Which role is responsible for risk/compliance function in AI governance?

• A. Risk/compliance function
• B. Data owner
• C. ML product owner
• D. IT security

Answer: (A)

The main idea here is who governs risk and regulatory compliance across AI initiatives. The risk/compliance function is tasked with establishing and operating the organization’s approach to risk management for AI, including identifying, assessing, and mitigating risks and ensuring adherence to laws, regulations, and internal policies. This role defines the risk appetite for AI programs, sets controls, and oversees assurance activities such as monitoring, audits, and reporting to leadership. They coordinate with privacy, legal, data governance, security, and product teams to ensure the AI system complies with data protection/privacy rules, fairness and bias considerations, transparency expectations, and model risk management standards throughout the lifecycle—from design to deployment to ongoing monitoring.

Data owners are primarily responsible for the data they control, including data quality, stewardship, and access management, but not the overarching risk and compliance governance for AI. The ML product owner focuses on delivering the product features and performance, ensuring the model meets user needs and requirements, rather than steering enterprise risk controls. IT security concentrates on protecting systems and data from threats, implementing security controls and incident response, which is important but narrower than the full risk/compliance scope across AI governance.