In most small and mid-sized companies, if you ask who is accountable when an AI system makes a costly or harmful decision, you get a shrug. The honest answer is usually "the board", but no individual on it has been named, and proportionate governance has not been set up. That gap is becoming a real liability in 2026, as regulation tightens and AI moves from experiments into decisions that affect customers and money. The fix is not to hire a Chief AI Officer. It is to name an accountable owner and put lightweight governance in place. Here is what that means for a company without a dedicated AI function.
Who answers when the AI gets it wrong?
Picture an AI system in your business making a decision that turns out badly: a customer wrongly refused, money misdirected, data exposed. Now ask who, by name, answers for it. In most SMEs there is no answer. The work has been delegated to a tool, the tool has been delegated to a team, and accountability has quietly evaporated somewhere in between.
This is different from the day-to-day question of who is allowed to use which tools, which is an operational matter. The board-level question is narrower and sharper: who is personally accountable for AI risk, and have you actually named them?
You probably don't need a Chief AI Officer
The market is busy telling you the answer is to hire a Chief AI Officer. For most companies your size, it is not. A dedicated AI chief is often premature, and the role has a habit of becoming a vanity title with an 18-month shelf life. You do not need a new seat in the C-suite. You need two things that cost almost nothing: a named accountable owner, usually an existing executive, and a proportionate system around them.
Naming the owner is the part everyone skips and the part that matters most. Accountability that belongs to "the board" belongs to no one. Accountability that belongs to a named person, with the authority to set policy and the proximity to see where AI is actually used, is real.
Why this is suddenly urgent
Two things are converging. AI is moving out of the sandbox and into decisions with real consequences. And the regulatory direction is unmistakable: accountability is becoming a named-person question, not a corporate abstraction. The EU AI Act's high-risk obligations are phasing in through 2026, and UK regulators are applying existing accountability frameworks to AI rather than waiting for a single new statute. For regulated firms, individual senior-manager accountability already extends to the systems they rely on.
The trouble is that almost all the guidance you will find online is written for large enterprises, by law firms and big consultancies. It does not tell a fifty-person company what proportionate actually looks like. That gap is the whole problem.
What proportionate governance looks like
Not a forty-page policy. For a company your size, five things:
- A named owner. One accountable individual, on the record.
- An inventory. A simple list of where AI is in use, including the unsanctioned tools your staff are already running. You cannot govern what you cannot see.
- Clear lines. What AI is allowed to decide on its own, and what always needs a human. Especially for anything irreversible or customer-facing.
- A record. A basic audit trail of significant AI-driven decisions, so you can answer "why did it do that?" after the fact.
- A rhythm. A short, regular review of the above, so it stays current as your AI use grows.
This is the board-level layer that sits above the operational control plane. The control plane governs what the agents do. This governs who answers for them.
You do not need to become an AI expert or build a compliance department. You need one accountable owner and a proportionate system, set up before an incident or a regulator forces the question rather than after.
If you want help working out what proportionate AI governance looks like for a company your size, and who on your board should own it, that is something I help leadership teams put in place. Let's talk.
Related: Shadow AI is your next audit finding · Agent sprawl is the new shadow IT. Your business needs a control plane · Does your business need a CTO?
