No organization wants to be the one in the headlines for a data breach, an AI hack, or an AI deployment that went wrong in public. Donna Medeiros, VP of AI and Data Advisory at Data Society, has advised enough executive teams to know the fear is universal. What varies is who actually pays for it when it happens.
“This one’s a tough one, because most organizations say they don’t want to be in the headlines for a data breach, AI usage gone wrong, or AI hacking. But the buck usually stops at the C-suite level.”
Whose Job Is Actually On the Line
Donna is specific about where accountability lands when an AI governance failure becomes public.
“Whose job is on the line often really does trace back to the CEO of an organization, the CTO, sometimes the CISO, the security officer, not just an AI officer if there is one at the organization.”
That’s not a hypothetical. Half of CEOs surveyed by BCG for its 2026 CISO Survey acknowledge that getting AI wrong could cost them their job, and 35 percent of organizations report a significant impact from an AI-enabled attack in the past twelve months, according to BCG. CISOs are absorbing a similar squeeze from the other direction. 96 percent now own AI governance and risk management across their organizations, a mandate that arrived without a matching increase in budget or headcount at most companies, according to Cybersecurity Insiders. Three-quarters of CISOs now worry about personal legal exposure if something goes wrong, up from just over half two years ago.
The Cost of Skipping the Audit
Donna is direct about the fix.
“There needs to be an audit function, internal, and most organizations these days do try to have external audits that look at the failure points of governance and where the potential high risks are, so that this doesn’t happen, so you don’t have something going public.”
The data explains why she’s insistent on this point. In IBM’s 2026 Cost of a Data Breach Report, 92 percent of organizations that experienced an AI-related security incident lacked proper AI access controls at the time, and shadow AI, tools deployed without governance oversight, showed up in 43 percent of breached organizations, more than double the prior year’s 20 percent, at an average cost of $5.39 million per incident. Only 32 percent of breached organizations had an AI policy in place at all, down from 37 percent the year before, and just 19 percent had their AI governance and security teams actually coordinating with each other. AI-related breaches cost $5.33 million on average, against $4.70 million for breaches without AI involvement. An audit function doesn’t just catch problems. In this data, it’s the difference between a $4.7 million incident and a $5.3 million one, and often the difference between a contained incident and a public one.
Governance Doesn’t Stay in IT
Donna’s closing point is the one she keeps returning to across every conversation about AI governance: this isn’t a technical function that reports up from IT. It’s an executive one.
“The buck should stop at the C-suite level. That’s whose job it is to make sure governance is an enterprise-wide function.”
An audit function run by a single team, buried under IT or handed to whoever happens to hold the AI officer title, will find the failure points that team is equipped to see and miss the ones it isn’t. An enterprise-wide governance function, sponsored at the CEO or CTO level and checked by both internal and external audits, is what actually closes the gap between having a policy and coordinating on it, which the IBM data shows is exactly where most organizations are currently failing.
Frequently Asked Questions
Donna Medeiros says accountability usually traces back to the CEO, the CTO, and sometimes the CISO, not just an AI officer if the organization has one. In her view, the buck stops at the C-suite level rather than with the IT department.
Half of CEOs in BCG’s 2026 research acknowledge that getting AI wrong could cost them their job, and 35 percent of organizations report significant impact from an AI-enabled attack in the past twelve months. CISOs feel similar pressure, with 96 percent now owning AI governance and three-quarters worried about personal legal exposure.
She argues that organizations need internal audits, ideally paired with external ones, that find governance failure points and high-risk areas before anything goes public. The goal is catching problems early enough that an incident never becomes a headline.
In IBM’s 2026 Cost of a Data Breach Report, 92 percent of organizations with an AI-related incident lacked proper AI access controls, and shadow AI appeared in 43 percent of breached organizations, up from 20 percent. AI-related breaches averaged $5.33 million against $4.70 million for breaches without AI, while shadow AI incidents averaged $5.39 million.
A single team buried under IT, or handed to whoever holds the AI officer title, will only find the failure points it is equipped to see. An enterprise-wide function sponsored by the CEO or CTO and checked by internal and external audits closes the gap the IBM data exposes, where only 32 percent of breached organizations had an AI policy and just 19 percent had governance and security teams coordinating.
