Book Your Discovery Call

Who owns AI in a company that has no AI team?

Short answer: somebody already owns the decisions by default, usually the individual employees making them one at a time. Formal ownership does not require an AI specialist or a committee. It requires one named person accountable for five things: which tools are approved, who holds the accounts, what data may be used, who trains people, and who decides when AI is the wrong answer.

The question usually arrives late. Somebody in finance mentions they have been using an AI tool to summarise supplier contracts, and a director realises they do not know what else is happening, on whose accounts, with which data.

Nothing has gone wrong at that point. But nobody chose any of it either.

It is already happening, whether or not it was approved

The research on this is unusually consistent, and the numbers are larger than most leadership teams expect.

Microsoft’s 2025 Work Trend Index found that 78% of people using AI at work are bringing their own tools rather than using something their employer provided. Gartner, surveying 302 cybersecurity leaders between March and May 2025, found that 69% of organisations either suspected or had evidence that employees were using prohibited public generative AI tools.

The consequences are now measurable. IBM’s Cost of a Data Breach Report 2025 found that 20% of breached organisations reported an incident involving shadow AI, meaning unsanctioned AI use, and that those breaches cost an average of $670,000 more than incidents where shadow AI was not a factor. The same report found that 63% of organisations either had no AI governance policy or were still developing one, and that 97% of organisations reporting an AI-related breach lacked proper AI access controls.

Read those together and the picture is clear enough. Ungoverned adoption is not the same as no adoption. It is adoption you cannot see.

What ownership actually involves

Ownership does not mean becoming an expert in the technology. It means being the person who answers five questions, so they stop being answered individually by whoever is closest to them.

Which tools are approved. A short, current list. Not a ban, which tends to move the behaviour out of sight rather than stop it.

Who holds the accounts. Company accounts under business terms, not personal subscriptions expensed later. Business and consumer terms are different contracts, with different defaults on training and retention.

What data may go in. A short list of what is out of bounds, in plain language, with examples from your business rather than abstract categories.

Who trains people. An ongoing answer to “how do I do this properly”, including how to check an output before it reaches a client.

Who decides when the answer is no. The most valuable of the five. Somebody has to be able to say that a process should be fixed before it is automated, and that an impressive demo is not a reason to put something into production.

Who it should be

In a business without a dedicated AI function, the best owner is usually whoever already owns operations or process, rather than IT. Most AI decisions turn out to be process decisions in disguise: should we automate this handoff, is this task consistent enough to trust to a model, who catches it when the output is wrong. Those are answered better by someone who understands how the work flows than by someone who understands the technology but not the workflow.

IT should be involved for accounts, access and security review. But if IT owns AI outright, the framing becomes risk management alone, and you end up with a policy that restricts without giving anybody a better way to work.

There is a third option worth knowing about, which is that the function does not have to sit inside the company at all. Designing and maintaining AI workflows has become a discipline in its own right, and plenty of businesses get the output of it without making a full-time hire. We looked at how that works, and when it makes sense, in the AI workflows role and why most businesses outsource it.

A reasonable first month

Ask what is already in use. Openly, framed as wanting to support it. People answer honestly when the question is not a trap.

Name the owner. One person, written down, with the five responsibilities attached to the role.

Approve one tool properly. A company account under business terms, with a data processing agreement and admin controls in place. One tool done properly beats a policy covering five.

Write one page. What is approved, what data is out of bounds, who to ask. One page that people read beats twelve that they do not.

The step after that is usually not another tool. It is taking one real workflow, getting it working end to end, and learning from that before expanding. That is the thinking behind AI Foundations, which starts by looking at how AI is actually being used in a business today, then gets one thing connected, secured and working against an outcome agreed in advance.

The pattern underneath all of this is the same one we apply to any system. Understand the process first, then choose the technology, then measure whether it worked. Reverse that order and you get an impressive demo and a quiet mess behind it. Trust the process with eligeo.ai.

Common questions

Who should be responsible for AI use in a company?

In a business without a dedicated AI function, whoever owns operations or process is usually the better owner, with IT involved for accounts, access and security review. Most AI decisions are process decisions in disguise. Where nobody internally has the bandwidth, the function can be run by an outside partner, which is what Eligeo.ai’s AI Foundations engagement is built around. If nobody internally has the bandwidth to take it on, the function can also be run by an outside partner, which is what our AI Foundations engagement is built around.

es, and it can be one page. What tools are approved, what data must not be entered, who to ask when unsure. Length is not what makes a policy effective. AI Foundations includes the training side of this, so the people covered by the policy understand why it says what it says.

The use of AI tools by employees without the knowledge or approval of the organisation. IBM’s Cost of a Data Breach Report 2025 found 20% of breached organisations reported an incident involving it, adding an average of $670,000 to the cost of the breach.

Bans without an approved alternative usually move the behaviour out of sight rather than stop it. Approving one tool properly and telling people why is more effective than prohibiting several. Getting that one approved environment connected, secured and understood is exactly what AI Foundations does.

Ask directly, framed as wanting to support it rather than investigate it. Expense records and browser or network logs can fill gaps, but people answer honestly when the question is not a trap.

No. It requires naming someone. The five responsibilities are decisions rather than technical tasks, and they sit naturally with an existing operations or process leader. Where the technical setup is the gap rather than the decisions, AI Foundations covers that part without a hire.