Policy
Who decides on AI tools, who assesses the risks and who oversees them? The roles explained, with a simple meeting structure and an AI register.
AI governance is the set of arrangements defining who in your organisation decides on AI tools, assesses the risks, manages the tools and provides oversight. Management is ultimately responsible, operational teams use and check, IT and security administer, and the data protection officer or privacy officer advises and monitors. Nobody does it alone.
For an office with thirty people, AI governance is neither a department nor a manual. It is a page of names, a meeting that happens and an accurate list. No law uses the term or prescribes one form. The relevant obligations do appear in legislation: GDPR accountability, the rules on the data protection officer, and AI Act provisions on AI literacy and human oversight.
In its advice on Microsoft 365 Copilot at a municipality, published in July 2026, the Autoriteit Persoonsgegevens (AP), the Dutch data protection authority, writes that policy must also be implemented in practice and employees must know it. According to the AP, responsibility should not rest with one employee or department but be shared throughout the organisation. If nobody is appointed, each employee chooses their own tool. Read what happens then in the shadow AI article.
The table below is a starting point. In a small organisation, roles overlap. That is allowed, except for the data protection officer: they must not make decisions about what they need to supervise.
| Role | Responsible for | Decides on |
|---|---|---|
| Management or board | Meeting GDPR and AI Act requirements, budget, risk appetite | Whether to deploy AI, AI policy, accepting residual risk |
| Data protection officer (DPO) | Advice and internal oversight of personal data handling | Nothing concerning purposes and means; their own investigations and advice |
| Privacy officer | Implementation: register, DPIAs, agreements, colleagues' questions | What management has delegated to this role |
| IT or application administration | Configuration, accounts, access permissions, connections | Technical settings within policy |
| Security | Security requirements, incidents, supplier checks | Whether a tool meets security requirements |
| Operational managers | Their team's use, output checking, training | Which tasks the team uses the tool for, within policy |
| Employees | Careful use, reporting mistakes and incidents | Whether an outcome is good enough to use |
| Procurement or contract management | Data processing agreements and terms | No substantive decisions; ensures contracts are assessed before signing |
The GDPR places obligations on the controller. That is the organisation and therefore its board. On its DPO page, the AP calls senior management “the controller within the meaning of the law”. Management may outsource tasks, but not responsibility. Operational managers own their team's use: they are first to see when something goes wrong.
IT and security answer questions a lawyer cannot: which documents can the assistant access, who can enable a connection, what is logged? In the same advice, the AP highlights the importance of authorisations: if an AI system can access every document the user can, specific authorisations become even more necessary.
The data protection officer is governed by Articles 37 to 39 GDPR. Article 37 GDPR lists three situations in which designation is mandatory:
The AP explains its interpretation on The DPO in your organisation. For the first group, it lists healthcare and educational institutions alongside central government, municipalities and provinces. Examples of the second include profiling, camera surveillance and personnel monitoring systems. Member States may designate additional situations. According to the AP, the Netherlands has not done so.
According to the AP, you must then substantiate why you have or have not appointed a DPO. “Large scale” and “core activities” are open concepts. If AI means you will process more sensitive data than previously, ask the question again.
The DPO is designated based on professional qualities and expertise in data protection legislation and practice. They may be an employee or someone you hire externally. The organisation publishes their contact details and communicates them to the supervisory authority. The AP estimates the number of DPOs in the Netherlands at around 10,000.
Article 39 lists five tasks the DPO must at least fulfil:
Article 38 protects the position. The organisation involves the DPO properly and in good time in all personal data protection matters. The DPO receives access to data and processing and the resources needed for their work. They receive no instructions about performing their tasks, may not be dismissed or penalised for doing so, and report directly to the highest management level. Other tasks are allowed provided they do not create a conflict of interests.
The AP makes that last point concrete. The DPO may not also hold a role determining processing purposes and means, such as head of finance, strategy, marketing, IT or HRM, or CISO. Article 39 of the Dutch GDPR Implementation Act adds confidentiality concerning what the DPO learns through a data subject's complaint or request.
The DPO does not own the privacy policy or approve AI tools. On its page about DPO tasks and responsibilities, the AP writes that meeting the rules is the organisation's responsibility, the DPO is not personally liable for an infringement, and maintaining the processing overview is not a DPO task. For a DPIA, you must ask the DPO for advice and record what you did with it. Read more in the article on DPIAs for AI tools.
For AI governance, this means the DPO is at the table, early and with all information, but does not sign off the decision.
The GDPR does not recognise the privacy officer. It is a job title organisations define themselves. The DPO is a statutory role.
| Data protection officer | Privacy officer | |
|---|---|---|
| Legal basis | Articles 37 to 39 GDPR | None |
| Task | Advise and provide internal oversight | Implement, organise, often also advise |
| Position | Independent, no instructions, reports directly to highest management | Ordinary employee or operational adviser |
| Protection | Not dismissed or penalised for performing tasks | Ordinary employment position |
| Registration with the AP | Yes | No |
| May help decide purposes and means | No | Yes, if agreed |
If you voluntarily appoint someone and call them a data protection officer, the AP says the same rules apply as for a mandatory DPO, including registration. If you do not want those requirements, the AP recommends a different title, such as privacy officer, and making clear within and outside the organisation that this person is not a DPO within the meaning of the law.
The AP's generative AI tool suggests who should participate: have privacy professionals, IT specialists and representatives of departments wishing to deploy AI complete it, and involve the DPO in good time. On a small scale, that is already an AI meeting. Everyday questions do not belong there, and incidents follow the data breach procedure.
Neither the GDPR nor AI Act prescribes an internal “AI register” by that name for an organisation that only uses AI. It is a practical aid. Without a list, the meeting does not know what it is discussing.
The record of processing activities is mandatory and describes personal data processing. The AI register describes tools, even without personal data input. The two refer to each other. The article on the record of processing activities shows what an AI tool entry looks like. Public authorities also have a public algorithm register. See the article on the Algorithm Register and IAMA.
Governance says who decides. Policy says what has been decided. Training ensures employees know it.
The AI policy is the document managed by the meeting: permitted tools, data, prohibited use, roles and incidents. Read how to write it in Writing an AI policy.
Article 4 of the EU AI Act was amended on 27 July 2026. According to the adopted digital omnibus text, providers and deployers take measures supporting the development of staff AI literacy. The obligation does not require a particular level to be ensured for each employee. For governance, this means someone owns training and can show what was done. Find the details in the AI literacy article.
If you use a system classified as high risk under the AI Act, additional obligations apply. Article 26 requires, among other things, assignment of human oversight to natural persons with the necessary competence, training and authority. According to the European Commission, requirements for Annex III applications apply from 2 December 2027. Read what high risk means and what already applies in the AI Act explained. Whether your application falls within it requires a legal assessment.
PrivaSearch is an aid within your governance, rather than a replacement. It pseudonymises personal data in documents before an AI assistant searches them. You decide who approves its use, who owns it and who oversees it.
Several elements align with this article's roles. Nothing becomes searchable until an employee has viewed and approved the document: review is mandatory. Employees take built-in training repeated periodically. Actions are logged. Find the explanation on the page on how it works.
Your environment also creates four starter documents from one form: an AI policy including a chapter on roles and incidents, a DPIA starter document, a register entry and a written lawful basis. They are described on the page about the GDPR and the AI Act. These are starter documents rather than legal advice. Your data protection officer's advice and formal management adoption remain your responsibility.
What a connected assistant sees, and what you arrange yourself, appears on the page about AI chatbots and the GDPR. To see the review, training and documents, book a demo.
A one-page arrangement: who decides on new AI tools, who assesses risks beforehand, who manages tools and who checks whether use follows the arrangements. In a small organisation, that often means three or four people meeting a few times a year with a list of tools in use. No separate department is needed.
Not merely because of AI use. Designation is mandatory for public authorities, organisations whose core activities involve systematic large-scale monitoring of people, and organisations whose core activities involve large-scale processing of special category or criminal offence data. If AI means your organisation processes more sensitive data, the answer may change. If unclear, you must substantiate your choice.
The data protection officer is a statutory role: independent, without instructions, with direct access to senior management and registered with the Autoriteit Persoonsgegevens. Privacy officer is a job title without statutory status, usually someone implementing and organising privacy work. A privacy officer may help decide on processing; a DPO may not. An organisation can have both: the privacy officer implements and the DPO supervises.
No. The DPO advises and supervises. According to the Autoriteit Persoonsgegevens, the DPO may not hold a role determining processing purposes and means, because they would then supervise their own decision. Management or an authorised manager decides. The organisation does involve the DPO in good time and must ask for advice on a DPIA.
As controller, the organisation remains accountable for what happens to personal data. According to the Autoriteit Persoonsgegevens, the data protection officer is not personally liable for an infringement. Whether an employee is to blame depends on the arrangements in place and whether they knew them. That is why policy, training and a reporting procedure belong together.
An internal AI register by that name is not a GDPR or AI Act obligation for organisations that only use AI. The record of processing activities is mandatory for personal data processing, and public authorities have a public algorithm register. Your own AI application list is mainly practical: without an overview, you cannot assess risks or tailor training.
Employees often use AI chatbots outside their organisation's visibility. What that means, what can go wrong and how to gain control step by step.
Where an uploaded file ends up, how long it stays, who can access it and what deletion means. With four approaches for files containing personal data.
The AI Act timeline after the digital omnibus: what applies already, what has moved to 2027 and 2028, and what AI chatbot users need to arrange now.
We show it with fictitious client files from your sector: upload, detection, review, search and the connection with your AI assistant. Afterwards you'll know exactly what your team can use safely.
Book a demo →