CIOs need decision rights to match AI accountability

AI accountability depends on aligned authority

Giving the chief information officer (CIO) responsibility for enterprise AI creates a practical problem when business units and functions retain control over spending and deployment. The CIO may answer for outcomes while controlling only some of the decisions behind them. For executives setting AI budgets and governance, the first question is whether authority, information and accountability line up.

Those responsibilities can align under either a single owner or distributed decision-making. Business units can choose applications while enterprise leaders set shared conditions for their use. Yet Thoughtworks’ research identifies tension between distributed ownership and concentrated personal responsibility. Thoughtworks has a commercial interest in demand for enterprise technology advice and implementation, including the AI work its recommendations address.

Visibility leaves decisions about authority unresolved

Thoughtworks found “no single dominant budget model” for AI, with deployment and spending responsibilities spread across organizations. Yet CIOs reported feeling personally responsible for managing AI outcomes and taking most of the blame when mistakes occur. Distributed spending can reflect legitimate differences in business needs, but it creates a management problem when the executive expected to explain an outcome lacks authority over the decisions behind it.

Understanding those decisions requires visibility, which most respondents already reported having. Nearly all technology executives reported full or high visibility into AI tools used across business units, according to Thoughtworks. An inventory can show where AI is used while leaving unresolved who may authorize that use, who sets its conditions and who manages the resulting risks. Organizations therefore need to examine who can make which decisions alongside their inventories.

Even with that visibility, governance can struggle to keep pace with deployment. Most CIOs in Thoughtworks’ research described their organizations as well prepared to govern AI, yet 88% said adoption was moving faster than governance. The responses address different questions: confidence in existing arrangements and how quickly those arrangements can accommodate new activity. So leaders reviewing readiness need to examine how responsibilities and controls apply to current deployment decisions.

Beyond these organizational pressures, separate research from AI platform Writer describes executives’ perceived career risk. In a finding described at the time as coming “earlier this year,” Writer reported that 61% of technology executives feared losing their job if they failed to lead their organization through an AI transition. Writer sells an AI platform and benefits commercially from enterprise AI adoption, giving it a stake in how leaders view that transition. Its finding concerns fear about continued employment; Thoughtworks’ research concerns ownership and responsibility for outcomes.

A broader CIO role can support local decisions

Against this background, Thoughtworks reported plans to change where technology leadership sits. More than half of CIOs planned to embed technology leads within business units, bringing expertise closer to teams making local decisions. Separately, just under half planned to broaden the CIO role to oversee enterprise AI strategy and implementation. Each plan raises a question about who gains authority over which decisions.

The scope of that authority determines whether a broader CIO role can work alongside local leadership. Enterprise strategy can cover common architecture and controls, while business units choose applications within agreed conditions. Embedded technology leads can connect local needs with enterprise requirements. The plans can therefore coexist, although the findings describe separate responses rather than a combined organizational program.

For either change, executives need to test what it enables people to do. Can each AI decision-maker exercise the necessary authority, obtain relevant information and identify the people responsible for applicable controls? A new reporting line or broader job description has practical value when it improves those conditions. But if a wider remit adds accountability while leaving decision rights unclear, the original mismatch remains.

Local decisions need clear owners and financial visibility

To clarify those decision rights, Thomas Squeo, chief technology officer (CTO) of Thoughtworks Americas, told CIO Dive in emailed comments that organizations should examine whether AI decision-makers have the authority and information they need. He also rejected a universal ideal for AI ownership. His recommendation focuses on how each organization works: whether the people expected to act can make the relevant decisions and understand their consequences. As a Thoughtworks executive, he has a commercial stake in demand for help designing and implementing those arrangements.

Authority and information need to be assessed together because either can limit a decision-maker’s effectiveness. Someone may have permission to authorize AI use while lacking the information to judge its implications. Another person may understand those implications but have little influence over the decision. Reviewing ownership therefore means examining both conditions wherever decisions sit.

Once decision-making authority is clear, responsibility for controls also needs an explicit home. Thoughtworks recommends assigning security, privacy and compliance to the relevant control owners throughout the business. Those owners would manage their respective obligations across distributed AI activity, alongside the CIO’s enterprise responsibilities. Clear relationships help decision-makers identify whose requirements apply to a proposed use.

Decisions about work require participation beyond the people responsible for technology and controls. “Changes to roles and workflows involve people, business and technology leaders together,” Squeo said. AI adoption can change how tasks are performed and who is responsible for them, so these leaders need to participate in decisions affecting their teams. Their involvement connects system choices to the roles and business operations those systems will change.

Financial responsibility adds another requirement. Squeo said, “Finance gets visibility into consumption and value, and business units make local decisions within agreed guardrails.” Finance would be able to examine what AI activity consumes and the value it produces, while business units retain scope to choose applications. The guardrails, agreed conditions within which those units can act, define the boundaries of that authority.

Shared architecture can support wider adoption

Those organizational boundaries need a technical foundation that business units can use repeatedly. Squeo recommends a shared technology environment with streamlined architecture and controls. Architecture is the common technical structure within which applications operate; controls set requirements for their reliable use. Establishing that foundation gives the CIO a defined contribution to local adoption across the enterprise.

With shared conditions in place, local teams can select applications without seeking fresh CIO approval for every use case. The CIO would be responsible for keeping that environment dependable across business units, while local leaders assess which applications fit their needs. This gives enterprise oversight a specific scope: maintaining the technical conditions that allow adoption to spread.

Squeo described the connection directly: “I see the CIO as the person connecting local adoption to enterprise scale,” he said. His example is an AI application that works in one area of the business and could be extended more widely. He described the responsibility as: “Making sure what works in one part of the business can grow without losing the architecture and controls that made it reliable.” So expanding the application into other parts of the business requires preserving the technical structure and controls that supported its initial use.

Key executive takeaways

• Align AI accountability with authority: CIOs held responsible for AI outcomes need decision rights that match their remit. Review who controls spending, deployment and risk before expanding the CIO’s responsibilities.
• Test governance against deployment speed: In Thoughtworks’ research, 88% of CIOs said AI adoption was moving faster than governance. Use AI inventories to check who authorizes each use, sets its conditions and manages its risks.
• Define enterprise and local responsibilities: A broader CIO role can coexist with technology leads embedded in business units. Specify which decisions sit with enterprise leadership and which local teams can make within shared conditions.
• Assign control ownership and financial visibility: Security, privacy and compliance owners need explicit responsibility across distributed AI activity. Give finance visibility into consumption and value, and involve business and people leaders in workflow changes.
• Build a shared foundation for wider adoption: CIOs can support local application choices through common architecture and controls. Preserve those foundations when extending a successful AI application across business units.