Executive sponsor (CIO / CTO)

AI adoption by role

The executive sponsor is the CIO (chief information officer), CTO (chief technology officer) or business-line technology head who is accountable for AI (artificial intelligence) adoption across a portfolio. This seat does not write prompts for the teams. It sets the outcomes, the risk appetite and the boundaries, funds the system that makes adoption safe, and decides when to pause or stop. Counts, shares and durations on this page are illustrative.

Licences are the cheapest part of AI adoption. The sponsor's real decision is whether to fund the reviewers, validators, controls and asset owners that let teams use those licences safely.

1. At a glance

Field	For the executive sponsor
Mandate	Set portfolio outcomes, risk appetite, prohibited boundaries, decision rights and funding; name an accountable owner for every use case and shared asset
Primary decision	Which use cases and enabling capabilities get funded, at what risk appetite, and when a use case steps down, pauses or exits
First safe win	Fund Stage 0 foundations plus one medium-tier pilot team, with reviewer capacity and evaluation upkeep inside the same budget line
Biggest failure mode	Buying seats and reporting seat counts as adoption, while independent validation, review time and asset ownership stay unfunded

Line: 1st line (accountable executive) · Family: Lead · Variants: CIO, CTO, business-line technology head

Variant	What differs
CIO	Owns the enterprise technology portfolio, shared platforms and the funding model for shared assets
CTO	Owns engineering standards, reference architecture and the technical direction of the platform and catalog
Business-line technology head	Owns one line's portfolio and its outcomes; consumes the shared platform and funds the line's extensions

2. Your journey: first steps to fully adopted

The sponsor's journey starts with funding the foundations and ends with a portfolio that runs on evidence.

Start here: your first steps

Read the AI inventory and list every use case that has no named owner.
Approve the risk appetite statement for AI, with the prohibited boundaries written out.
Fund Stage 0 foundations and reviewer capacity in the same budget line.
Back one medium-tier pilot that has a baseline, a named owner and an expiry date.

Fully adopted: how the work runs

Moment in the work	Before AI	Fully adopted (Stage 4–5)	Decision that stays human
Funding	Licences bought per seat; review and validation funded later, if at all	Every funding request shows the full cost: licences, review, validation and asset ownership	Which use cases and shared assets get funded
Portfolio view	Monthly packs compiled by hand; figures without sources	An agent drafts the scorecard narrative; every figure links its source and its metric owner confirms it	What the portfolio does next
Risk appetite	Set once, then read again only after an incident	Reviewed on a fixed cycle from near-miss trends and evaluation results, with the second line's challenge on record	The appetite itself, and any residual risk routed to the executive level
Review of outcomes	Pilots age with no production or stop decision	A periodic review pack from continuous evaluation; each use case gets a decision with an expiry	Continue, step down or exit
Pause and recovery	Stopping a use case needs a crisis meeting	Teams test the kill switch on a schedule; the sponsor reads the drill results	Ordering a pause, and lifting it

What changes for the organization

Before	After
Seat counts reported as adoption	A balanced scorecard with denominators and owners
Ten local fixes (illustrative) for one date problem	One funded shared asset with a named owner
Pilots that never end	Every pilot ends in production or a recorded stop

In any organization

Small or unregulated: the founder or head of engineering holds this seat, and may also be the business owner of each use case.
What scales: committee layers, formal validation reports and audit packs shrink. A named owner per use case, human approval of merges and releases, no customer data in unapproved tools and a tested kill switch never do.

3. Your decisions

The column "your relationship" uses the site's decision relationship vocabulary: owner or approver · independent validator or challenger · consulted control partner · evidence recipient · notified. The operating model holds the full RACI (responsible, accountable, consulted, informed).

Decision	Your relationship	Inputs	Escalation	Cannot be delegated
AI risk appetite for the portfolio	Owner, inside the enterprise risk appetite; AI and model risk is the independent challenger	Enterprise risk appetite statement, risk-tier standard, incident and near-miss history	The board risk committee or its equivalent	Yes
Prohibited boundaries	Owner of the portfolio statement; the second line defines the standard	Risk-tier standard, legal and compliance view	Board risk committee	Yes
Portfolio outcomes and funding	Owner or approver	Leader decision briefs, portfolio scorecard, intake pipeline	Executive committee	Yes
Fund the enabling system	Owner or approver	Platform, validation, enablement and reviewer-capacity requests	Executive committee	Yes
Name accountable owners	Owner	Use-case inventory, asset catalog gaps	Executive committee	Yes
Residual risk on a high-tier use case	Owner only where policy routes it to the executive level; otherwise evidence recipient	Validation report, residual-risk statement, compensating controls	Per the organization's policy	Yes, when it is yours
Step down, pause or exit	Owner at portfolio level	Scorecard, failed evaluation, incident, control gap	Executive committee	Yes
Tool or provider approval	Evidence recipient; procurement and third-party risk own it	Tool evaluation decision record, exit plan	Procurement and third-party risk	Not yours to hold
Release of a change	Notified, for high-tier changes only	Change record	The existing change authority	Not yours to hold

4. Two kinds of adoption

Kind	What it means for you	Example
How you work with AI	You use the approved assistant for your own drafting and reading, and say so. You check every number against its source	The assistant summarizes four leader decision briefs; you read every residual-risk line in full yourself
What you fund and steer	The use-case portfolio, the shared platform, the asset catalog, validation capacity and the enablement program	You fund the owner of `shared-datetime` and the temporal-domain contract instead of ten separate team fixes

Modelling use. A sponsor who mandates AI use but never uses it signals that the rules are for others. A sponsor who uses it on approved tools, with no restricted data, signals that the rules are workable.

5. Your ladder

The adoption ladder describes the controls and evidence around a use case. For the sponsor, each stage asks what must be funded and decided, not what the sponsor may delegate. Maturity is never permission to hand accountable decisions to an agent.

Stage	AI use from your seat	Guardrail you fund or require	Artifact or evidence	Decision relationship	Step-down trigger
0 · Foundations	None	Inventory, intake, risk tiers, approved tools, acceptable use, logging, named owners	Funded foundations plan with owners and dates	Owner of funding and of the risk appetite statement	Any foundation without an owner: no team enters Stage 1
1 · Personal productivity	Drafts and summaries of your own documents	Approved tool; no restricted data; you apply every change	Your own drafts	Owner of your text	An unreported policy breach from your office
2 · Team context	A reviewed prompt that drafts leader decision briefs in the house format	Prompt reviewed like code; source links required	Draft briefs with sources	Evidence recipient of the brief; owner of the decision	Briefs reach you without sources
3 · Delegated tasks	An agent drafts the scorecard narrative from the metrics system	Every number links its source; the metrics owner checks before you read	Scorecard narrative with source links	Evidence recipient; owner of what you decide from it	A number in the narrative cannot be traced
4 · Agentic workflows	Teams in your portfolio run agentic workflows	Funded sandbox, spend limits, kill switch, recovery tests	Kill-switch and recovery test results	Evidence recipient; owner of the funding	A kill-switch test fails or is skipped
5 · Scale and sustain	Portfolio review draws on continuous evaluation	Asset ownership and funding; periodic review; material-change process	Periodic review pack	Owner of continue, step down or exit	A shared asset loses its owner or funding

Human-operated at Stage 5. Setting the risk appetite, accepting residual risk, and ordering a pause or exit stay with the sponsor at every stage. An agent can assemble the evidence. It never makes these calls.

6. Priority scenarios

Scenario	Value	Risk tier	Stage	First step	Do not use AI when…
Summarize decision briefs	Faster reading of long packs	Low	1	Use the approved assistant on internal briefs only	The pack contains restricted or customer data
Draft the portfolio narrative	Consistent monthly story across lines	Medium	3	Require source links for every figure	The figures are not yet reconciled by their owners
Find duplicate efforts	One funded shared asset instead of ten local ones	Low	2	Ask the catalog owner for a duplicate report across the intake pipeline	The report would replace a conversation with the asset owners
Compare provider options	Clear trade-offs before a renewal	Medium	2	Start from the tool evaluation decision record on the tools page	The decision depends on contract terms only legal has read
Prepare a committee update	Clear, short updates to the board risk committee	Medium	1	Draft, then have the second line check every risk statement	The update states a risk position the second line has not confirmed
Workforce planning	Better questions about role change	Low	1	Use aggregate, approved data only	Any decision about a named person

7. The due-date ask from your seat

The organization must show the contractual payment due date the same way on web, mobile, statements and reminder notifications, and the payment cutoff time in the customer's own IANA (Internet Assigned Numbers Authority) time zone. The sponsor never sees a pull request for this. The sponsor sees the reason it went wrong: ten date implementations (illustrative), three of them wrong, while a shared library existed.

Card field	For the executive sponsor
Decision	Fund the shared-library owner and require one governed shared path instead of four local fixes. Architecture and the library owner approve the contract and the `formatPaymentCutoff(cutoffInstant, customerZone)` extension; the change authority approves the release
Input received	A leader decision brief from the enablement lead: option A manual tests, option B delegated test generation behind an approval gate, option C move the wrong implementations onto `shared-datetime` first
Output and evidence	A decision record: B, with C done first; architecture named as contract owner; review after two releases or at once on a model or provider change
Recipient	The enablement lead, the engineering managers of web, mobile, statement-service and notification-service, and architecture
What stays the same	payment-schedule-service stays the read-only source of the due date and cutoff; the change goes through existing change control; the AI use stays medium tier

8. Hand-offs and separation of duties

You give → to whom	You receive ← from whom	You challenge	You are notified of
Risk appetite and boundaries → the second line and every use-case owner	Leader decision briefs ← the enablement lead and use-case owners	Benefit claims without a baseline	High-tier releases
Funding decisions → engineering managers, platform, enablement	Portfolio scorecard ← the enablement lead, with metric owners	Seat counts offered as adoption	Kill-switch use and severe incidents
Named owners → the asset catalog and inventory	Validation conclusions ← independent validation	Pilots with no path to production	Exceptions past their expiry
Pause or exit orders → use-case owners	Audit reports ← internal audit	Requests to fund a use case without reviewer capacity	Provider changes that trigger re-evaluation

Separation of duties. The sponsor who funds a use case does not validate it. When the sponsor is also the business owner, the residual-risk acceptance still needs the independent challenge of AI and model risk on record first.

Third-line interface: internal audit

Internal audit is the third line. It is not part of the second line, and it is not a delivery partner. It reports independently, usually to the audit committee.

Internal audit…	What it means for the sponsor
Receives evidence	Inventory, risk-tier decisions, control design, validation reports, change records, monitoring results, exceptions
Independently assesses	Whether governance and controls are designed well and work in practice
Never approves	First-line releases, use cases or tools
Never designs controls	It does not write controls on management's behalf, because it will test them later
Your duty	Give it full, read-only access to evidence; own the management response to findings, with dates and owners
Your mistake to avoid	Asking audit to "sign off" a use case before launch, or treating an audit finding as a delivery-team problem only

9. Evidence and records

Evidence	Produced or consumed	System of record	Retention owner
Risk appetite statement for AI	Produced	Enterprise risk management system	The second line
Leader decision briefs and decision records	Consumed, then produced	Decision log or evidence index	Records, per the schedule
Portfolio scorecard	Consumed	Metrics system	The enablement lead, with metric owners
Funding approvals for shared assets	Produced	Finance system; owner recorded in the asset catalog	Finance and the asset owner
Validation reports, high tier	Consumed	Validation repository	Independent validation (validation records owner)
AI or model risk decision, high tier	Consumed	Model or AI inventory	AI and model risk (a separate artifact from the validation report)
Audit reports and management responses	Consumed, then produced	Audit issue tracker	Internal audit owns the report; management owns the response

10. Skills and learning path

For an executive, the skill is decision literacy: reading evidence, asking for the denominator, and recognizing when a claim has no baseline. Prompt writing matters less. Scenario practice matters most.

Level	What the sponsor learns	How	Done when
Foundation	The two axes, the tiers, what is prohibited, acceptable use	A 45-minute leader briefing; acceptable-use scenarios	You answer the scenario questions correctly and know the escalation path
Practitioner	Reading a trace, an evaluation report and a scorecard	Walk through Lab 5 and Lab 6 as an observer with the team	You can say why a passing evaluation still leaves residual risk
Advanced	Making a pause or exit call under pressure	A tabletop exercise: a provider change breaks the evaluation set the week before a release	You make the call, record it with an expiry, and name the owner

11. Measures and incentives

Ask for a balanced portfolio scorecard: value, quality, risk, workforce, sustainability and unit cost, each with a denominator and an owner. The measure chapter defines the metrics.

Metric	Definition	Anti-gaming note
Use cases past pilot	Use cases in production or stopped by decision, divided by all pilots older than two quarters	A stopped pilot with a recorded reason is a good result
Net time saved	Time saved minus review and rework time, per change	Never accept gross time saved
Escaped severe defects	Severe defects found after release, per release	Read together with cycle time
Near misses reported	Count per quarter, by team	A rise after a new reporting path is good news; never set a target to reduce it
Unit cost	Total cost of a use case per unit of work, including review	Include reviewer and validation time, not only licences
Asset health	Shared assets with a named owner and an in-date review	An asset without an owner counts as a liability
Workforce transition	People with protected learning time and a stated role path	Not a headcount reduction target

Incentives. Leaders below the sponsor follow what the sponsor counts. Reward honest numbers, reused assets and recorded "not a fit" results. Never reward the largest time-saved claim.

12. Cost, capacity and workforce

The sponsor funds the enabling system, not just pilots. The split below is illustrative and varies by organization.

Budget line	What it pays for	Illustrative share of first-year AI spend
Licences and model use	Approved tools and usage	25%
Platform and data	Gateway, logging, sandbox, evaluation tooling	20%
Independent validation	Validator time for medium and high tiers	10%
Controls and monitoring	Hooks, CI (continuous integration) checks, monitoring, kill-switch tests	10%
Reviewer capacity	Protected human review time in delivery teams	15%
Enablement	Program team, labs, champions' protected time	10%
Asset ownership	Owners of shared libraries, prompts and evaluation sets	10%

Workforce question	The sponsor's answer must cover
What happens to roles?	Which tasks change, which roles are redesigned, and how that decision is made; never a promise the organization cannot keep
What happens to time saved?	Where it goes: review, quality, backlog, learning; state it before the program starts
Who gets learning time?	Protected hours per person per month (for example, 4 hours, illustrative), funded, not taken from evenings
How is performance judged?	Outcomes and quality, not AI output volume; no productivity quota tied to AI use
Who is consulted?	HR (human resources) and, where they exist, employee representatives, before roles change

Capacity rule. If a funding request adds delegated work, it must add reviewer capacity too. Delegated work with no reviewer is approval unread.

13. Anti-patterns and stop conditions

Anti-pattern	Why it fails	Instead
Seats as success	Licences show access, not depth or value	Ask for the balanced scorecard
Pilots with no path	Pilots age without a production or stop decision	Every pilot has an owner, a gate plan and an expiry
Risk sign-off at the end	Late risk review becomes the blocker	Fund the second line to join intake
Funding pilots, not owners	Shared assets decay; teams rebuild them	Fund asset owners with the asset
One omnibus risk approval	Privacy, compliance, model risk and records answer different questions	Each authority records its own decision

Stop condition	What the sponsor does
Evaluation fails on a risk slice	Confirms the step-down; does not grant an exception to meet a date
Severe incident or kill-switch use	Freezes expansion of that use case until the incident review closes
Provider or model change	Requires re-evaluation before Stage 3 or 4 use resumes
Material use-case change	Sends it back to intake
Reviewer capacity gone	Pauses delegated work rather than accepting approval unread

14. Action kit and 30/60/90

Decision card. Copy it for every funding or pause decision.

## Sponsor decision card
Decision: ____________________ (one sentence)
Use case and tier: ____________ Stage today / target: ___ / ___
Owner (named): ______________ Independent challenger: ______________
Benefit, with baseline and denominator: ______________________________
Full cost, incl. review + validation + asset ownership: _______________
Residual risk after controls, and who carries it: ____________________
Reviewer capacity confirmed by: _____________________
Stop conditions: failed eval slice / incident / provider change / owner lost
Expiry or review date: ___________  Recorded in: _____________________

Questions to ask your enablement lead

Which use cases have no named owner, no reviewer capacity, or no path out of pilot?
Where did a team step down this quarter, and what did we learn?
What does the scorecard look like without the self-reported numbers?

Days 1 to 30	Days 31 to 60	Days 61 to 90
Goal	Know the current state	Fund the enabling system	Decide on evidence
Actions	Read the AI inventory; meet the second line and internal audit; ask for the gaps in Stage 0	Approve the risk appetite statement for AI; fund foundations, reviewer capacity and one pilot	Review the first scorecard; make one continue, step-down or stop decision and record it
Evidence	List of foundation gaps with owners	Funded plan; named owners; leader decision brief approved	Recorded decision with expiry; management response to any audit observation
Watch for	Promising benefits before a baseline exists	Funding licences without validators	Treating a stopped pilot as a failure