A city creates an AI steering committee but leaves permitting AI without a named business owner. What governance gap should audit highlight?

Creating a city AI steering committee while leaving permitting AI without a named business owner leaves a governance gap: missing ownership of AI-related risk, controls, decisions, and standards for that permitting system. Enterprise steering committee oversight of AI policy and portfolio priorities across city programs sets direction at the portfolio level; system owners accept residual risk, approve model and prompt changes, fund controls, and answer for resident-facing outcomes. Without a named owner, exception handling, vendor escalations, and incident accountability have no clear landing point when applicants are harmed or delayed.

Enterprise steering committee oversight of AI policy and portfolio priorities across city programs does not eliminate the need for a system-level business owner and should not be treated as a substitute RACI. Vendor management of model updates, hosting uptime, and support tickets under the permitting contract does not transfer ownership of municipal permitting risk to the vendor—the city retains public accountability for decisions affecting permits. Assigned data stewardship for permit record quality, definitions, and sharing agreements between departments is not a substitute for business ownership of the AI permitting system; AI decision systems that affect permits require clear business ownership and documented deputies.

Exam caveat: RACI questions often distinguish enterprise steering committee oversight of AI policy and portfolio priorities from system accountability—both are required for effective AI oversight. Operational check: assign a permitting business owner in the AI inventory, link them to risk acceptance and change approval, verify that enterprise steering committee oversight of AI policy and portfolio priorities does not substitute for that role, and test an incident scenario to confirm who decides.