care of data protection compliance. It is true that AI can also affect other areas of law, such as copyright law. However, as many companies are primarily users of AI technologies that are already available on the market, these other legal issues are somewhat less prominent for them than for those who offer AI products themselves (we will discuss separately the changes that result from the AI Act).

In many cases, we believe it also makes sense for AI compliance to be coordinated internally with those who are already responsible for data protection. They will usually already have the most experience: Many of the central concerns and approaches that relate to a legally compliant, ethical and risk-aware use of AI are already well known and established in data protection. Examples include the principles of transparency, accuracy and self-determination. Similarly, in data protection, there is already a lot of experience with two compliance tools that are now also becoming important in the field of AI:  records of processing activities and data protection impact assessments. We recommend the former to our clients for their internal AI applications, and the latter represents a proven methodology for assessing and addressing risks that are also well suited to AI projects (see Part 4 of our series). It is therefore not surprising that most of the regulatory recommendations on the use of AI to date have come from supervisory authorities in the area of data protection.

The EU AI Act will also add the spectrum of product regulation to the use of AI (especially for those companies that are considered to be providers) and a number of cases in which companies will have to introduce certain standard checks, such as whether a particular project could result in a prohibited AI applications, whether one of the special obligations that are imposed on deployers of AI (e.g. when using AI-generated content for public information) need to be complied with, or whether the intended AI application is considered "high-risk" under the AI Act.

---

This article is part of a series on the responsible use of AI in companies:

• Part 1: AI at work: The three most important points for employees
• Part 2: Popular AI tools: What about data protection?
• Part 3: AI: 11 principles – and an AI policy for employees
• Part 4: How to assess the risks of both small and large AI projects
• Part 5: AI governance in our company – who is responsible?
• Part 6: The flip side of the coin: Where we need to protect AI from attackers
• Part 7: The EU AI Act - what it means in practice for most companies
• Part 8: AI in financial institutions – opportunities and challenges
• Part 9: AI in marketing: 4 unfair competition law pitfalls
• Part 10: Copyright and AI: Responsibility of providers and users
• Part 11: Fair play with AI: How sports organisations may use athlete data
• Part 12: Feeding AI: How to commercialize data sets
• Part 13: AI in Human Resources
• Part 14: Copyright and AI: How to protect yourself in practice
• Part 15: What you should legally consider when retaining AI providers
• Part 16: How companies can ensure transparency for their use of AI
• Part 17: What is inside an AI model and how it works
• Part 18: The most important compliance requirements for AI
• Part 19: Language models with and without personal data
• Part 20: Risk-based approach: Not all AI applications harbour high risks
• Part 21: The right of access to large language models
• Part 22: Guidelines for using artificial intelligence in financial institutions (FINMA) - VISCHER
• Part 23: Switzerland: What to expect in terms of AI regulation
• Part 24: Five trigger questions for more AI compliance
• Part 25: AI Tools – What about data protection?
• Part 26: AI training: How to Handle Copyright, Data Protection And Other Restrictions
• Part 27: How small and medium-sized enterprises can use AI in a compliant manner
• Part 28: When Media Houses and AI Providers clash – the Pitfalls of AI Regulation
• Part 29: The Challenges of Achieving AI User Adoption
• Part 30: Overview of Key EU Digital Regulations
• Part 31: AI Tools – What about data protection? (2026)
• to be continued...

We support you with all legal and ethical issues relating to the use of artificial intelligence. We don't just talk about AI, we also use it ourselves. You can find more of our resources and publications on this topic here.