Matriz de Roles y Responsabilidades de Gobernanza de IA
raci-matrix governance
Disclaimer: This is guidance only, not legal advice. Consult qualified legal counsel before adopting this matrix. | Este documento es solo orientativo, no constituye asesoramiento jurídico.
AI Governance Roles & Responsibilities Matrix
Document Reference: [ORG-RACI-AI-001] Version: 1.0 Effective Date: [DATE] Review Date: [DATE + 12 months] Owner: AI Officer Approved by: CEO / AI Governance Committee Classification: Internal
1. How to Read This Document
1.1 RACI Key
| Letter | Role | Definition |
|---|---|---|
| R | Responsible | Does the work; carries out the activity |
| A | Accountable | Owns the outcome; the “buck stops here”; must approve or sign off; there should be only ONE accountable per activity |
| C | Consulted | Provides input before or during the activity; two-way communication |
| I | Informed | Kept updated on progress or outcome; one-way communication |
| — | Not involved | No role in this activity |
1.2 Roles Covered in This Matrix
| Role Abbreviation | Full Role Title | Reports To |
|---|---|---|
| CEO | Chief Executive Officer | Board of Directors |
| CTO | Chief Technology Officer | CEO |
| DPO | Data Protection Officer | CEO / Legal (must be independent) |
| CISO | Chief Information Security Officer | CTO or CEO |
| AIO | AI Officer | CTO or CEO |
| LGL | Legal / General Counsel | CEO |
| HR | HR Director | CEO |
| DHD | Department Heads (all departments) | CEO |
| USR | Individual Users / All Employees | Department Heads |
*[Note: Customise role titles to reflect your organisation’s actual structure. In smaller organisations, roles may be combined — document any dual-hatting clearly and assess whether it creates conflicts of interest.]
2. Role Descriptions
2.1 CEO (Chief Executive Officer)
The CEO has ultimate accountability to the board for the Organisation’s AI governance posture. The CEO:
- Chairs or delegates chair of the AI Governance Committee
- Approves the AI risk appetite statement
- Is accountable for regulatory compliance with the EU AI Act at organisational level
- Ensures adequate resources are allocated to AI governance
- Represents the Organisation in material regulatory engagements
Key AI obligations:
- Approve and sign the AI governance framework and major policies
- Receive quarterly AI governance briefings
- Escalation point for material AI incidents
2.2 CTO (Chief Technology Officer)
The CTO is responsible for the technical strategy, infrastructure, and technical governance of AI systems. The CTO:
- Oversees the technical implementation of AI systems
- Ensures AI systems are built or procured to meet security, robustness, and accuracy requirements
- Line-manages the AI Officer (in most structures)
- Reports on AI technical risks to the AI Governance Committee
2.3 DPO (Data Protection Officer)
The DPO is a legally required role under GDPR (Art. 37) for many organisations, and plays a critical role in AI governance given the data-intensive nature of AI systems. The DPO:
- Monitors compliance with GDPR for all AI processing activities
- Advises on DPIAs for AI systems
- Acts as contact point with AEPD (Spain)
- Must be consulted before deployment of any AI system processing personal data
- Must operate with independence — cannot be instructed on how to carry out their tasks
Independence note: The DPO cannot simultaneously be Responsible or Accountable for activities they are supposed to monitor. Where the DPO appears as C (Consulted), their opinion must be documented.
2.4 CISO (Chief Information Security Officer)
The CISO is responsible for information security across the Organisation, including the security of AI systems. The CISO:
- Assesses cybersecurity risks of AI systems before and during deployment
- Sets and enforces security requirements for AI procurement and development
- Manages AI-related security incidents
- Maintains the security monitoring programme for AI systems
- Advises on access controls, encryption, and threat modelling for AI
2.5 AI Officer (AIO)
The AI Officer is the day-to-day operational lead for AI governance. This role may be a dedicated position or a responsibility assigned to an existing role (document clearly). The AI Officer:
- Maintains the AI System Inventory and Risk Register
- Manages the AI tool approval process
- Coordinates risk assessments and DPIAs
- Monitors AI system performance and incidents
- Reports to the AI Governance Committee
- Manages the AI Champions network
- Liaises with AESIA (Spain’s AI supervisory authority) where required
2.6 Legal / General Counsel (LGL)
Legal provides specialist advice on regulatory compliance, contract management, and liability. In AI governance:
- Reviews AI system contracts and Data Processing Agreements
- Advises on EU AI Act classification and compliance obligations
- Reviews high-stakes AI-generated content (regulatory submissions, litigation, public statements)
- Manages regulatory inquiries and enforcement actions
- Advises on intellectual property issues related to AI
2.7 HR Director (HR)
HR manages the people dimension of AI governance:
- Ensures AI policy is communicated and understood by all staff
- Manages AI training programmes
- Handles disciplinary matters arising from AI policy breaches
- Advises on employment law implications of AI use (especially in HR/people decisions)
- Manages change management for AI adoption
2.8 Department Heads (DHD)
Department Heads are accountable for AI governance within their teams:
- Ensure team members complete mandatory AI training
- Enforce AI policy compliance within their department
- Support the AI Champion in their department
- Approve AI use cases originating from their department
- Escalate incidents and shadow AI instances to the AI Officer
- Review Tier 2 AI-generated content before use
2.9 Individual Users (USR)
All employees who use AI tools are responsible for:
- Complying with the Acceptable AI Use Policy
- Completing mandatory AI literacy training
- Only using approved AI tools for work purposes
- Submitting requests for new AI tools through proper channels
- Reporting incidents, shadow AI, or concerns promptly
- Reviewing and verifying AI-generated content before use
- Protecting confidential and personal data in AI interactions
3. Master RACI Matrix
3.1 AI Strategy and Governance
| Activity | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Approve AI strategy and roadmap | A | R | C | C | R | C | I | I | I |
| Set and approve AI risk appetite | A | C | C | C | R | C | I | I | — |
| Approve AI Governance Framework | A | C | C | C | R | C | C | I | I |
| Chair AI Governance Committee | A | C | C | C | R | C | C | I | — |
| Allocate budget for AI governance | A | C | I | I | R | I | I | I | — |
| Report AI governance to Board | A | C | C | C | R | C | I | I | — |
| Appoint AI Officer | A | R | I | I | — | I | C | I | — |
| Maintain AI governance documentation | I | I | C | I | A/R | C | I | I | — |
| Annual Framework review | A | C | C | C | R | C | C | I | I |
3.2 AI System Procurement and Approval
| Activity | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Submit new AI tool request | I | I | I | I | I | I | I | A | R |
| Initial risk screening of requested tool | I | I | I | I | A/R | I | I | C | I |
| Security assessment of AI tool/vendor | I | I | I | A/R | C | I | I | C | I |
| DPIA for AI processing (personal data) | I | I | A/R | C | C | C | I | C | I |
| Legal review — AI Act classification | I | I | C | I | C | A/R | I | I | — |
| Legal review — vendor contract/DPA | I | I | C | I | C | A/R | I | I | — |
| Final approval — Low/Minimal risk tools | I | I | I | I | A/R | I | I | I | I |
| Final approval — High risk systems | A | C | C | C | R | C | I | I | — |
| Approve tool for enterprise rollout | I | A | C | C | R | C | I | C | I |
| Communicate approved tool to users | I | I | I | I | A/R | I | R | R | I |
| Reject tool request (with reasons) | I | I | I | I | A/R | C | I | I | I |
3.3 Risk Assessment
| Activity | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Maintain AI Risk Register | I | I | C | C | A/R | I | I | I | I |
| Conduct risk assessment for new AI system | I | I | C | C | A/R | C | I | C | I |
| Conduct DPIA (GDPR Art. 35) | I | I | A/R | C | C | C | I | C | I |
| Prior consultation with AEPD (if required) | I | I | A/R | I | C | C | I | I | — |
| Conduct bias and fairness assessment | I | C | C | I | A/R | I | C | C | I |
| Conduct security/penetration testing | I | C | I | A/R | C | I | I | I | I |
| Review risk register — quarterly | I | I | C | C | A/R | C | I | I | I |
| Escalate high risks to AI Governance Committee | I | I | C | C | A/R | C | I | I | I |
| Assess EU AI Act compliance for high-risk systems | A | C | C | C | R | A/R | I | I | — |
3.4 Training and AI Literacy
| Activity | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Define AI training requirements | I | I | C | I | R | C | A | C | I |
| Develop AI literacy training content | I | I | C | C | R | C | A | C | I |
| Deliver mandatory AI awareness training | I | I | I | I | C | I | A/R | R | I |
| Deliver advanced AI governance training (managers) | I | I | C | C | R | C | A | I | I |
| Complete mandatory AI literacy training | I | I | I | I | I | I | I | R | A/R |
| Track and report training completion | I | I | I | I | C | I | A/R | C | I |
| Enforce training completion (escalate non-completion) | I | I | I | I | C | I | A | R | I |
| Update training when policy/law changes | I | I | C | C | R | C | A | I | I |
| AI Champion briefings and network meetings | I | I | C | I | A/R | I | C | R | I |
3.5 Monitoring and Performance
| Activity | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Maintain AI System Inventory | I | I | C | I | A/R | I | I | C | I |
| Monitor AI system performance (accuracy, uptime) | I | C | I | C | A/R | I | I | R | I |
| Monitor AI systems for bias/discriminatory outputs | I | I | C | I | A/R | I | C | R | I |
| Shadow AI detection and monitoring (technical) | I | C | I | A/R | C | I | I | I | I |
| Shadow AI detection (department surveys) | I | I | I | I | R | I | R | A | R |
| Monitor policy compliance (all employees) | I | I | I | I | R | I | A | R | I |
| Prepare monthly AI operational dashboard | I | I | I | I | A/R | I | I | I | I |
| Prepare quarterly AI governance committee report | I | I | C | C | A/R | C | I | I | I |
| Prepare quarterly board AI governance report | A | C | C | C | R | C | I | I | — |
| Annual AI governance effectiveness review | A | C | C | C | R | C | C | C | I |
3.6 Incident Response
| Activity | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Report AI incident / suspected issue | I | I | I | I | I | I | I | I | A/R |
| Receive and log incident report | I | I | I | I | A/R | I | I | I | I |
| Classify incident severity | I | I | C | C | A/R | I | I | I | I |
| Contain incident (technical isolation) | I | R | I | A/R | C | I | I | I | I |
| Assess personal data breach (GDPR) | I | I | A/R | C | C | C | I | I | I |
| Notify AEPD (if personal data breach >72hr threshold) | A | I | A/R | I | C | C | I | I | — |
| Notify affected data subjects (if required) | I | I | A/R | I | C | C | I | I | — |
| Conduct incident investigation | I | C | C | C | A/R | C | C | C | I |
| Implement technical remediation | I | A | C | R | C | I | I | I | I |
| Handle disciplinary aspects of incident | I | I | I | I | C | I | A/R | R | I |
| Produce Post-Incident Report | I | I | C | C | A/R | C | C | C | I |
| Present findings to AI Governance Committee | I | I | C | C | A/R | C | C | C | — |
| Escalate critical incidents to CEO/Board | A | C | C | C | R | C | I | I | — |
| Update risk register following incident | I | I | C | C | A/R | I | I | I | I |
3.7 Vendor Management
| Activity | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Identify potential AI vendors | I | R | I | I | R | I | I | A/R | C |
| Conduct AI vendor due diligence (technical) | I | C | I | A/R | C | I | I | C | I |
| Conduct AI vendor due diligence (data protection) | I | I | A/R | C | C | C | I | C | I |
| Negotiate and sign vendor contract | I | C | C | C | C | A/R | I | C | I |
| Negotiate and sign Data Processing Agreement | I | I | A/R | I | C | R | I | I | — |
| Manage ongoing vendor relationship | I | C | I | I | A/R | C | I | C | I |
| Annual vendor performance review | I | C | C | C | A/R | C | I | C | I |
| Manage vendor security incidents | I | C | I | A/R | C | C | I | C | I |
| Offboard AI vendor (contract end / switch) | I | C | C | C | R | A | I | C | I |
| Manage vendor access termination | I | R | C | A | C | C | I | C | I |
3.8 Policy Review and Updates
| Activity | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Trigger policy review (scheduled or event-based) | I | I | C | C | A/R | C | C | I | I |
| Draft policy updates | I | I | C | C | R | C | C | I | I |
| Review policy updates (legal/compliance) | I | I | C | C | I | A | C | I | I |
| Review policy updates (data protection) | I | I | A | C | R | C | C | I | I |
| Stakeholder consultation on major policy changes | I | C | C | C | A/R | C | R | C | C |
| Approve updated policy | A | C | C | C | R | C | C | I | I |
| Communicate policy updates to staff | I | I | I | I | R | I | A/R | R | I |
| Acknowledge updated policy (all staff) | I | I | I | I | I | I | A | R | R |
| Archive superseded policy versions | I | I | I | I | A/R | I | I | I | I |
3.9 Automated Decision-Making and Human Oversight
(Applies to AI systems covered by GDPR Art. 22 or EU AI Act human oversight requirements)
| Activity | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Identify AI systems with automated decision-making | I | C | C | I | A/R | C | I | C | I |
| Define human oversight requirements per system | I | C | C | I | R | C | C | A | I |
| Implement human override / review mechanism (technical) | I | A/R | C | C | C | I | I | C | I |
| Conduct human review of AI decisions (ongoing) | I | I | I | I | C | I | C | A | R |
| Handle data subject requests for human review (Art. 22) | I | I | A/R | I | C | C | C | R | I |
| Audit human oversight compliance | I | I | C | I | A/R | C | C | C | I |
| Report oversight failures to AI Governance Committee | I | I | C | C | A/R | C | I | I | I |
4. Role-Specific Summary Cards
These one-page summaries can be distributed to individuals in each role.
CEO Summary Card
Your key AI governance responsibilities:
- Approve the AI risk appetite and governance framework
- Receive and act on quarterly AI governance reports
- Ensure adequate resources for AI compliance
- Final escalation point for critical AI incidents
- Board accountability for EU AI Act compliance
You must be informed of:
- All P1 (Critical) AI incidents within 2 hours
- Material regulatory inquiries about AI
- Any decision to proceed against DPO advice
CTO Summary Card
Your key AI governance responsibilities:
- Technical strategy and oversight of all AI systems
- Ensure AI systems meet security, accuracy, and robustness standards
- Oversee AI Officer (if direct report)
- Technical incident response and remediation
You must be informed of:
- All P1 and P2 AI incidents
- Technical vulnerabilities in AI systems
- Significant AI vendor issues
DPO Summary Card
Your key AI governance responsibilities:
- Advise on all AI processing involving personal data
- Review and sign off all DPIAs for AI systems
- Contact point for AEPD; manage prior consultations
- Monitor GDPR compliance across all AI systems
- Must be consulted before deployment — your opinion must be documented
You are accountable for:
- Quality and completeness of DPIAs
- GDPR breach notifications to AEPD
- Independence of data protection function
You cannot be Responsible or Accountable for activities you are monitoring.
CISO Summary Card
Your key AI governance responsibilities:
- Security assessments for all AI tools and vendors
- Maintain security controls for AI systems (encryption, access, monitoring)
- Shadow AI detection (technical)
- AI-related security incident response
You must be informed of:
- All AI-related security incidents
- New AI system deployments that are security-relevant
- Vendor security incidents
AI Officer Summary Card
Your key AI governance responsibilities:
- Day-to-day AI governance operations
- AI System Inventory and Risk Register
- AI tool approval process
- Coordinate risk assessments and DPIAs
- AI Governance Committee agenda and reporting
- AI Champions network
- Monitor performance, incidents, and shadow AI
- Liaise with AESIA
You are the primary R across most governance activities. When in doubt, it lands with you to co-ordinate.
Legal Summary Card
Your key AI governance responsibilities:
- EU AI Act classification and compliance advice
- Vendor contract review and DPA negotiation
- High-stakes content review
- Regulatory inquiry and enforcement management
- IP advice on AI-generated content
You must be informed of:
- All potential regulatory breaches
- Material AI incidents with legal exposure
- Significant vendor contract issues
HR Director Summary Card
Your key AI governance responsibilities:
- AI policy communication and training programme
- Training completion tracking and enforcement
- Disciplinary matters arising from AI policy breaches
- Employment law advice for AI in HR decisions
- Change management for AI adoption
You must be informed of:
- Policy breaches by employees
- AI training completion rates
- AI use in people decisions (recruitment, performance, etc.)
Department Head Summary Card
Your key AI governance responsibilities:
- Ensure your team completes mandatory AI training
- Enforce AI policy in your department
- Support your AI Champion
- Escalate incidents and shadow AI to AI Officer
- Review Tier 2 AI-generated content before use
- Approve AI use case requests from your team before submitting to AI Officer
Key message: You are the first line of AI governance in your department. Your team looks to you to model responsible AI use.
Individual User Summary Card
Your key AI governance responsibilities:
- Only use AI tools on the Approved Tools List
- Complete mandatory AI literacy training on time
- Submit a request before using any new AI tool
- Never enter personal data, client data, or secrets into any AI tool
- Always verify AI-generated content before using it
- Report concerns, incidents, or shadow AI immediately
Quick checklist before using any AI tool:
- Is this tool on the Approved List?
- Am I about to enter any personal data, client info, or confidential material?
- Will I verify the output before using it?
- If I am unsure about any of the above — have I asked my AI Champion?
5. Known Conflicts and Resolution
| Potential Conflict | Resolution |
|---|---|
| DPO independence: DPO cannot be accountable for activities they must audit | DPO role is C (Consulted) on policy approval; DPO is never A for activities involving AI system operation |
| AI Officer and CISO both involved in security assessments | CISO is A/R for security assessment; AI Officer is C; AI Officer is A/R for risk register entry |
| HR and Legal both involved in disciplinary matters | HR is A/R for disciplinary procedure; Legal is C for legal advice; HR owns the process |
| DPO and Legal both involved in regulatory matters | Legal is A/R for general regulatory matters; DPO is A/R for GDPR-specific regulatory engagement with AEPD |
| Multiple C roles potentially create decision paralysis | Consultation must be time-limited: maximum [5] business days for standard decisions; [2] business days for urgent matters |
6. RACI Matrix Change Log
| Version | Date | Changed by | Summary of changes | Approved by |
|---|---|---|---|---|
| 1.0 | [DATE] | [Name] | Initial version | [Name, Title] |
Annex A — Org Chart Template for AI Governance
Adapt and complete with actual names and reporting lines.
BOARD OF DIRECTORS
│
CEO ──────────────── DPO (independent)
│
┌────┴────┐
CTO LGL
│
CISO
│
AIO (AI Officer)
│
┌─────┬─────┬────┐
DHD1 DHD2 DHD3 HR
│ │ │
AC1 AC2 AC3 (AI Champions)
│ │ │
USR USR USR (All employees)AC = AI Champion (embedded in each department)
Annex B — Glossary of Roles
| Abbreviation | Full Title | Alternative Titles Sometimes Used |
|---|---|---|
| CEO | Chief Executive Officer | Managing Director, Director General |
| CTO | Chief Technology Officer | Head of Technology, IT Director |
| DPO | Data Protection Officer | Data Privacy Officer (note: GDPR uses “Protection”) |
| CISO | Chief Information Security Officer | Head of Information Security, Security Director |
| AIO | AI Officer | AI Governance Lead, Chief AI Officer, AI Compliance Manager |
| LGL | Legal / General Counsel | Company Secretary, Head of Legal, Legal Director |
| HR | Human Resources Director | People Director, Head of HR, People & Culture Lead |
| DHD | Department Head | Manager, Director, Head of [function] |
| USR | Individual User | Employee, Staff Member, Team Member |
In smaller organisations, one person may hold multiple roles. Document any dual-hatting and assess for conflicts of interest. At minimum, the DPO must remain independent.
Template provided by J4SGON | j4sgon.com This is guidance only, not legal advice. Version 1.0 | For EU AI Act compliance use | Last updated: 2026-04-05
Versión Española
Matriz de Roles y Responsabilidades de Gobernanza de IA
Referencia: [ORG-RACI-AI-001] Versión: 1.0 Fecha de vigencia: [FECHA] Fecha de revisión: [FECHA + 12 meses] Propietario: AI Officer Aprobado por: CEO / Comité de Gobernanza de IA Clasificación: Interno
1. Cómo Leer Este Documento
1.1 Clave RACI
| Letra | Rol | Definición |
|---|---|---|
| R | Responsable | Realiza el trabajo; ejecuta la actividad |
| A | Accountable (Aprobador) | Es dueño del resultado; tiene la última palabra; debe aprobar o dar el visto bueno; solo UNO por actividad |
| C | Consultado | Aporta información antes o durante la actividad; comunicación bidireccional |
| I | Informado | Se le mantiene actualizado sobre el progreso o resultado; comunicación unidireccional |
| — | No involucrado | Sin rol en esta actividad |
1.2 Roles Cubiertos en Esta Matriz
| Abreviatura | Título completo | Reporta a |
|---|---|---|
| CEO | Director General | Consejo de Administración |
| CTO | Director de Tecnología | CEO |
| DPO | Delegado de Protección de Datos | CEO / Legal (debe ser independiente) |
| CISO | Director de Seguridad de la Información | CTO o CEO |
| AIO | AI Officer | CTO o CEO |
| LGL | Legal / Asesoría Jurídica | CEO |
| HR | Director de RRHH | CEO |
| DHD | Responsables de Departamento (todos) | CEO |
| USR | Usuarios Individuales / Todos los Empleados | Responsables de Departamento |
*[Nota: Personalice los títulos de rol para reflejar la estructura real de su organización. En organizaciones más pequeñas, los roles pueden combinarse — documente cualquier duplicación y evalúe si genera conflictos de interés.]
2. Descripciones de Roles
2.1 CEO (Director General)
Responsabilidad última ante el consejo por la postura de gobernanza de IA de la organización.
- Preside o delega la presidencia del Comité de Gobernanza de IA
- Aprueba la declaración de apetito de riesgo de IA
- Es accountable del cumplimiento regulatorio con el EU AI Act a nivel organizativo
- Asegura la asignación de recursos adecuados para la gobernanza de IA
2.2 CTO (Director de Tecnología)
Responsable de la estrategia técnica, infraestructura y gobernanza técnica de los sistemas de IA.
- Supervisa la implementación técnica de los sistemas de IA
- Asegura que los sistemas cumplan requisitos de seguridad, robustez y precisión
- Generalmente supervisa al AI Officer
2.3 DPO (Delegado de Protección de Datos)
Rol legalmente requerido bajo el GDPR (Art. 37) para muchas organizaciones, crítico en gobernanza de IA.
- Monitorea el cumplimiento del GDPR para todas las actividades de procesamiento de IA
- Asesora sobre DPIAs para sistemas de IA
- Punto de contacto con la AEPD (España)
- Debe ser consultado antes del despliegue de cualquier sistema de IA que procese datos personales
- Nota de independencia: El DPO no puede ser simultáneamente Responsable o Accountable de actividades que debe monitorear
2.4 CISO (Director de Seguridad de la Información)
Responsable de la seguridad de la información en toda la organización, incluidos los sistemas de IA.
- Evalúa riesgos de ciberseguridad de los sistemas de IA antes y durante el despliegue
- Establece y aplica requisitos de seguridad para la adquisición y desarrollo de IA
- Gestiona incidentes de seguridad relacionados con IA
2.5 AI Officer (AIO)
Líder operativo del día a día para la gobernanza de IA. Puede ser un puesto dedicado o una responsabilidad asignada a un rol existente (documentar claramente).
- Mantiene el Inventario de Sistemas de IA y el Registro de Riesgos
- Gestiona el proceso de aprobación de herramientas de IA
- Coordina evaluaciones de riesgo y DPIAs
- Reporta al Comité de Gobernanza de IA
- Gestiona la red de AI Champions
- Enlace con AESIA (autoridad supervisora de IA de España)
2.6 Legal / Asesoría Jurídica (LGL)
Asesoramiento especializado en cumplimiento regulatorio, gestión de contratos y responsabilidad.
- Revisa contratos de sistemas de IA y Acuerdos de Procesamiento de Datos
- Asesora sobre clasificación y obligaciones de cumplimiento del EU AI Act
- Gestiona consultas regulatorias y acciones de ejecución
2.7 Director de RRHH (HR)
Gestiona la dimensión humana de la gobernanza de IA.
- Asegura que la política de IA se comunique y comprenda
- Gestiona programas de formación en IA
- Maneja asuntos disciplinarios derivados de incumplimientos de la política de IA
- Gestiona el cambio organizativo para la adopción de IA
2.8 Responsables de Departamento (DHD)
Accountable de la gobernanza de IA dentro de sus equipos.
- Aseguran que los miembros del equipo completen la formación obligatoria en IA
- Aplican el cumplimiento de la política de IA en su departamento
- Escalan incidentes e instancias de Shadow AI al AI Officer
- Revisan contenido generado por IA de Nivel 2 antes de su uso
2.9 Usuarios Individuales (USR)
Todos los empleados que usan herramientas de IA son responsables de:
- Cumplir la Política de Uso Aceptable de IA
- Completar la formación obligatoria en alfabetización de IA
- Usar solo herramientas de IA aprobadas para fines laborales
- Reportar incidentes, Shadow AI o preocupaciones de forma inmediata
- Revisar y verificar el contenido generado por IA antes de usarlo
- Proteger datos confidenciales y personales en las interacciones con IA
3. Matriz RACI Principal
3.1 Estrategia y Gobernanza de IA
| Actividad | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Aprobar estrategia y hoja de ruta de IA | A | R | C | C | R | C | I | I | I |
| Establecer y aprobar apetito de riesgo de IA | A | C | C | C | R | C | I | I | — |
| Aprobar Marco de Gobernanza de IA | A | C | C | C | R | C | C | I | I |
| Presidir Comité de Gobernanza de IA | A | C | C | C | R | C | C | I | — |
| Asignar presupuesto para gobernanza de IA | A | C | I | I | R | I | I | I | — |
| Reportar gobernanza de IA al Consejo | A | C | C | C | R | C | I | I | — |
| Nombrar AI Officer | A | R | I | I | — | I | C | I | — |
| Mantener documentación de gobernanza de IA | I | I | C | I | A/R | C | I | I | — |
| Revisión anual del Marco | A | C | C | C | R | C | C | I | I |
3.2 Adquisición y Aprobación de Sistemas de IA
| Actividad | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Enviar solicitud de nueva herramienta de IA | I | I | I | I | I | I | I | A | R |
| Screening inicial de riesgo de herramienta solicitada | I | I | I | I | A/R | I | I | C | I |
| Evaluación de seguridad de herramienta/proveedor de IA | I | I | I | A/R | C | I | I | C | I |
| DPIA para procesamiento de IA (datos personales) | I | I | A/R | C | C | C | I | C | I |
| Revisión legal — clasificación EU AI Act | I | I | C | I | C | A/R | I | I | — |
| Revisión legal — contrato de proveedor/DPA | I | I | C | I | C | A/R | I | I | — |
| Aprobación final — herramientas de riesgo Bajo/Mínimo | I | I | I | I | A/R | I | I | I | I |
| Aprobación final — sistemas de alto riesgo | A | C | C | C | R | C | I | I | — |
| Aprobar herramienta para despliegue empresarial | I | A | C | C | R | C | I | C | I |
| Comunicar herramienta aprobada a usuarios | I | I | I | I | A/R | I | R | R | I |
| Rechazar solicitud de herramienta (con motivos) | I | I | I | I | A/R | C | I | I | I |
3.3 Evaluación de Riesgos
| Actividad | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Mantener Registro de Riesgos de IA | I | I | C | C | A/R | I | I | I | I |
| Realizar evaluación de riesgos para nuevo sistema de IA | I | I | C | C | A/R | C | I | C | I |
| Realizar DPIA (GDPR Art. 35) | I | I | A/R | C | C | C | I | C | I |
| Consulta previa con AEPD (si necesario) | I | I | A/R | I | C | C | I | I | — |
| Evaluación de sesgo y equidad | I | C | C | I | A/R | I | C | C | I |
| Pruebas de seguridad/penetración | I | C | I | A/R | C | I | I | I | I |
| Revisión trimestral del registro de riesgos | I | I | C | C | A/R | C | I | I | I |
| Escalar riesgos altos al Comité de Gobernanza de IA | I | I | C | C | A/R | C | I | I | I |
| Evaluar cumplimiento EU AI Act para sistemas de alto riesgo | A | C | C | C | R | A/R | I | I | — |
3.4 Formación y Alfabetización en IA
| Actividad | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Definir requisitos de formación en IA | I | I | C | I | R | C | A | C | I |
| Desarrollar contenido de formación en alfabetización de IA | I | I | C | C | R | C | A | C | I |
| Impartir formación obligatoria en concienciación de IA | I | I | I | I | C | I | A/R | R | I |
| Impartir formación avanzada en gobernanza de IA (managers) | I | I | C | C | R | C | A | I | I |
| Completar formación obligatoria en alfabetización de IA | I | I | I | I | I | I | I | R | A/R |
| Seguimiento y reporte de finalización de formación | I | I | I | I | C | I | A/R | C | I |
| Hacer cumplir finalización de formación (escalar incumplimiento) | I | I | I | I | C | I | A | R | I |
| Actualizar formación cuando cambie la política/legislación | I | I | C | C | R | C | A | I | I |
| Briefings y reuniones de la red de AI Champions | I | I | C | I | A/R | I | C | R | I |
3.5 Monitoreo y Rendimiento
| Actividad | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Mantener Inventario de Sistemas de IA | I | I | C | I | A/R | I | I | C | I |
| Monitorear rendimiento de sistemas de IA (precisión, disponibilidad) | I | C | I | C | A/R | I | I | R | I |
| Monitorear sistemas de IA por sesgo/salidas discriminatorias | I | I | C | I | A/R | I | C | R | I |
| Detección y monitoreo de Shadow AI (técnico) | I | C | I | A/R | C | I | I | I | I |
| Detección de Shadow AI (encuestas departamentales) | I | I | I | I | R | I | R | A | R |
| Monitorear cumplimiento de política (todos los empleados) | I | I | I | I | R | I | A | R | I |
| Preparar dashboard operativo mensual de IA | I | I | I | I | A/R | I | I | I | I |
| Preparar informe trimestral del Comité de Gobernanza de IA | I | I | C | C | A/R | C | I | I | I |
| Preparar informe trimestral de gobernanza de IA para el Consejo | A | C | C | C | R | C | I | I | — |
| Revisión anual de efectividad de gobernanza de IA | A | C | C | C | R | C | C | C | I |
3.6 Respuesta a Incidentes
| Actividad | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Reportar incidente de IA / problema sospechado | I | I | I | I | I | I | I | I | A/R |
| Recibir y registrar informe de incidente | I | I | I | I | A/R | I | I | I | I |
| Clasificar severidad del incidente | I | I | C | C | A/R | I | I | I | I |
| Contener incidente (aislamiento técnico) | I | R | I | A/R | C | I | I | I | I |
| Evaluar brecha de datos personales (GDPR) | I | I | A/R | C | C | C | I | I | I |
| Notificar a la AEPD (si brecha >umbral de 72h) | A | I | A/R | I | C | C | I | I | — |
| Notificar a los interesados afectados (si necesario) | I | I | A/R | I | C | C | I | I | — |
| Realizar investigación del incidente | I | C | C | C | A/R | C | C | C | I |
| Implementar remediación técnica | I | A | C | R | C | I | I | I | I |
| Manejar aspectos disciplinarios del incidente | I | I | I | I | C | I | A/R | R | I |
| Elaborar Informe Post-Incidente | I | I | C | C | A/R | C | C | C | I |
| Presentar hallazgos al Comité de Gobernanza de IA | I | I | C | C | A/R | C | C | C | — |
| Escalar incidentes críticos al CEO/Consejo | A | C | C | C | R | C | I | I | — |
| Actualizar registro de riesgos tras el incidente | I | I | C | C | A/R | I | I | I | I |
3.7 Gestión de Proveedores
| Actividad | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Identificar proveedores de IA potenciales | I | R | I | I | R | I | I | A/R | C |
| Due diligence técnica del proveedor | I | C | I | A/R | C | I | I | C | I |
| Due diligence de protección de datos del proveedor | I | I | A/R | C | C | C | I | C | I |
| Negociar y firmar contrato de proveedor | I | C | C | C | C | A/R | I | C | I |
| Negociar y firmar Acuerdo de Procesamiento de Datos | I | I | A/R | I | C | R | I | I | — |
| Gestionar relación continua con proveedor | I | C | I | I | A/R | C | I | C | I |
| Revisión anual de rendimiento del proveedor | I | C | C | C | A/R | C | I | C | I |
| Gestionar incidentes de seguridad del proveedor | I | C | I | A/R | C | C | I | C | I |
| Desvinculación del proveedor de IA (fin de contrato / cambio) | I | C | C | C | R | A | I | C | I |
| Gestionar terminación de acceso del proveedor | I | R | C | A | C | C | I | C | I |
3.8 Revisión y Actualización de Políticas
| Actividad | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Activar revisión de política (programada o por evento) | I | I | C | C | A/R | C | C | I | I |
| Redactar actualizaciones de política | I | I | C | C | R | C | C | I | I |
| Revisar actualizaciones (legal/cumplimiento) | I | I | C | C | I | A | C | I | I |
| Revisar actualizaciones (protección de datos) | I | I | A | C | R | C | C | I | I |
| Consulta a stakeholders sobre cambios importantes | I | C | C | C | A/R | C | R | C | C |
| Aprobar política actualizada | A | C | C | C | R | C | C | I | I |
| Comunicar actualizaciones de política al personal | I | I | I | I | R | I | A/R | R | I |
| Acusar recibo de la política actualizada (todo el personal) | I | I | I | I | I | I | A | R | R |
| Archivar versiones de política sustituidas | I | I | I | I | A/R | I | I | I | I |
3.9 Toma de Decisiones Automatizada y Supervisión Humana
(Aplica a sistemas de IA cubiertos por GDPR Art. 22 o requisitos de supervisión humana del EU AI Act)
| Actividad | CEO | CTO | DPO | CISO | AIO | LGL | HR | DHD | USR |
|---|---|---|---|---|---|---|---|---|---|
| Identificar sistemas de IA con toma de decisiones automatizada | I | C | C | I | A/R | C | I | C | I |
| Definir requisitos de supervisión humana por sistema | I | C | C | I | R | C | C | A | I |
| Implementar mecanismo de anulación/revisión humana (técnico) | I | A/R | C | C | C | I | I | C | I |
| Realizar revisión humana de decisiones de IA (continuo) | I | I | I | I | C | I | C | A | R |
| Gestionar solicitudes de interesados para revisión humana (Art. 22) | I | I | A/R | I | C | C | C | R | I |
| Auditar cumplimiento de supervisión humana | I | I | C | I | A/R | C | C | C | I |
| Reportar fallos de supervisión al Comité de Gobernanza de IA | I | I | C | C | A/R | C | I | I | I |
4. Tarjetas Resumen por Rol
Tarjeta del CEO
Responsabilidades clave de gobernanza de IA:
- Aprobar el apetito de riesgo y el marco de gobernanza de IA
- Recibir y actuar sobre informes trimestrales de gobernanza de IA
- Asegurar recursos adecuados para el cumplimiento de IA
- Punto final de escalado para incidentes críticos de IA
- Accountability ante el Consejo por cumplimiento del EU AI Act
Tarjeta del CTO
Responsabilidades clave:
- Estrategia técnica y supervisión de todos los sistemas de IA
- Asegurar que los sistemas cumplan estándares de seguridad, precisión y robustez
- Supervisar al AI Officer (si es reporte directo)
- Respuesta técnica a incidentes y remediación
Tarjeta del DPO
Responsabilidades clave:
- Asesorar sobre todo procesamiento de IA que involucre datos personales
- Revisar y aprobar todas las DPIAs para sistemas de IA
- Punto de contacto con la AEPD; gestionar consultas previas
- Monitorear cumplimiento GDPR en todos los sistemas de IA
- Debe ser consultado antes del despliegue — su opinión debe documentarse
No puede ser Responsable o Accountable de actividades que está monitoreando.
Tarjeta del CISO
Responsabilidades clave:
- Evaluaciones de seguridad para todas las herramientas y proveedores de IA
- Mantener controles de seguridad (cifrado, acceso, monitoreo)
- Detección técnica de Shadow AI
- Respuesta a incidentes de seguridad relacionados con IA
Tarjeta del AI Officer
Responsabilidades clave:
- Operaciones diarias de gobernanza de IA
- Inventario de Sistemas de IA y Registro de Riesgos
- Proceso de aprobación de herramientas de IA
- Coordinar evaluaciones de riesgo y DPIAs
- Agenda y reportes del Comité de Gobernanza de IA
- Red de AI Champions
- Monitorear rendimiento, incidentes y Shadow AI
- Enlace con AESIA
Usted es el R principal en la mayoría de las actividades de gobernanza. En caso de duda, le corresponde coordinar.
Tarjeta de Legal
Responsabilidades clave:
- Asesoramiento sobre clasificación y cumplimiento del EU AI Act
- Revisión de contratos de proveedores y negociación de DPA
- Revisión de contenido de alto impacto
- Gestión de consultas regulatorias y acciones de ejecución
- Asesoramiento sobre PI de contenido generado por IA
Tarjeta del Director de RRHH
Responsabilidades clave:
- Comunicación de la política de IA y programa de formación
- Seguimiento y cumplimiento de la finalización de formación
- Asuntos disciplinarios por incumplimientos de la política de IA
- Asesoramiento en derecho laboral para el uso de IA en decisiones de RRHH
- Gestión del cambio para la adopción de IA
Tarjeta del Responsable de Departamento
Responsabilidades clave:
- Asegurar que su equipo complete la formación obligatoria en IA
- Hacer cumplir la política de IA en su departamento
- Apoyar a su AI Champion
- Escalar incidentes y Shadow AI al AI Officer
- Revisar contenido generado por IA de Nivel 2 antes de su uso
- Aprobar solicitudes de casos de uso de IA de su equipo antes de enviarlas al AI Officer
Mensaje clave: Usted es la primera línea de gobernanza de IA en su departamento. Su equipo le mira como modelo de uso responsable de IA.
Tarjeta del Usuario Individual
Responsabilidades clave:
- Usar solo herramientas de IA de la Lista de Herramientas Aprobadas
- Completar la formación obligatoria en alfabetización de IA a tiempo
- Enviar una solicitud antes de usar cualquier nueva herramienta de IA
- Nunca introducir datos personales, datos de clientes o secretos en ninguna herramienta de IA
- Siempre verificar el contenido generado por IA antes de usarlo
- Reportar preocupaciones, incidentes o Shadow AI de inmediato
Lista de verificación rápida antes de usar cualquier herramienta de IA:
- ¿Esta herramienta está en la Lista Aprobada?
- ¿Estoy a punto de introducir datos personales, información de clientes o material confidencial?
- ¿Verificaré la salida antes de usarla?
- Si no estoy seguro/a de alguna de las anteriores — ¿he consultado a mi AI Champion?
5. Conflictos Conocidos y Resolución
| Conflicto potencial | Resolución |
|---|---|
| Independencia del DPO: el DPO no puede ser accountable de actividades que debe auditar | El rol del DPO es C (Consultado) en aprobación de política; nunca es A para actividades de operación de sistemas de IA |
| AI Officer y CISO ambos en evaluaciones de seguridad | CISO es A/R para evaluación de seguridad; AI Officer es C; AI Officer es A/R para la entrada en el registro de riesgos |
| RRHH y Legal ambos en asuntos disciplinarios | RRHH es A/R para el procedimiento disciplinario; Legal es C para asesoramiento legal; RRHH es dueño del proceso |
| DPO y Legal ambos en asuntos regulatorios | Legal es A/R para asuntos regulatorios generales; DPO es A/R para el contacto regulatorio específico del GDPR con la AEPD |
| Múltiples roles C pueden crear parálisis de decisión | La consulta debe tener plazo: máximo [5] días hábiles para decisiones estándar; [2] días hábiles para asuntos urgentes |
6. Registro de Cambios de la Matriz RACI
| Versión | Fecha | Modificado por | Resumen de cambios | Aprobado por |
|---|---|---|---|---|
| 1.0 | [FECHA] | [Nombre] | Versión inicial | [Nombre, Título] |
Anexo A — Plantilla de Organigrama para Gobernanza de IA
Adaptar y completar con nombres reales y líneas de reporte.
CONSEJO DE ADMINISTRACIÓN
│
CEO ──────────────── DPO (independiente)
│
┌────┴────┐
CTO LGL
│
CISO
│
AIO (AI Officer)
│
┌─────┬─────┬────┐
DHD1 DHD2 DHD3 HR
│ │ │
AC1 AC2 AC3 (AI Champions)
│ │ │
USR USR USR (Todos los empleados)AC = AI Champion (integrado en cada departamento)
Anexo B — Glosario de Roles
| Abreviatura | Título completo | Títulos alternativos |
|---|---|---|
| CEO | Director General | Administrador Único, Consejero Delegado |
| CTO | Director de Tecnología | Responsable de Tecnología, Director de TI |
| DPO | Delegado de Protección de Datos | Responsable de Privacidad (nota: el GDPR usa “Protección”) |
| CISO | Director de Seguridad de la Información | Responsable de Seguridad de la Información |
| AIO | AI Officer | Responsable de Gobernanza de IA, Chief AI Officer, Responsable de Cumplimiento de IA |
| LGL | Legal / Asesoría Jurídica | Secretario de la Sociedad, Director Jurídico |
| HR | Director de Recursos Humanos | Director de Personas, Responsable de RRHH |
| DHD | Responsable de Departamento | Manager, Director, Jefe de [función] |
| USR | Usuario Individual | Empleado, Miembro del personal |
En organizaciones más pequeñas, una persona puede desempeñar múltiples roles. Documente cualquier duplicación y evalúe conflictos de interés. Como mínimo, el DPO debe permanecer independiente.
Plantilla proporcionada por J4SGON | j4sgon.com Este documento es solo orientativo, no constituye asesoramiento jurídico. Versión 1.0 | Para uso de cumplimiento del EU AI Act | Última actualización: 2026-04-05
Cuéntanos qué integras o migras
Envíanos la plataforma, los sistemas implicados y dónde está el bloqueo. Recibes un alcance por escrito — fases, entregables y lo que queda fuera — antes de facturar nada.