The Changing C-Suite: CAIO, CIO, CISO, CDO, CHRO, CFO and General Counsel

All courses / AI Leader / Module 3 / Chapter 15

Learning objectives

After the lesson the participant can:

Describe for each executive seat what it gains with AI and what it must not hold, with the anchoring instrument.
Explain the four boundary rules and the instrument or principle behind each.
Assess the case for a chief AI officer by what the seat would hold, not by its title.
Draft entries of a decision-rights register with holder, deputies, response time, evidence standard, record and ceiling.

Key concepts

The builder does not verify: DORA Article 6(4) requires a control function for ICT risk with appropriate independence. For AI the practical test is whether the CISO can stop a system's release without the CIO's agreement, with a route to the management body that does not pass through the CIO.
Two seats for data: The chief data officer manages the data estate and thereby determines purposes and means. The data protection officer under GDPR Article 38 receives no instructions and must have no conflicting tasks; the Court of Justice ruling in X-FAB Dresden gives the reason not to merge the two mandates.
The spender does not measure: Value claims arrive from the people who asked for the spend. The CFO's charter carries the evidence duty: no adoption or value claim reaches the board without scope, method, date and result, and the CFO's office owns the measurement, not the programme's sponsor.
Chief AI officer: A seat for which the evidence is a pair of vendor surveys with differing samples. The chapter judges it by what it would hold: strategist without decision rights, platform owner, risk owner or budget holder. Hansa Mutual rejected all four versions and kept the work.
Decision-rights register: The DRR gives each AI decision six fields: holder, deputies, response time, evidence standard, record and a ceiling for AI. For the four prohibited classes it states that Level 4 is never used. Decisions that a delegation order assigns elsewhere are shown as decided elsewhere.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Match

Who typically holds what

Match each question about AI accountability to its typical holder in the chapter's table.

Interactive exercise 2 · Scenario

The builder and the verifier

Apply the boundary rule that the builder does not verify.

Teaching plan

20 min	Lecture seat by seat: what each gains, what it must not hold and which article anchors the point, framed as architectural reading and not legal advice.
15 min	The teacher presents the evidence on the chief AI officer and Hansa Mutual's decision AIDR-1051; groups argue which of the four versions of the seat their own organisation would actually be creating.
10 min	Plenary on the three failures of executive answerability, starting with the name that is a committee.
35 min	Exercise: build register entries for AI decisions and one must-not-hold list.
10 min	Quiz and comparison of DRR-HM-001 with DRR-NR-001.

Discussion

Hansa's general counsel asked to have it recorded that he is consulted on six entries and holds none. Why does a record that says 'legal approved' move an answer to a seat that cannot own it?
At Nordvik the AI governance lead reported to the executive who builds and runs the platform. Where in your organisation does the person who verifies report through the person who builds?
Hansa's decision against a chief AI officer sets a review in March 2031 with two named tests. What tests would tell your organisation that its allocation of AI decisions is failing?

Written exercise

Exercise · 35 minutes

Decision-rights register entries

For your own executive team, or for Nordvik Region's management group, write five entries of a decision-rights register in the form of DRR-HM-001. Choose decisions likely to need an answer in the next twelve months, for example approving an AI system for a consequential use, accepting residual risk, stopping a system or revoking an agent identity, approving an agent's mandate and informing employee representatives. For each give the holder, two deputies, the consulted roles, the response time, the evidence the holder must have seen, the record and the ceiling for AI. Then write the must-not-hold list for one seat, such as the CISO or the CHRO, and check the four boundary rules.

Deliverable: Five register entries with all six fields and one seat's must-not-hold list, with a note on any boundary rule broken today.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

What does the chapter say the CIO's charter should state about approving the use of an AI system for a purpose?
Show the answer
B. The decision to use a system for a purpose belongs to the executive whose function it serves
A CIO who approves the use of a system for claims, hiring or benefits has approved what the CIO's own teams built and bought. The CIO owns the platform, the provider relationships and the engineering evidence.
Why did Hansa Mutual's executive board reject the platform-owner version of a chief AI officer in AIDR-1051?
Show the answer
D. Because the group CIO and the head of the group AI platform already held the platform
The board went through four versions of the seat and found each already held: strategy and seams by the governance board's chair, platform by the CIO and head of AI platform, risk by the chief risk officer and CISO, budget by the CFO.
What did Nordvik Region's first register DRR-NR-001 change for the AI governance lead?
Show the answer
A. It gave the lead a direct line to the regional director on risk, with the audit committee informed
The lead sat in the digitalisation unit under the executive who builds and runs the platform. The register gives a route that does not depend on the platform owner and moves the stop right to a set including the CISO and the system owner.