Skip to content

Who Should Lead the Process

An ARAF assessment is a governance review, not a technical audit. Internal ownership should sit with governance leadership, with technical teams as critical contributors rather than process owners.

Organisation StageRecommended LeadRationale
Seed-stageFounder or CEO (acting as AIOC)Seed organisations typically operate with a named governance authority and a documented decision log.
Growth-stageGeneral Counsel or Head of LegalContract infrastructure and liability architecture are central assessment domains.
EnterpriseGeneral Counsel, Chief Risk Officer, or AI Governance LeadAssessment should be integrated into formal risk governance and committee oversight structures.
FunctionRole in Assessment Process
Legal / General CounselOwn D3 and D4 preparation, regulatory interpretation, and overall engagement governance.
Risk / ComplianceLead dimensional pre-assessment, multiplier analysis, and governance maintenance design.
Technical / AI EngineeringProvide architecture evidence, supply chain maps, autonomy parameters, and system change records.
OperationsProvide operational evidence, monitoring records, anomaly escalation records, and execution context.
Commercial / FinanceProvide leverage exposure context, customer/vendor contract realities, and dependency patterns.
Executive / BoardSet governance mandate, approve accountability design, and receive institutional reporting outputs.
  • Treating assessment as an engineering exercise instead of a governance process
  • Running without a single accountable internal lead
  • Preparing documents without briefing interview participants
  • Deferring legal contract and liability analysis until mid-assessment

The strongest internal model is a governance-led, cross-functional process with clear accountability ownership and evidence discipline before assessor engagement begins.