The AI Officer: why every organisation needs this key function

Five years ago, the role of Data Protection Officer (DPO) was unknown at most organisations. Today it appears in virtually every organisation chart, with a clear mandate, a structured methodology and a recognised professional community. The European legislator deliberately forced that shift through Article 37 of the GDPR.

The AI Officer follows a similar path, but is fundamentally a broader role. Where the DPO is primarily a compliance officer monitoring adherence to privacy legislation, the AI Officer is the organisation-wide director of responsible and strategic AI use. Compliance with the EU AI Act is an important part of that role, but certainly not the only part.

What makes the AI Officer broader than a compliance function?

The comparison with the CISO (Chief Information Security Officer) is illuminating. A CISO does not work solely to comply with the GDPR or NIS2, they build information security as a strategic capability of the organisation: culture, architecture, risk management and legal compliance simultaneously. The AI Officer does the same for artificial intelligence.

This means the AI Officer operates across four layers that together cover the full spectrum of responsible AI use:

Layer 1, strategy and policy

The AI Officer formulates, in collaboration with management, the organisation's AI policy: which AI applications are permitted, under what conditions, and with what ethical boundaries? This policy translates the organisation's mission and values into concrete rules for the deployment of AI. It is not a legal document, but a strategic framework that guides procurement officers, product managers, IT teams and end users.

Layer 2, ethics and values

AI systems can discriminate, manipulate and cause unintended harm, even without crossing a legal boundary. The AI Officer safeguards the ethical dimension of AI use: are the outcomes of our systems fair? Are those affected transparently informed? How do we handle algorithmic decisions that affect people? What are the consequences if the system makes a mistake? These questions require a structural ethical review process, not as a one-time project, but as an ongoing practice.

Layer 3, risk management and compliance

Here the AI Officer connects with the EU AI Act. Article 26 imposes a series of concrete obligations on deployers of high-risk AI systems: ensuring human oversighthuman oversightDesigned-in human ability to monitor, intervene in, override or shut down an AI system — meaningful only when the human has authority, information and time to act.Open full entry →, monitoring input data, reporting incidents, requesting and retaining supplier documentation. The AI Officer coordinates compliance with all these obligations and builds the compliance dossiers a supervisory authority expects. But risk management does not stop at the law: the AI Officer also identifies operational, reputational and strategic risks that fall outside the legal definition of 'high-risk'.

Layer 4, AI maturity and culture

An AI Officer who only manages dossiers misses half the impact. The function also has an internally mobilising role: increasing AI literacyAI literacySufficient understanding of AI's workings, capabilities and risks for one's role — an explicit expectation for provider and deployer staff under the EU AI Act.Open full entry → across the organisation (Art. 4 EU AI Act already mandates this), building knowledge among managers, and creating a culture in which employees dare to flag AI risks. Organisations that do this well discover risks internally, rather than through a supervisory authority or an incident.

The parallel with the DPO: similarities and differences

The AI Officer shares several structural characteristics with the DPO:

• Broad knowledge base required, Legal knowledge alone is insufficient. Anyone taking AI governance seriously also understands how ML models work, what biases can exist in training data, and how AI architecture choices determine the risk profiles of systems.
• Independence essential, Just as a DPO cannot be instructed by the controller in their supervisory function, the AI Officer must have the authority to contest classifications, challenge procurement decisions and halt projects when risks are insufficiently covered.
• Can be filled internally or externally, Large organisations appoint an internal AI Officer; smaller organisations outsource the function to specialist firms. Both are legitimate, provided the mandate and powers are formally established.

The crucial difference: the DPO is a legally mandated function for a defined category of organisations. The AI Officer is, for now, not a legally mandated function, but a strategic necessity for every organisation that uses AI structurally. The EU AI Act indirectly forces the presence of someone who coordinates the obligations; the real need for an AI Officer, however, is broader than that legislation.

What does an AI Officer do concretely?

The day-to-day tasks fall into five clusters:

1. AI register and classification

The AI Officer manages the AI register, the living overview of all AI systems the organisation deploys, per department, per supplier, per intended use. The risk class for each system is determined on the basis of Article 6 and Annex IIIAnnex IIIThe EU AI Act's list of high-risk use-case areas — biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice.Open full entry → of the EU AI Act. Incorrect classification is itself a violation, and responsibility for correct classification lies with the organisation, not the supplier.

2. compliance dossier formation

For each high-risk system, the AI Officer coordinates the construction of a compliance dossier: the deployerdeployerAn organization using an AI system under its own authority in its activities — carrying operator duties: use per instructions, oversight, input relevance, monitoring, notices.Open full entry → assessment (Art. 26), the Fundamental Rights Impact Assessmentimpact assessmentThe design-time discipline of describing a system, mapping stakeholders, identifying harms, rating probability × severity, choosing mitigations and documenting a signed decision — the skeleton under DPIAs, FRIAs and AIAs.Open full entry → (Art. 27), supplier documentation and oversight registers. The AI Officer is not always the executor, but always the director who ensures all components are present and current.

3. ethical review of new AI applications

For every new AI application, whether a purchased SaaS tool or an internally developed model, the AI Officer conducts a structured ethical review. Who is affected by the outcomes of this system? Are those outcomes transparent and explainable? Is there sufficient human oversight? These questions are not optional, they are the foundation for responsible AI use.

4. AI literacy and internal knowledge building

Article 4 of the EU AI Act has obliged organisations since 2 February 2025 to demonstrably make employees who work with AI AI-literate. The AI Officer coordinates this training programme, registers who has completed which training, and ensures knowledge remains current as the technology evolves. But AI Literacy goes beyond legislation: it is the foundation for an organisation that internally recognises and manages AI risks.

5. oversight of AI in the procurement process

Many AI risks enter the organisation through the procurement chain. The AI Officer ensures that when purchasing new AI systems, the right questions are asked of suppliers: what is the risk class of this system, is a CE declaration or conformity assessmentconformity assessmentThe pre-market process demonstrating a high-risk AI system meets the EU AI Act's requirements, leading to CE marking and registration.Open full entry → available, what do the instructions for use say? AI governance begins at the contract table, not at go-live.

Practical first steps for organisations

You do not need to wait for a definitive job description to begin. The following steps are immediately actionable:

1. Designate a lead, Assign someone internally to take on the AI Officer role, even if it is initially a secondary responsibility. Without ownership, governance stalls at good intentions.
2. Inventory all AI systems, Per department, per supplier, per intended use. Including shadow AIshadow AIAI tools adopted by staff or business units outside official channels and governance — the predictable product of processes that are too heavy or too slow.Open full entry → (ChatGPT, Copilot, niche SaaS tools). This is the indispensable foundation for every subsequent step.
3. Formulate an AI policy, One page is sufficient to start: which AI applications are permitted, what are the ethical boundaries, who has approval authority for new systems?
4. Start AI Literacy training, The obligation is in force now. Register training sessions and retain attendance lists (Art. 4 EU AI Act).
5. Document every decision, Every classification, every review, every oversight action, dated and retained. This is the evidence you need at an audit.

Why the AI Officer is here to stay

The emergence of the AI Officer is not hype. It is a direct consequence of a technology that is penetrating organisations deeply, combined with legislation that is already in force. Organisations that invest now in the knowledge, the structure and the mandate are building a capability that is resilient to further regulatory changes and that radiates trustworthiness to clients, employees and supervisory authorities.