Artificial intelligence in business raises a question beyond tooling: who actually owns it? The executive funding it, the team using it, the vendor, or the provider? The answer changes depending on whether we discuss ownership, governance, or liability.
Artificial intelligence in business raises a question that goes beyond choosing a tool: who actually owns it? The executive team funding it, the operational team using it, the service provider integrating it, or the vendor supplying the model? The answer changes depending on whether we are discussing day-to-day oversight, intellectual property rights over software, or legal liability.
The right framework involves appointing a business lead, supported by leadership, while clarifying everyone's rights and responsibilities. Buying a subscription does not give you ownership of the model. Outsourcing development to an agency does not transfer all legal liabilities. And naming a point person is not enough if no one has the authority to allocate budget or halt a risky use case.
Governance should belong to someone who understands the business process being improved and can measure its results. For a customer support assistant, this will typically be the head of customer service. For invoice automation, it will be the finance or operations department.
This person does not need to know how to train a machine learning model. Instead, they must be able to define what qualifies as an acceptable response, prioritize needs, and structure how end users work with the tool.
Role | Core Responsibilities |
|---|---|
Executive Sponsor | Validates objectives, budget, and acceptable risk levels |
Business Lead | Defines requirements, monitors quality, and decides on functional updates |
Technical Lead | Manages integrations, access controls, security, and maintenance |
Legal / DPO Support (as needed) | Reviews contracts, data processing activities, and regulatory obligations |
End Users | Follow guidelines, review outputs, and report errors |
Governing artificial intelligence in companies becomes fragile when these roles remain implicit. People end up assuming someone else is verifying outputs, monitoring spend, or handling incidents.
A smaller organization does not need to establish a steering committee for every automated task. A business leader can act as both executive sponsor and business lead, relying on an external provider for technical integration. The key is to distinguish between responsibilities, even when they are handled by the same individual.
As the company grows, juggling these responsibilities becomes harder. An operations manager can then coordinate projects, while each department maintains a lead for its specific use cases.
Appoint someone responsible for business outcomes, not just someone tasked with testing tools. They must be given dedicated time for this mission and direct access to decision-makers. Without this, the role remains purely symbolic, and decisions end up being made reactively as emergencies arise.
Referring to "our AI" is convenient, but legally inaccurate. A solution may combine a third-party model, your internal documents, custom code, and various cloud services. To understand AI ownership in business, you must examine these components separately.
A subscription to an assistant or API access typically grants a contractual right of use. It does not make your company the owner of the model, its weights, or the underlying infrastructure.
An open-weights model offers more deployment flexibility, but it does not remove licensing constraints. Commercial use, redistribution terms, and related requirements must still be checked for that specific model. "Open" does not mean "unrestricted."
Similarly, fine-tuning or customizing a model does not automatically grant you ownership of it. You must differentiate between the base model, the artifacts resulting from adaptation, and the rights granted by the provider.
For most SMEs, owning the model is rarely the main objective. Being able to switch vendors without having to rebuild the entire operational process is far more valuable.
Your internal procedures, documents received from clients, and employee personal data are not all governed by the same legal rules. Holding a file does not automatically grant you the right to send it to an external vendor or use it to train an AI system.
Managing data associated with artificial intelligence in business must answer practical questions: Where does the data come from? Who has access to it? What uses are permitted?
In particular, verify whether the service retains prompts and queries, reuses content to train or improve its models, or allows you to opt out of data reuse. You should also review retention periods, deletion procedures, and any data transfers outside the European Economic Area.
Service terms and account settings matter far more than general marketing promises about privacy. Commitments often vary significantly between consumer plans, enterprise subscriptions, and API agreements.
A custom AI platform might contain proprietary code written for you, vendor components, and open-source libraries. The contract must specify the exact rights granted over each component. A paid invoice is not a substitute for an intellectual property assignment or a tailored software license.
Ask who controls the source code repositories, the cloud hosting, and the administrative accounts. Having broad rights over software is of little help if you cannot retrieve it or have another vendor maintain it.
Regarding generated outputs, provider terms may allow you to exploit them commercially without guaranteeing they qualify for copyright protection. Fully AI-generated content does not automatically enjoy intellectual property protection; human creative contribution and originality must be assessed on a case-by-case basis.
Finally, having the right to use generated output does not guarantee that it is free of third-party copyrighted material, confidential information, or factual errors. Human review prior to publication remains essential.
Liability in business AI does not simply follow whoever wrote the code. It depends on strategic decisions, contractual agreements, and the applicable legal framework. A service provider can be held accountable for its deliverables without stepping into your shoes regarding obligations toward your clients or employees.
Under the GDPR, the data controller determines the purposes and means of processing. The data processor processes personal data on the controller's behalf and strictly according to instructions. A single vendor may assume different roles depending on the specific operation being performed.
If your company uses an AI assistant to analyze customer inquiries, you likely remain the data controller, even if the entire infrastructure is hosted by an external vendor. Your company must assess the legal basis, inform data subjects, ensure data security, and set up appropriate data processing agreements with providers.
When available, a Data Protection Officer (DPO) advises and monitors compliance. They do not replace business leaders in making operational decisions. Involving them early avoids discovering after deployment that intended data cannot legally be used as planned.
The EU Artificial Intelligence Act draws a clear distinction between the system "provider" and the "deployer" using it under its own authority. These legal classifications are separate from those under the GDPR.
The regulatory obligations applicable to artificial intelligence in companies depend on your organization's role, the specific use case, and the level of risk involved. Developing an internal system or substantially modifying an existing one can also alter your legal classification.
An internal drafting assistant does not require the same scrutiny as an AI tool used to screen job applicants. AI use cases in recruitment demand particular caution. Before any sensitive rollout, confirm your classification, obligations, and implementation timeline.
Effective governance is not measured by the number of meetings held. It should enable a business to answer three questions quickly: Who decides? Based on what evidence? How can we roll back if necessary?
Prior to deployment, draft a brief project charter involving the business lead and the technical lead. Start by clearly defining what AI can actually do today, then scope the initiative to a verifiable task.
This document can easily fit onto a single page and should cover five core decisions:
Expected outcome: The problem being addressed, the baseline situation, and the success metrics.
Authorized scope: Eligible users, accessible data sets, and allowed actions.
Human oversight: Outputs that require human review and scenarios that must be escalated to a person.
Resources committed: Allocated budget, required maintenance time, and who signs off on expenses.
Off-switch: The person authorized to suspend usage and the fallback process to previous operations.
Formalizing this makes AI implementation much easier to oversee. Crucially, it prevents an informal trial from silently becoming an essential, unmaintained tool through habit alone.
A tool might draft a document in seconds while requiring several minutes of manual review and verification. Real productivity gains are calculated from time saved after proofreading, correcting, and managing edge cases.
Track both an economic metric and a quality metric. For a customer support assistant, this could be the total cost per resolved ticket alongside the percentage of suggested responses accepted without major edits. Be sure to factor software subscriptions, integration costs, and ongoing maintenance into the equation.
The business lead tracks operational performance. The technical lead monitors system uptime, errors, and infrastructure costs. Leadership decides whether to sustain, expand, or terminate the initiative.
Schedule a review after any major change: updating a model, indexing new documents, adding integrations, or granting the system permission to take autonomous actions. Strong performance during an initial pilot does not guarantee identical results after functional updates.
Consider an SME that wants to draft support responses based on internal knowledge bases. The support manager sets quality benchmarks and defines out-of-scope inquiries. Executive leadership signs off on the budget. An external development agency builds the integration with existing software.
In this scenario, AI governance remains with the business unit: the customer support manager decides whether proposed responses meet operational standards. The external agency is responsible for executing the technical scope defined in the agreement, not for determining acceptable business risk.
At launch, human support agents review every drafted response before sending it. Any request lacking verifiable reference documentation or involving a dispute must be escalated to a human. If the assistant is later granted permission to send messages autonomously, that evolution demands a new validation of scope, safeguards, and review thresholds.
Ownership, meanwhile, is split: the underlying model may belong to a third-party vendor, the internal documents remain subject to company rights and obligations, and rights to custom integration code depend on the contract. A single AI tool involves multiple stakeholders and distinct layers of rights.
Obtain written confirmation regarding software usage rights, access to source code, third-party components, and technical accounts required for operations. Clarify who pays for third-party subscriptions and who retains administrative control over account settings.
Next, define operational management: planned maintenance, incident response times, change management approvals, and the deprovisioning of access once the engagement ends. An automation integrated into your CRM should not retain active administrative access indefinitely.
Finally, plan for exit strategies and reversibility from day one. What assets will you be able to export? In what format? With what level of documentation and technical transition support? The agreement must clearly govern data handover and data deletion.
True operational control is tested the day you decide to switch vendors. Owning an application without administrative access, documentation, or the intellectual property rights necessary to maintain it leaves you just as vendor-locked as a proprietary SaaS subscription.
Do we need to hire a full-time AI manager? Not necessarily. An SME can start with an appointed business lead and external technical support. The need for a dedicated internal role depends on the number of active use cases, their operational criticality, and overall coordination needs.
Does a company own the outputs generated by an AI? You must distinguish between the contractual permission to use outputs and whether they qualify for copyright protection. You must also ensure outputs do not infringe on third-party intellectual property or contain unauthorized data.
Should the IT department lead all AI initiatives? IT must be involved in technical selection, architecture, and cybersecurity. However, business teams remain indispensable for defining expected quality, redesigning workflows, and evaluating business value.
Who has the authority to shut down an AI tool? Your governance policy must name this individual before deployment. The business lead can suspend an underperforming use case, while the technical lead must have the authority and procedure to revoke system access immediately during a technical or security incident.
Before selecting a model, identify the business process you want to improve, its business owner, and the required data. From there, you can clearly define legal rights, human oversight, and exit requirements.
Impulse Lab helps companies navigate AI through strategic opportunity audits, custom solution development, and adoption training. An audit is an effective first step to connect your business requirements with technical choices before committing development resources.
Our team of experts will respond promptly to understand your needs and recommend the best solution.
Got questions? We've got answers.
Leonard
Co-founder
