Governance & Responsibilities
Version: 1.0 | Effective from: 1 January 2026
1. Purpose
This document defines the organizational structure, roles, and responsibilities for ensuring compliance with the AI Act, NIS2, and GDPR.
2. Roles & Accountability
| Role | Responsibility | Reports to |
|---|---|---|
| CEO | Overall compliance responsibility, budget allocation | Board |
| CTO | AI systems governance, risk classification, vendor audit, model monitoring | COO |
| CISO | NIS2 compliance, incident response, penetration testing, audit trail | COO |
| DPO | GDPR compliance, DSAR handling, privacy impact assessment, regulatory liaison | CLO |
| CLO (Legal) | Regulatory strategy, AI Act high-risk assessment, contracts, sanctions review | CEO |
| Product Manager | User transparency (AI disclosures), product design privacy, testing | CTO |
| Engineering Lead | Implementation of technical controls, data encryption, audit logging | CTO |
| Compliance Officer | Day-to-day compliance tracking, documentation, training coordination | CLO |
3. Governance Cadence
3.1 Monthly sync
Participants: CTO, CISO, DPO, Compliance Officer Agenda:
- Compliance progress review
- Incident review (if any)
- Risk register update
- Upcoming deadlines
3.2 Quarterly Board review
Participants: CEO, C-level, Board members Agenda:
- Compliance scorecard
- Budget vs. actual
- Key risks and mitigations
- Regulatory updates
3.3 Annual external audit
Participants: All + External auditor Scope:
- ISO 27001 audit
- GDPR readiness assessment
- AI Act compliance review
4. Decision Matrix
| Decision | Approval level |
|---|---|
| New AI system (low-risk) | CTO |
| New AI system (high-risk) | CTO + Legal + CEO |
| Vendor with data access | CISO + DPO |
| Data breach response | CEO + CISO + DPO |
| Policy change | CLO + CEO |
| Budget >EUR 50k | CEO + Board |
5. Escalation Path
Level 1: Owner (CTO/CISO/DPO) | (if unable to resolve within 24h)Level 2: C-level meeting | (if critical or regulatory)Level 3: CEO + Legal | (if board approval required)Level 4: Board6. Documentation Requirements
| Document type | Retention |
|---|---|
| Policy documents | 5 years after change |
| Audit logs | 5 years |
| DPIA | 5 years after processing ends |
| Incident reports | 5 years |
| Training records | 3 years |
| Meeting minutes | 3 years |
7. Training Requirements
| Role | Required training | Frequency |
|---|---|---|
| All employees | GDPR basics | Annually |
| All employees | Phishing awareness | Quarterly |
| Engineering | Secure coding | Semi-annually |
| Product / Data Science | AI governance, bias testing | Quarterly |
| Leadership | Compliance risks, incident response | Annually |
8. Certifications
| Role | Required certification |
|---|---|
| CISO | CISSP, CISM, or CEH |
| DPO | CIPP/E or GDPR certification |
| CTO | AI governance training (internal/external) |
9. Regulatory Contacts
| Authority | Contact | Purpose | Escalation |
|---|---|---|---|
| National DPA | [Country-specific DPA contact] | GDPR breaches, complaints | DPO + CEO |
| National CSIRT | [Country-specific CSIRT portal] | NIS2 incidents | CISO + CEO |
| DG Justice (EU) | — | AI Act high-risk | Legal + CEO |
10. Policy Review
- Quarterly: Review incident log, compliance metrics, risk register
- Semi-annually: Update per regulatory changes
- Annually: Formal policy review + board approval
Next review: Q2 2026