In most energy companies, AI governance lives wherever the first AI tool was installed. That usually means IT. A policy gets drafted by the CIO’s team, an approved-tools list goes up on the intranet, and the board hears about it once a year inside a technology update.
That placement is the problem. IT can tell you whether a model is secure, licensed and integrated. It cannot tell you whether the company should be letting a model shape a drilling schedule, a hiring screen or a hedge, because those are not technology questions. They are questions about risk appetite and accountability, and in a well-run company those belong to the board and the executives it oversees.
Why does AI governance keep ending up in the IT department?
Because AI arrives as software. It gets bought through procurement, it needs credentials and integrations, and it shows up on a vendor invoice next to the ERP license. So the people who manage software are handed the job of managing it.
The trouble is that a modern AI tool does not just process data. It makes recommendations, and people act on them. A maintenance model decides which compressor gets looked at first. A contract-review assistant decides which clauses get flagged. Once a tool is influencing a decision, the governance question stops being “is the system working?” and becomes “who is answerable for what this system caused us to do?” An IT department is not set up to answer that, and it should not be asked to.
What does the IT framing miss?
Put the two framings side by side and the gap is obvious. The IT question set is about the tool. The board question set is about the decision.
- IT asks: Is it secure? Is the data protected? Does it integrate with our systems? Is the vendor stable?
- The board asks: Which decisions is AI now influencing? How much of that risk are we willing to carry? Who signs off, and who answers if it goes wrong? Would we be comfortable explaining this to a regulator, a partner or a jury?
Both lists matter. Only one of them is a technology problem. When governance sits in IT, the first list gets handled well and the second list gets handled by nobody, which is how a company ends up with a clean security review on a tool that is quietly making calls no executive ever approved.
What do the published frameworks actually say about ownership?
The most widely referenced voluntary framework in the U.S., the NIST AI Risk Management Framework, is direct about this. It organizes AI risk work into four functions: govern, map, measure and manage. It does not treat governance as one step among four. In the framework’s own words, governance “is designed to be a cross-cutting function to inform and be infused throughout the other three functions.”
On ownership, the framework document (NIST AI 100-1) names it plainly. Subcategory GOVERN 2.3 reads: “Executive leadership of the organization takes responsibility for decisions about risks associated with AI system development and deployment.” The appendix describing who does what goes further: “Key AI actors responsible for AI governance include organizational management, senior leadership, and the Board of Directors.”
The international view points the same way. The OECD AI Principles list accountability as a core principle for anyone deploying AI. Accountability is not something a help desk can hold on the company’s behalf.
None of these documents is a law, and an energy company is not obliged to adopt any of them. But when an incident is reviewed after the fact, these are the reference points a regulator, an auditor or opposing counsel will reach for first, and every one of them puts ownership above the IT function.
Who should own which part of AI governance?
Moving governance out of IT does not mean taking IT out of governance. It means each layer owns the part it is actually equipped to own.
| Layer | What it owns | What it should produce |
|---|---|---|
| Board of directors | Risk appetite for AI-influenced decisions; oversight of the program | A committee assignment, a reporting cadence, and a stated tolerance for where AI may and may not decide |
| Executive leadership | Responsibility for AI risk decisions, per NIST GOVERN 2.3 | A named executive owner, a written charter, and a budget line |
| Business-unit leaders | The decisions AI influences inside their operations | An inventory of AI-influenced decisions and a named approver for each |
| IT and security | The tools: access, data protection, integration, vendor review | Technical controls, logs and evidence the other layers can rely on |
Notice where IT lands. It is essential, and it is the bottom row. Its output is evidence that the layers above use to make and defend decisions, not the decisions themselves.
How can you tell if your AI governance is sitting in the wrong place?
Five signs show up again and again in companies where governance has stalled inside IT:
- The AI policy is signed by the CIO and no one above. A policy nobody senior owns is a guideline, not a control.
- The board has never been told which decisions AI influences. It has been told which tools are approved, which is a different and much less useful list.
- AI does not appear on the enterprise risk register, or appears only as a cybersecurity line item.
- No board committee has AI in its charter. Audit assumes risk has it, risk assumes technology has it, and the question never lands.
- Nobody can say who approved a given AI use case. Ask that about any tool in production. If the honest answer is “IT turned it on,” the gap is real.
What does moving governance to the board actually involve?
Less than most executives fear. It is an organizational change, not a technology project, and the first steps fit in a quarter.
Assign AI oversight to a named board committee in writing. Name one executive as the accountable owner and give that person a charter that covers decisions, not just tools. Add AI-influenced decisions to the risk register with an owner on each line. Set a reporting rhythm so the board hears about AI on a schedule rather than after a surprise. Then tell IT what evidence you need from it, which is usually logs, access records and vendor terms, so its work feeds the oversight instead of standing in for it.
This is the kind of operating model ModalPoint works on with energy leadership teams: governance built around the decisions AI touches rather than the software it runs on. The steps above stand on their own, though, and a company can take every one of them without outside help.
A question to take into the next board meeting
Ask one director to name the person accountable for the company’s AI risk. Not the person who manages the tools, but the person who answers for what those tools lead the company to do.
If the board can name that person and that person reports to the board, governance is where it belongs. If the room goes quiet, or every eye turns to the CIO, you have found the work for next quarter.
Matthew Bertram is Chief Marketing Officer of the Oil & Gas Global Network, President of ModalPoint, an AI decision-governance advisory, and CEO of EWR Digital, a Houston digital marketing agency in business for more than 25 years. He hosts The Best SEO Podcast, created the LLM Visibility™ methodology for getting brands cited in AI search, and is a contributor to NIST’s Cyber-AI Profile.