19%
of organisations gave risk and compliance primary responsibility for AI governance in 2025, up from 13%; information security remained most common at 21%

What the chart shows

Information security was the function most often given primary responsibility for AI governance in 2025, at 21% of organisations in the AI Index and McKinsey survey, the same as in 2024. Risk and compliance rose the most, from 13% to 19%, and dedicated AI governance roles rose from 14% to 17%.

Data and analytics functions fell from 17% to 13%. The share of organisations where no function is primarily responsible fell from 9% to 5%.

Key numbers

MeasureValue
Information security, 202521%
Risk and compliance, 202519%
Risk and compliance, 202413%
AI-specific governance roles, 202517%
Data and analytics, 202513%
No function responsible, 20255%

How to read it

  • Survey of business leaders by the AI Index and McKinsey & Company in 2024 and 2025, across several regions and industries; it has no respondents from China.
  • ‘Unknown’ responses are not shown, so shares do not add up to 100%.
Source: McKinsey & Company Survey, 2025, via the AI Index Report 2026 (Stanford HAI), figure 3.3.6: Business functions assigned primary responsibility for AI governance, 2024 vs. 2025. Chart and text by AI Adoption.
Numbers checked against the published data on 20 October 2026.
Download the data (CSV) · Cite this chart