In a company, overall responsibility for AI regulation lies primarily with management, since the EU AI Act obliges the governing body to align existing governance structures with AI-specific requirements. In practice, however, this responsibility is distributed across several roles: from compliance teams and IT managers to a dedicated AI officer. The following questions clarify what these responsibilities look like in concrete terms and what qualifications are required.<\/p>\n
The EU AI Act draws a fundamental distinction between two actors: providers<\/strong> and deployers<\/strong> of AI systems. Providers are companies that develop AI and place it on the market under their own name. Deployers are all those who use AI systems professionally or have employees use them. Different but binding obligations apply to both roles.<\/p>\n The core obligations that the EU AI Act imposes on companies include:<\/p>\n Important to know: As of 2 August 2025, the transparency obligations and the AI competence requirement apply in full. All further obligations for high-risk AI systems take effect in stages through 2027 and 2028 respectively. Companies that act now are significantly better positioned than those that wait until the last deadline.<\/p>\n For high-risk AI systems, legal responsibility lies primarily with the deployer \u2014 that is, the company using the system. Management is obliged to establish appropriate governance structures and ensure they are upheld. Violations can result in fines of up to 7 percent of global annual turnover.<\/p>\n The chain of responsibility is structured in multiple layers. The governing body \u2014 meaning the board or management \u2014 must evaluate whether existing governance mechanisms are sufficient for AI deployment or need to be adapted. In concrete terms, this means:<\/p>\n A frequently overlooked point: if a deployer changes its role \u2014 for example by redistributing an AI system under its own name or making significant changes to its functionality \u2014 it becomes legally a provider. The associated obligations are considerably more extensive and include, among other things, technical documentation, conformity assessments, and cooperation with authorities.<\/p>\n The EU AI Act does not mandate the appointment of an AI officer, unlike the GDPR’s requirement for a data protection officer. Nevertheless, establishing such a role is strongly recommended as soon as a company deploys AI systems in relevant processes, particularly when high-risk applications are involved.<\/p>\n The ISO 42001 standard, the international standard for AI management systems, goes further. It requires that roles and responsibilities for AI be clearly defined and assigned in accordance with the organisation’s needs. This also includes establishing a process that enables employees to report concerns about AI deployment throughout the entire system lifecycle.<\/p>\n In practice, an AI officer<\/a> typically takes on the following tasks:<\/p>\n Whether this function is structured as a standalone position or as an additional responsibility within an existing role depends on the size of the company and the AI intensity of its processes. What matters is that responsibility is clearly assigned and does not remain in a vacuum of accountability.<\/p>\n AI governance does not work as a one-person task \u2014 it is a team effort. A sensible distribution of AI responsibility within a company is oriented around existing areas of accountability and supplements them with AI-specific tasks. Certain typical areas of responsibility have proven effective in practice.<\/p>\n Management bears overall responsibility and sets the AI strategy as well as the risk appetite. The compliance and risk team monitors adherence to the AI regulation and maintains the risk management system. The IT department is responsible for the technical implementation, security, and documentation of the systems in use. HR is responsible for demonstrating employee competence and ensuring compliance with employment law obligations when AI is used in the workplace.<\/p>\n In addition, supervisory bodies, external specialist advisors, and auditors play an important role. They verify whether the governance structures that have been established actually function, and provide independent assessments of the company’s compliance maturity. Particularly in the context of AIMS certification under ISO 42001<\/a>, external auditors are an integral part of the process.<\/p>\n What is crucial for success is a clear escalation path: who reports concerns to whom? Who decides when there are conflicts between efficiency and compliance? These questions should be set out in writing in an AI policy that is reviewed at regular intervals for its currency.<\/p>\n AI officers within a company need a broad competence profile that combines a foundational understanding of technology, legal knowledge, and organisational skills. The EU AI Act explicitly requires deployers to ensure that the people involved with AI have sufficient AI competence. This applies not only to IT professionals, but to all roles along the governance chain.<\/p>\n Specifically, AI officers should have or develop the following knowledge:<\/p>\n The good news: these qualifications can be built up in a targeted way. Recognised certifications \u2014 such as AI Manager or AI Compliance Officer \u2014 provide the structured knowledge needed to implement the EU AI Regulation in day-to-day business operations.<\/p>\n We at mITSM offer specialised training and certifications that prepare professionals and managers specifically for the requirements of the EU AI Regulation and ISO 42001. Our trainers are certified experts who know AI governance and AI compliance from practical experience and pass this knowledge on directly.<\/p>\n Our offering includes, among other things:<\/p>\n\n
Who bears legal responsibility for high-risk AI systems?<\/h2>\n
\n
Do companies need a dedicated AI officer?<\/h2>\n
\n
How should AI responsibility be meaningfully distributed across departments?<\/h2>\n
Primary responsibilities by function<\/h3>\n
Secondary roles and oversight<\/h3>\n
What qualifications do AI officers within a company need?<\/h2>\n
\n
How mITSM supports you with AI regulation in your company<\/h2>\n