Who owns AI risk at work? Business and tech leaders can’t agree, PwC survey finds

Business leaders currently lack consensus on accountability for the deployment and security of artificial intelligence, as revealed by PwC research. While organizations are increasingly aware of AI's benefits, such as streamlining operations and reducing workloads, they are simultaneously facing trade-offs involving rogue AI models and new security risks stemming from AI agents acting as network entry points. The research indicates a distribution of perceived responsibility among various leadership roles; specifically, 29% of CEOs and security leaders place accountability with technology roles like the CIO or CTO, 17% with cybersecurity teams, and 26% with a dedicated AI leader or function. Although 33% of organizations have hired for dedicated AI roles, this does not equate to a clearly defined chain of responsibility for agentic AI governance.
The research also points to the need for new security paradigms to manage these agents. Experts suggest that applying existing identity controls, such as those used for human users (passwords, MFA), must be extended to agentic AI systems. This approach aims to enhance security through better governance while acknowledging the necessity of human oversight. Furthermore, some proposals suggest establishing centralized platforms for registering and controlling AI agents, linking them to human owners who authorize high-risk actions, and ensuring that these deployments are subject to regular evaluation and decommissioning.

* PwC surveyed approximately 4,000 business and tech leaders across 71 countries.
* No single role has a clear responsibility for managing agentic AI or its security according to the survey.
* 47% of surveyed leaders consider cybersecurity a standing agenda item for boards.
* Nine out of ten business leaders reported that board oversight, executive accountability, and enterprise risk integration are in place.
* 33% of organizations have recognized the need for accountability and hired for dedicated AI roles, including AI chief officers or board members.
* 29% of CEOs and security/risk leaders stated accountability resides with the CIO, CTO, or similar technology roles.
* 17% of respondents indicated responsibility lies with the CISO or cybersecurity teams.
* 26% of respondents suggested responsibility should remain with a dedicated AI leader or function.
* 11% of respondents indicated that accountability is unclear, shared across multiple roles or functions.
* Jim Taylor suggested agentic AI should utilize identity controls similar to those securing human users.

The narrative surrounding AI governance reveals a gap between technological capability and organizational structure, particularly concerning responsibility. The core tension lies between the rapid integration of powerful, autonomous AI agents and the slow, hierarchical processes for assigning legal and operational accountability. The fact that no single role holds clear responsibility suggests an inherent misalignment: current organizational structures are ill-equipped to handle emergent, distributed forms of intelligence. This ambiguity is not merely a bureaucratic hurdle; it represents a potential abdication of oversight when risks materialize—such as the actions of rogue agents or security incidents.
The suggestion to map identity controls onto AI agents is a move toward engineering externalized governance mechanisms. This mirrors the historical necessity of defining clear control points (like the CISO role) to manage systemic risk, but here the locus of control is diffused. The implication for human agency is that while technology can provide technical controls, the ultimate failure point remains a gap in leadership consensus and formal responsibility structures. Who bears the cost of an AI-related failure—the developer, the deployer, or the executive sign-off—is currently undefined.
The pattern suggests that when facing exponential technological change, organizations tend to defer accountability until crisis forces a resolution. The fear is not just about technical breaches but about the institutional inability to assign blame and mandate remediation effectively across dispersed AI systems. This structure invites reflection on whether leadership training and governance frameworks can evolve faster than the technology itself, or if new, specialized executive roles are necessary precisely because the current model has failed to account for agentic complexity.
Bridge Questions: If no single role is clearly responsible, what specific mechanisms can be implemented to ensure operational accountability when agents act autonomously? How can organizational structures evolve quickly enough to define responsibility for continuously adapting AI deployments? What new leadership competencies must be developed to bridge the gap between technical capability and corporate governance?