AI Governance · Board Governance · Enterprise AI Adoption

2026-06-03

Why AI Governance Cannot Live Inside IT Alone

AI governance cannot sit inside a single department. It requires leadership ownership supported by risk, IT, and practice leadership. The firms getting this right are treating AI like conflicts and professional responsibility oversight.

Effective AI oversight rarely sits within a single department. Instead, it tends to resemble other firm-wide governance functions such as conflicts management or professional responsibility oversight. Leadership sets direction while risk management, IT, practice leadership, and knowledge management contribute specialized expertise.

This type of cross-functional structure allows firms to address AI not simply as a technology initiative, but as a professional governance issue affecting how legal work is performed and supervised.

For those exploring AI governance frameworks, I regularly share practical structures and models that firms are beginning to adopt. Feel free to follow if these topics are useful to your work.

Questions to Consider

Are the right functions represented in our governance structure?
Do risk, security, technology, and practice leadership work from a shared framework?
Where are governance responsibilities duplicated or unclear?
Could a single department effectively manage all AI-related risks?
Are governance decisions coordinated across the firm?

Next Steps for Law Firms

1. Identify Current Governance Ownership

Determine whether AI governance currently resides within a single function such as IT, innovation, or knowledge management.

2. Establish Cross-Functional Governance

Include leadership from risk management, technology, professional responsibility, security, operations, and practice groups.

3. Define Roles and Responsibilities

Clarify which functions own policy development, vendor review, training, incident management, and executive reporting.

4. Create a Governance Committee

Formalize a structure that regularly reviews AI-related risks, opportunities, incidents, and policy updates.

5. Integrate AI Into Existing Governance Frameworks

Treat AI similarly to conflicts management, professional responsibility, cybersecurity, and enterprise risk oversight.

6. Develop Escalation Procedures

Ensure attorneys and staff understand where AI-related concerns should be reported and reviewed.

7. Review Governance Effectiveness Annually

Assess whether governance structures remain appropriate as adoption expands.

Next Steps for Executive Leadership

1. Assign Executive Sponsorship

Designate a managing partner, executive committee, or governance function responsible for AI oversight.

2. Require Cross-Functional Participation

Avoid concentrating governance responsibilities within a single department.

3. Establish Governance Reporting

Receive periodic updates regarding AI adoption, incidents, verification controls, vendor risks, and policy compliance.

4. Align Governance With Firm Strategy

Balance innovation objectives with professional responsibility obligations and risk tolerance.

5. Evaluate Governance Maturity

Review whether oversight structures are evolving alongside AI adoption.

Next Steps for Professional Liability Carriers

1. Review Governance Structures

Assess whether firms rely on a single department or maintain cross-functional governance.

2. Evaluate Leadership Engagement

Determine whether executive leadership actively participates in AI governance.

3. Examine Accountability Models

Review committee structures, reporting relationships, and decision-making authority.

4. Assess Coordination Across Functions

Evaluate how risk management, technology, ethics, and practice leadership collaborate.

5. Consider Governance Structure as a Risk Indicator

Cross-functional governance often signals greater organizational maturity and oversight capability.