Who Owns AI Policy? The Head of People Role Most Companies Miss

AI policy works best with shared owners and one tie-breaker: the head of people owns acceptable use, IT owns access and tools, legal owns risk, and one named executive has the final say when they disagree. Most companies give it to IT or legal by default, and miss the part of the policy that is really about how people work.

The question matters because a policy without an owner is a document nobody enforces. Employees start using AI tools anyway, teams buy their own, and the first time something goes wrong, nobody knows who was supposed to have decided.

What AI governance means

AI governance is the set of rules, roles and records a company uses to decide which AI tools it uses, what they may do, and who answers for the results. The AI policy is the written part of it: what is allowed, what is not, and who approves exceptions. Governance also covers the habits that keep the policy real, such as approving new tools, reviewing how they are used, and recording the decisions made about them.

Who AI policy defaults to, and why that fails

IT usually gets AI policy because AI arrives as software. IT is right to own which tools are approved, how accounts work, and what data each tool can reach. But IT is not set up to decide whether a manager may use AI to draft performance reviews, or whether an engineer must say when a pull request was mostly written by a model.

Legal gets it because AI carries risk. Legal is right to own contracts, data protection and liability. But a policy written only by legal tends to be a list of prohibitions, and a list of prohibitions gets ignored when it gets in the way of work.

Each owner sees one slice. The slice neither sees is the biggest one: how AI changes the way people do their jobs.

Why the head of people belongs in the room

Most AI policy questions are people questions. May employees use AI for work they are credited for? What work must stay human, such as hiring decisions or feedback on a colleague? How do you treat a mistake made with an AI tool? How do you make sure people who use AI well are not penalized, and people who refuse it are not left behind? Who answers when AI speaks for someone?

The head of people already owns the policies that govern conduct, performance and fairness. AI use touches all three. Leaving them out produces a policy that is technically sound and that employees either fear or ignore.

A shared ownership model

Area	Owner	Decides
Acceptable use	Head of people	What employees may and may not use AI for, and how AI-assisted work is credited
Tools and access	IT or security	Which tools are approved, what data each may reach, how accounts work
Risk and contracts	Legal	Data protection, vendor terms, liability, regulatory duties
Agents that act	Engineering lead	What any AI agent may do on its own, and its boundaries
Tie-breaks and sign-off	One named executive	The final call when the owners disagree

The table is a starting point. What matters is that each area has one owner and the whole group has one tie-breaker.

Why a policy needs a decision record

A policy is a set of decisions: this tool is approved, that use is not, this team has an exception until March. If those decisions live in meeting notes and chat threads, the policy cannot be applied consistently, because nobody can find what was decided last time. Keep a simple record of each AI policy decision: what was decided, who decided, why, and when it will be reviewed. The same practice keeps any team's decisions findable; see the guide to a system of record for decisions.

Rules for a small team

A twenty-person company does not need a committee. It needs one page that answers five questions:

1. Which AI tools are approved, and who approves new ones?
2. What data must never go into an AI tool?
3. What work must a person do or check before it goes out?
4. When do you tell a customer or colleague that AI was involved?
5. Who answers for a mistake made with AI?

Name one person who owns the page, usually the founder or head of operations at that size, and review it every quarter.

A playbook for the head of people

1. Ask teams how they already use AI. The answers will differ from what the policy assumes.
2. Draft the acceptable use section with IT and legal, not after them.
3. Say clearly which work stays human: hiring decisions, feedback on people, anything that speaks in someone's name without their review.
4. Agree how AI-assisted work is credited and reviewed in performance conversations.
5. Make it safe to report a mistake made with AI, so problems surface early.
6. Review the policy each quarter with the other owners, and record what changed.

Keeping a person accountable for AI output is the thread through all of this; the guide to keeping human accountability with AI goes further. For the limits that make that necessary, see what AI agents cannot do.

Where StandIn fits

StandIn answers your teammates' questions from the work you have already done, in your words, with a source under every answer. Every reply is labeled as your StandIn, so nobody mistakes it for you, and it never guesses: when the answer is not in your work, it says so and points to the person who knows. That makes it simple to write into an AI policy. See how it works for people and operations leaders.