Core question who owns AI risk, who decides, and how is governance resourced?
The Accountability & Operating Model pillar establishes the decision structure every other control depends on. It is the pillar most often "done on paper": a policy exists, but nobody can show a decision the governance forum actually made, or which role approved the last high-risk deployment. VERITRAIL treats accountability as something you evidence through decisions, not documents.
What good looks like
- An approved, versioned AI governance policy with a named executive owner, reviewed at least annually.
- A cross-functional forum — business, technology, risk, legal, privacy, security — with written authority to approve, restrict or stop AI use cases, and minutes that show it has done so.
- A RACI that names who is responsible across the lifecycle, including who performs human oversight.
- A leadership-approved risk appetite that translates into risk-tier criteria used at intake.
- A list of prohibited and restricted uses that every use case is screened against.
- Role-based AI literacy for staff, operators and decision-makers, with completion tracked.
Controls in this pillar
| Control | Objective | Priority / scope | Evidence that demonstrates it |
|---|---|---|---|
| AO-01 AI governance policy | Documented, approved, versioned policy setting scope, principles, risk appetite linkage and accountabilities | Critical / all AI | Approved policy with version and approval record; communication record; annual review minutes |
| AO-02 Executive accountability and AI governance forum | Cross-functional forum with documented authority to approve, restrict or stop AI use cases | Critical / all AI | Terms of reference; membership; decision log showing approve/restrict/stop decisions |
| AO-03 AI roles, responsibilities and RACI | Roles for business, technology, risk, legal, privacy and security across the lifecycle | High / all AI | RACI matrix; role descriptions; human-oversight role assignments |
| AO-04 AI risk appetite and tolerance | Leadership-approved appetite, tolerance thresholds and risk-tier criteria | High / all AI | Risk appetite statement; tier criteria; approval record |
| AO-05 AI literacy and role-based training | Role-based AI literacy and responsible-use training | High / all AI | Curriculum; completion records by role; effectiveness metrics |
| AO-06 Escalation paths and decision rights | How AI issues and incidents are escalated, to whom, and how fast | High / all AI | Escalation matrix; concern-reporting channel; sample escalations |
| AO-07 Regulatory and contractual obligations register | AI-relevant legal, regulatory, contractual and customer obligations by jurisdiction and system | High / all AI | Obligations register; legal review records; obligation-to-system mapping |
| AO-08 Responsible AI principles and objectives | Measurable responsible-AI objectives aligned to values and appetite | Medium / all AI | Principles; objectives with metrics; leadership approval |
| AO-09 Third-party AI accountability | Accountability for vendor AI, including provider/deployer/customer responsibility allocation | Medium / third-party | Responsibility allocation (RACI or contract schedule); vendor AI owners |
| AO-10 Prohibited and restricted AI use policy | Prohibited, restricted and conditionally permitted uses; every use case screened | Critical / all AI | Prohibited/restricted list; intake screening records |
| AO-11 Stakeholder engagement and feedback | Feedback from affected individuals, users and internal stakeholders acted on | Medium / high-risk | Feedback channel; feedback log; actions taken |
| AO-12 Governance resourcing | Budget, people and tooling sufficient for the organization's scale | Medium / all AI | Governance budget; staffing plan; tooling inventory |
VERITRAIL controls cited
- AO-01 AI governance policyNIST AI RMF: GOVERN 1.1, GOVERN 1.2ISO/IEC 42001: 5.2, A.2.2, A.2.4EU AI Act: Art. 17, Art. 26
- AO-02 Executive accountability and AI governance forumNIST AI RMF: GOVERN 2.1, GOVERN 2.3ISO/IEC 42001: 5.1, 5.3, A.3.2EU AI Act: Art. 17
- AO-04 AI risk appetite and toleranceNIST AI RMF: GOVERN 1.3, MAP 1.5ISO/IEC 42001: 6.1.1, 6.1.2EU AI Act: Art. 9
- AO-10 Prohibited and restricted AI use policyNIST AI RMF: GOVERN 1.1, MAP 1.1ISO/IEC 42001: A.9.4, A.2.2EU AI Act: Art. 5
Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.
Common failure modes
- A forum with no teeth. The forum reviews slide decks but has never restricted or stopped anything. VERITRAIL asks for a decision log, because the evidence for AO-02 is the decisions themselves.
- Risk appetite that never reaches intake. The board approves an appetite statement, but tier criteria at intake are improvised. AO-04 is only effective when it feeds EI-02 tiering and GL-01 triage.
- Training as a one-off. A single e-learning module is not role-based literacy. Operators who supervise AI decisions need different training from developers or executives (AO-05).
- Vendor AI as nobody's problem. Embedded AI features in purchased software are often unowned. AO-09 assigns accountability and clarifies who is the provider and who is the deployer.
How VERITRAIL helps
- The maturity self-assessment scores this area through questions STR-Q1 to STR-Q3 and HUM-Q3, and raises a critical flag when there is no policy or accountable owner.
- VERITRAIL Control provides policy templates, a forum charter, RACI and escalation matrices, and records forum decisions as evidence.
- The VERITRAIL Agent can draft a RACI or obligations register from your inputs — as a draft for human review, with each line citing the relevant control.
Indicative framework alignment
AO controls map indicatively to NIST AI RMF GOVERN 1 and GOVERN 2 (for example, AO-01 to GOVERN 1.1 and 1.2; AO-05 to GOVERN 2.2), to ISO/IEC 42001 clauses 4–7 and Annex A.2–A.4 (AO-01 to clause 5.2 and A.2.2; AO-02 to 5.1, 5.3 and A.3.2), and to EU AI Act articles including Art. 4 (AI literacy, AO-05) and Art. 5 (prohibited practices, AO-10). See NIST AI RMF, ISO/IEC 42001 and EU AI Act readiness.
Next step
Most organizations can stand up the critical AO controls within the first 30 days of a programme. A Governance Baseline validates what you already have and drafts what you do not.