Black Sheep AI
A RACI matrix maps every governance activity to who does the work, who is answerable, who gets consulted, and who gets told. For AI and data governance it's the difference between a model with a clear owner and a model everyone assumed someone else was watching.
Unclear ownership is not a soft problem. When we run a governance gap assessment, the recurring finding is a model in production that no single person is accountable for. The data steward thinks the model owner has it. The model owner thinks the RAI council signed off. The council thinks it was a limited-risk system that never needed review. A RACI matrix exists to make that ambiguity impossible, and building one for AI is mostly a matter of discipline, not novelty.
One accountable, no exceptions
RACI assigns each activity across four roles. Responsible is the person or people doing the work. Accountable is the single individual answerable for the outcome. Consulted are the stakeholders whose input you seek before deciding, in a two-way exchange. Informed are the people you keep updated after the fact, one way.
The rule that carries the most weight is the one teams break first: exactly one Accountable per activity. You can have several people Responsible for building a model. You cannot have two people accountable for whether it should have shipped, because two accountable means none. Our roles and responsibilities model is strict about this. Every AI model gets a named Model Owner who is the single point of accountability for its performance, compliance, and incidents, and that name goes in a registry, not a conversation.
Pick the roles before the letters
A RACI matrix is only as good as the roles down its side. For AI and data governance we work with a stable cast, and each one earns its column:
- Model Owner — accountable for a specific model across its lifecycle, from documentation to drift to incident response.
- Data Steward — responsible for the quality, lineage, and appropriate use of the data a model trains and runs on. This is the heart of data governance RACI: someone has to own whether the data is fit to use.
- Development / ML team — responsible for building, testing, and deploying.
- RAI Council — the second-line ethics and risk body; sets policy, reviews high-risk systems, and holds approval authority for the riskiest deployments.
- Internal Audit — independent assurance, reporting to the board rather than to management.
Legal, the CISO, and the Chief AI Officer join for specific activities, but these five cover most of the lifecycle. Name real people or named positions, not departments. "Engineering is responsible" is how a task falls through the cracks between three engineers.
A worked RACI for AI and data governance
Here's a compact version of the matrix we start from. It's deliberately short; a real one runs to dozens of rows across the govern, map, measure, and manage functions, but this shows the shape.
| Activity | RAI Council | Model Owner | Data Steward | Dev / ML team | Internal Audit |
|---|---|---|---|---|---|
| High-risk use case approval | A | R | C | I | I |
| Training data curation | I | A | R | R | I |
| Bias testing | I | A | C | R | I |
| Deployment decision | C | A | C | I | I |
| Continuous monitoring | I | A/R | C | R | I |
Read a row across and the accountability question answers itself. Who decides a high-risk system can proceed? The RAI Council is accountable; the model owner does the work of preparing it; the data steward is consulted; audit is merely informed. Who owns the data that goes into the model? The steward is responsible, but the model owner remains accountable for using it, which stops "the data was bad" from becoming a way to shed responsibility.
The A/R on continuous monitoring is intentional. Some activities have the same person accountable and responsible, and pretending otherwise just adds a fake handoff.
RACI and the three lines of defense
A RACI matrix answers "who does what for this activity." The three lines of defense model answers a different question: "which part of the organization owns this category of risk." They're complementary, and you want both.
The first line, your development and data teams, owns and manages operational risk day to day. In RACI terms they carry most of the Responsible assignments and the operational Accountable ones, like the model owner accountable for deployment. The second line, the RAI Council and risk officers, oversees and challenges; they show up as Accountable on policy and high-risk approvals and Consulted on the rest. The third line, internal audit, provides independent assurance and is mostly Informed on operations but Responsible when the activity is the audit itself.
Map your RACI onto the three lines and gaps jump out. If an activity has no second-line Consulted or Accountable anywhere near a high-risk decision, your oversight has a hole. If audit appears as anything other than Informed on day-to-day operations, its independence is compromised.
Where ESG governance fits
Teams searching for a RACI matrix for ESG governance are usually asking the same operational question in different clothing: who is answerable for the environmental, social, and governance impacts of the systems we run. We don't sell an ESG product, and we won't pretend AI governance is a substitute for a full ESG program. But the RACI mechanics are identical. An AI system that screens job applicants or prices credit is an ESG-relevant system, and the accountability you'd build for its fairness, data provenance, and oversight is exactly the data-governance RACI above, applied with ESG impacts named explicitly in the impact rows.
The one place AI adds a genuinely new column is supply chain. ESG accountability has always cared about what's upstream, and AI inherits risk from foundation models and third-party datasets you didn't build. That's what the AI Bill of Materials is for: it documents the models, datasets, licenses, and their provenance across the supply chain, so when you assign someone as Accountable for an upstream component, they have something concrete to be accountable for. A RACI cell that says "Model Owner is accountable for third-party model risk" is empty without a BOM listing what that model carries.
Getting it adopted
A RACI matrix that lives in a slide deck governs nothing. What makes it real:
- Inventory your models first and assign a Model Owner to each. Accountability with no name is the failure you're trying to fix.
- Build the matrix activity by activity, and enforce the single-Accountable rule on every row. If you can't name one accountable person, the activity isn't defined yet.
- Cross-check it against the three lines of defense so oversight and assurance aren't accidentally missing from high-risk decisions.
- For any activity touching upstream models or data, require an AI BOM so the accountable person can actually see what they own.
- Embed the assignments into your project and workflow tooling, then review them quarterly. Organizations change; a static matrix drifts out of truth within a year.
