What Is an AI Governance Role?

Job titles in this field have not settled. The same work gets posted as governance, risk, compliance, assurance or policy depending on which team wrote the requisition, and two companies will use the same title for jobs three levels apart. What follows is organized by what the role is accountable for, which is more stable than what it is called.

AI Governance Analyst 74 open

Owns The AI inventory, intake reviews for new models and vendors, and the risk assessments that go with them.

Reports to An AI governance manager or the head of privacy.

Often confused with Not a data scientist. The analyst asks what the model is for, who it affects and what evidence exists, and does not build it.

AI Governance Manager or Lead 74 open

Owns The program itself: policy, the review board agenda, the standards the business has to meet, and the reporting that goes upward.

Reports to A director of AI governance, a CISO or a chief privacy officer.

Often confused with Not the analyst with more years. The manager owns whether the program exists and works, not individual assessments.

Director of AI Governance

Owns Budget, headcount, the relationship with legal and engineering, and the answer when a regulator or a board member asks how AI is controlled.

Reports to A chief risk, privacy, legal or information officer.

Often confused with Not a compliance director who picked up AI. The seat exists because the AI questions did not fit the existing committees.

Chief AI Officer

Owns Enterprise AI strategy and the governance that holds it, usually both at once. In health systems the title often reads Chief Health AI Officer.

Reports to The CEO, the CIO or the chief digital officer.

Often confused with Not a CTO for models. The CAIO is accountable for what the organization is allowed to do with AI, which is a different question from whether it can.

AI Risk or Model Risk Analyst

Owns Model validation, performance and drift monitoring, and the risk register entries that come out of both.

Reports to A head of model risk, usually inside a second line of defense.

Often confused with Not the model's author. Independence from the build team is the entire point of the job.

AI Compliance Analyst or Manager

Owns Mapping a specific obligation, the EU AI Act, a state law, a sector rule, to controls somebody actually operates, then evidencing it.

Reports to A compliance manager or director.

Often confused with Not governance. Governance decides what the organization will allow. Compliance proves it met a rule that already exists.

AI Policy Analyst or Advisor

Owns Reading what is coming, drafting positions, and advising on regulation before it lands. Government, industry and civil society all hire for it.

Reports to A head of public policy or government affairs.

Often confused with Not internal policy writing. This role points outward at legislators and regulators.

AI Auditor and AI Assurance

Owns Independent testing of whether the controls everyone else designed are operating, and the report that says so.

Reports to A chief audit executive, or a client if the work is external.

Often confused with Not the control owner. An auditor who helped build the control cannot test it.

Responsible AI Lead

Owns Fairness, transparency and harm review, often sitting with product rather than with risk.

Reports to A head of product, research or trust and safety.

Often confused with Not a rebranded ethics committee. The job is usually judged on shipped changes to models and products.

AI Safety Researcher

Owns Evaluations, red teaming and the research behind both, concentrated in frontier labs and the institutes around them.

Reports to A head of safety or research.

Often confused with Not AI governance. Safety asks what the model can do. Governance asks what the organization will permit.

Privacy roles, CIPP and CIPM 54 open

Owns Personal data mapping, DSARs, retention, and the privacy half of every AI review.

Reports to A chief privacy officer or general counsel.

Often confused with Not separate from AI governance in practice. Privacy teams are the single most common source of AI governance hires.

GRC Engineer 24 open

Owns Controls written as code, evidence collected automatically, and the tooling that makes an audit a query instead of a scramble.

Reports to A head of security or GRC.

Often confused with Not a security engineer. A security engineer is measured on whether the system is safe. A GRC engineer is measured on whether you can prove it.

AI governance roles: tools, skills and workflows

What is the difference between AI governance and AI compliance?

Governance decides what the organization will allow itself to do with AI and sets the standard. Compliance proves it met a rule somebody else already wrote. The same person often does both at a small company, and they are separate teams at a large one.

Which AI governance role pays the most?

Chief level, then director, then manager, as you would expect. The sharper divide is sector. Financial services and health systems pay above technology companies for the same title, because the regulator is already in the building.

Which role should I target first?

Whichever one your current work most resembles. Privacy and internal audit people move into AI governance faster than engineers do, because the job is evidence and judgment before it is technology.

Do these roles require a certification?

Mostly no. AIGP is the one asked for by name with any regularity, and even then it is usually listed as preferred. Read the requirements rather than collecting credentials.