ASD Essentials IT.GOV-08.1 Name an Executive Accountable for AI Use, Governance and Risk Management

What it says

Establish and maintain executive accountability for the use, governance and risk management of artificial intelligence within the organisation.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

Gives a named executive ongoing accountability for how the organisation uses, governs and manages the risks of artificial intelligence (AI).

One named executive answers for how AI is used. To meet this, every AI use goes through an approved process for approval, risk assessment and oversight. That covers AI built in-house, bought, or built into existing software. AI risks go in the risk register and regular reports. Scheduled reviews consider changes in what AI can do, in threats and in AI use. For example, an AI feature added to email software is approved before use.

Where this action applies

What's in each domain?

Governance and culture: a capability domain, which ASD applies across all phases from the start.

Why it matters

Without a named owner, AI spreads with no approval, risk check or oversight, and the rules fall behind as AI changes. Risks such as leaked sensitive data, unreliable automated decisions and unsafe supplier AI stay unrecorded until an incident.

How to implement

The board or executive committee should name one executive accountable for AI use, governance and risk management.
Record it in a resolution and role description, and reassign it when that person changes role or leaves.
The accountable executive should own a written process to approve, risk assess and oversee AI, and have it approved.
Back it with a staff AI use policy, such as rules on what data staff may enter, and record every decision.
The executive's team should keep a register of every AI use: built in-house, bought, or built into existing software, such as email.
Approve and risk assess each new or changed use first, and name an owner to oversee it.
Risk owners should record the risks of every known AI use in the risk register, and check it against the AI register for gaps.
Include AI risk in regular risk reports to the executive committee or board.
The accountable executive should review AI use and governance on a set schedule.
Consider changes in what AI can do, in threats and in how it is used, then update the process and registers and report back.

Keep it running

The accountable executive's team sends every AI request, supplier AI feature and in-house project through one approval and risk assessment path. It keeps the AI register (a list of every AI use) matched to the risk register. Watch for AI that arrives unasked, such as new features in existing software or supplier updates, and bring it into the process. This action applies organisation-wide, in every priority phase. Its proof is governance records, not system settings.

Evidence and audit

Check 1 of 5What an auditor asks for
Ask for
Ask for the resolution, delegation or role description naming the executive accountable for AI.
Look at
Whether one current, named person holds it, or only a committee, a team or a vacant role.
Good evidence
One named executive holds current, written accountability for AI use, governance and risk.
Check 2 of 5What an auditor asks for
Ask for
Ask for the approved AI governance process and decision records for recent AI requests.
Look at
Whether the process is approved and used, or informal, unwritten or never applied.
Good evidence
An approved process supports the executive, and recent decisions show it being followed.
Check 3 of 5What an auditor asks for
Ask for
Ask for the AI register and approval records for in-house, supplier and built-in examples.
Look at
Whether all three kinds are covered alike, or built-in and supplier AI runs unapproved.
Good evidence
Every known AI use is approved, risk assessed and actively overseen.
Check 4 of 5What an auditor asks for
Ask for
Ask for the AI entries in the risk register and recent executive or board risk reports.
Look at
Compare the risk register with the AI register for known uses with no recorded risk.
Good evidence
Every known AI use has its risks in the risk register and regular risk reports.
Check 5 of 5What an auditor asks for
Ask for
Ask for the AI review schedule and records of the latest reviews.
Look at
Whether reviews ran on time and weighed changes in AI, threats and use, or copied the last one.
Good evidence
Reviews run on schedule, address what has changed, and lead to recorded actions.

ASD indicators of good practice (12)

The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".

Not effective(4)

NE-1No named executive is accountable for the use, governance or risk management of artificial intelligence.
NE-2Artificial intelligence is used within the organisation with no approval, risk assessment or oversight.
NE-3Artificial intelligence related risks are not reflected in the organisation’s risk register.
NE-4Artificial intelligence use and governance arrangements have not been reviewed within the schedule defined by the organisation.

Partially effective(4)

PE-1A named executive is accountable for artificial intelligence but the governance process is informal or undocumented.
PE-2Approval and risk assessment occur for some artificial intelligence use cases but coverage is inconsistent across internally developed, third-party and embedded artificial intelligence.
PE-3Some artificial intelligence related risks are recorded but the organisation’s risk register does not capture all known artificial intelligence use cases.
PE-4Reviews occur within the schedule defined by the organisation, but do not consistently address changes in artificial intelligence capability, threat environment or organisational use.

Fully effective(4)

FE-1A named executive has accountability for artificial intelligence, supported by an approved governance process that has evidence of being followed.
FE-2The governance process addresses approval, risk assessment and oversight for internally developed, third-party and embedded artificial intelligence use cases.
FE-3Artificial intelligence related risks are reflected in the organisation’s risk register and reported through standard governance channels.
FE-4Reviews of artificial intelligence use and governance arrangements are conducted on a schedule defined by the organisation and consistently address changes in artificial intelligence capability, threat environment or organisational use.

Mappings

Closest match in ISO/IEC 42001: A.3.2, Define and Allocate AI Roles and Responsibilities, which this control partially meets.

ISO 42001

ISO/IEC 42001: 1 mapping

A.3.2Define and Allocate AI Roles and ResponsibilitiesPartially meets

ASD ISM

ASD Information Security Manual: 3 mappings

ISM-1998Integrate Cyber Security Across Business FunctionsPartially overlaps
ISM-2002Ensure Board Cyber Security Literacy for CompliancePartially overlaps
ISM-2074Develop and Maintain AI Usage PolicyPartially overlaps

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.