An AI governance RACI matrix allocates the activities of the AI programme across the functions of the organisation: who is accountable for the outcome (A), who is responsible for the work (R), who is consulted (C) and who is informed (I). It prevents gaps and overlaps, leaves a single final owner per activity and makes separation of duties visible between those who build, validate and audit AI systems.
How to use
- Enter the size, the sector, whether the organisation builds or only buys AI and whether it processes personal data at scale.
- Tick the functions that really exist, from the board to the business owners.
- Choose the governance activities or leave them blank to use the default set.
- Review the matrix, the reassignments, the separation of duties check and the committee charter outline, then export as CSV or PDF.
What each field asks for
| Field | What to enter |
|---|---|
| Organisation name (optional) | Appears in the title of the matrix. |
| Organisation size | In small organisations roles are combined and the matrix is leaner. |
| Sector (optional) | Choose the sector |
| Relationship with AI | Builders need independent validation; buyers need vendor due diligence. |
| Do you process personal data at scale with AI? | Decides whether DPIA and FRIA join the default activities. |
| Functions that exist in the organisation | Tick only the ones that really exist; missing ones are reassigned with a warning. |
| Governance activities (optional) | If none is ticked, the tool uses a default set based on your previous answers. |
Example
Aurora Credit, a fictional mid-sized lender that builds credit models and also buys third-party AI, has twelve functions but no AI committee and no internal audit. The matrix covers 15 activities with 7 reassignments: executive leadership is accountable for the inventory, triage, risk assessment and validation, risk management validates the models instead of the data team, and the audit of AI goes to an independent external reviewer. The proposed committee has 9 voting members and a quorum of 5.
When to use
- When structuring the AI governance programme and deciding who approves, who does the work and who checks it.
- Before setting up the AI governance committee and drafting its terms of reference.
- When an auditor, a client or the board asks who is accountable for each AI system.
Frequently asked questions
What does each letter of a RACI matrix mean?
R does the work, A is accountable for the outcome and approves, C is consulted beforehand and I is informed afterwards. The tool also uses A/R when the same function is accountable and does the work, which is common in small organisations.
Why can there be only one A per activity?
With two final owners, nobody is really accountable. The tool guarantees exactly one A per activity and, when the natural owner does not exist, moves the A to the next function on the list and shows the reassignment.
How does the tool handle separation of duties?
Whoever builds or operates a system never validates or audits their own model, and internal audit never runs operating controls. When no independent function is available, the matrix points to an independent external reviewer to engage.
What if the organisation has no AI committee, DPO or internal audit?
Without a committee, executive leadership is accountable for managing AI. Without a DPO, legal carries out the DPIA. Without internal audit, the audit of AI goes to an external reviewer, never to the first line.
Which DPCert certification covers this topic?
Building the AI governance programme, its roles and the committee is covered in RAIL (Responsible AI Leader). Board and executive duties on AI are covered in RAI-X (Responsible AI for Executives).
Does the matrix guarantee compliance with the EU AI Act or ISO/IEC 42001?
No. The tool is educational and suggests a starting allocation based on simple rules, which the organisation must adapt. It is not legal advice, not an audit and not a certification of the organisation.