A PwC survey of roughly 4,000 business and technology leaders across 71 countries finds that no single role has clear ownership of AI risk. While about half of organizations now discuss AI at the board level, the chain of responsibility for agentic AI and its security remains undefined. Only a third of companies have hired dedicated AI roles such as chief AI officers or AI board members.
Where accountability does exist, it is split: 29% of leaders say the CIO or CTO is responsible, 26% point to a dedicated AI leader or function, and 17% place it with the CISO or cybersecurity teams. Another 11% say responsibility is shared or unclear. The survey suggests that, much like the rise of the CISO in the 1990s, organizations may soon create a chief AI security officer role to fill the gap.
Technology can help, according to RSA's chief product and strategy officer, Jim Taylor. He argues that AI agents should be governed with the same identity controls used for human employees—passwords, zero-trust principles, and multi-factor authentication. A centralized platform could register approved agents, tie each to a human owner, and require authorization for high-risk actions. Taylor warns that while agents themselves won't face compliance violations, the organizations deploying them will, so companies need the means to keep them secure.