From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Billy Hurley

itbrew.com

Outsourcing your data destruction? Check out a service provider’s doors and cameras, says one IT pro.

How to vet your third-party data destroyer

Tom McKay

Government IT spending to increase in 2023

Quashing technical debt could cost an estimated $588.9 billion in 2023.

Governments will beef up their IT spending next year, according to Gartner projections

A recent survey indicates that many data centers are failing to track key environmental data.

Data centers aren’t crunching their own sustainability numbers

Data Management

Pop-ups, privacy notices, and consent checks provide a tiny bit of order in our unwieldy digital world, especially when it comes to pictures and videos of you. Some company-issued notifications, for example, might prompt you to agree to a platform or organization’s use of your likeness in a captured photo.

It’s harder to read that kind of fine print, however, with an unfamiliar pair of glasses—specifically augmented-reality (AR) ones. Our digital social contract becomes even more difficult to enforce if there are 

 with stylish eyewear that’s capable of recording you instantly.

“How do you roll that out, when you have, say, a million individuals with glasses just walking around, living their lives? Are they to wear T-shirts or signage that says, ‘Hey, I’m not myopic, I’m not [near]-sighted. I’m wearing these glasses because I’d like to take pictures of everyone as I walk about doing my daily life,’” Joe Jones, director of research and insights at nonprofit privacy organization IAPP, told IT Brew with a laugh.

Jones spoke with us about security and privacy risks—as well as the upside—of wearables as this technology becomes more advanced.

This interview has been edited for length and clarity.

Are you seeing mainstream adoption of AR glasses to help people do their jobs?

I would say, not mainstream. But I’m definitely seeing an increase in activity and increasing 

 in using AR glasses, or other devices that can help simulate real-world or can help augment real-world environments. You’re seeing this in a number of contexts: You

 medicine, broader scientific research. You’re also seeing it in anything where there are very minute manufacturing- or engineering- or precision-based professions as well—realms that don’t engage the privacy or civil liberties realm to the same degree. If you’re looking at where there might be leaks in infrastructure, or where there might be radiation, that’s different to dentistry…or to having a conversation with your friends, peers, or loved ones using AR glasses.

Do any privacy concerns come to mind as this technology gets adopted?

Your name, age, inferences, pupil dilation, etc., could all be picked up by someone’s AR glasses. And the moment is so fleeting, just as much as it’s so ubiquitous…The questions around the lawfulness and the efficacy of the not just documentary safeguards, but the governance and compliance safeguards that exist when you’re collecting data, when you should be telling people what you’re doing with that data, how you’re going to handle it, what rights they have, and what recourse they have.

I think a lot of the more mature players in this space are processing a lot of that data as locally as possible. Many of them are processing their data on device, so in the headset, on the glasses, and once that data is no longer being used or doesn’t have the utility, a lot of that data is being deleted.

Can documentation and compliance safeguards be somehow implemented in everyday life? Are we just kind of stuck with this risk?

I do think we’ll see some of the manufacturers and systems suppliers of these will say, “data is collected, and here’s how we’re dealing with that data.” And so if you’re walking down the street and you see someone who’s wearing these glasses, you might think, “Okay, I want to know how Company X may have collected my data there.”

The big challenge to all of this is the stylistic design, which makes it harder and harder for individuals to know that their data has been collected in the first place. It’s one thing to talk about CCTV. You see the camera. It’s one thing to talk about the selfie; you see a phone go up…A lot of this technology is going back to a more analog design so that we 

know it’s technological, and it becomes even harder to understand what safeguards, what documentation and checks and balances exist.

Would you have any advice for, say, a dentist who is using these glasses?

Making sure that they are on top of their own governance, their own infrastructure security, their own privacy compliance is going to be really key. There’s only so much they can control when it comes to the device manufactured by someone else, but the extent to which they’re pulling down and pulling out that data for their own use in their own systems. That’s when they have more control and more is expected of them.

A portrait of Joe Jones, director of research and insights at nonprofit privacy organization, IAPP

With AR glasses, IAPP’s Joe Jones sees security and privacy challenges

It’s difficult to protect information from video- and photo-capturing eyewear.

As many employees use GenAI platforms to find the right answers to tech and business conundrums, some of their colleagues see value in collecting the right questions.

Three IT professionals shared what they learned after implementing prompt libraries for their organizations. Whether adding 50 new prompts in one month like West Monroe’s Reva Busby, or stopping at around five like PR-firm pro Emily Koehn, a collection of go-to chatbot inputs offers a helpful head start for a variety of tasks within an organization.

“I think a prompt library is important because it allows the use of AI to scale faster,” Busby, director of the commercial growth team at business and technology consulting firm West Monroe, told IT Brew. “You are getting pre-built and well-engineered prompts that you can use right off the bat, without having to have all that knowledge about building a prompt yourself.”

In 2023, West Monroe introduced Nigel, an internal chat platform assisting the company’s 2,000 employees with tasks like drafting emails, writing code, and analyzing datasets.

The platform holds a library of 278 prompts, and has about 12,000 all-time uses (and 8,000 just in 2025), according to data shared by WM.

While Busby did not reveal exact prompts, the director said one prompt for generating a sales email includes case-specific factors for the user to input, including: background information about a client, tone, and output format.

While some prompts may be a sentence long, Busby said, others related to sales or consultant teams are “robust” and may require lots of extra details “because you’re trying to execute a very specific workflow in the context of some repeatable service.”

Busby uses a specific prompt when organizing notes after a candidate interview—one that pulls data like job role, notes, and feedback into desired table formats.

For Koehn, PR account director at Crackle PR, the prompt library is a smaller guide for the nine or so full-time employees using tools like ChatGPT, Perplexity, or Gemini. Prompts exist for main categories like:

 from analytics consulting firm Trust Insights, which factors role, action, context, and execution into the prompts. One helpful prompt for Koehn, she said, pulls the most headline-worthy findings from an uploaded client report.

“Now that gives me a fantastic starting point in minutes,” Koehn said. “Do I still go through every single tab of data and verify that AI didn’t hallucinate? Absolutely. Do I still look at the data to make sure that AI didn’t miss any things that are really significant or interesting? Absolutely.”

A report from the US Chamber of Commerce, which polled over 3,800 businesses in June 2025, found that 58% of small businesses (250 or fewer employees) use GenAI—up from 40% in 2024 and more than double compared to 2023 (23%).

Generative AI is also popular with the companies who are investing heavily in creating it. Microsoft CEO Satya Nadella revealed some 

 recently on LinkedIn, including “Based on my prior interactions with [/person], give me 5 things likely top of mind for our next meeting.”

West Monroe’s library, built “from scratch,” according to Busby, organizes prompts by topics (productivity and performance management, for example) and job role (like sales). A search bar gives employees suggestions for helpful inputs, and prompts can also be ranked and sorted by usage and popularity, Reva said; employees can pin their favorites.

“You need to be able to narrow down quickly to what’s relevant to you,” Busby said.

Recommendation #2. Get everyone involved.

When West Monroe’s Nigel came online, the team noticed a trend: a few people were writing all the prompts. Busby stressed the importance of letting employees “cocreate” on prompts; the firm has even recently offered a prompt-building “wizard” for the non-experts.

As long as a prompt doesn’t include a restricted topic like financials and compensation, Busby noted in a follow-up email to IT Brew, it will appear in the library, and employees can offer ideas and commentary to the prompt author. (The company also highlights standout prompts each month on the company’s homepage, Busby told us.)

Brady Lewis, senior director of AI innovation at marketing consultancy Marketri, has led the refinement of a prompt library that he says has reached 150 full prompts.

Lewis also meets every Monday with a six-person, cross-department AI council to investigate any problems with deployment, and to review new prompts for vague or otherwise troubling results.

And some prompts require…more prompts. Lewis advises employees with frustrating results to copy the output that 

work and try a new LLM (or start over with the same one) “to reframe the question.”

Lewis also has a collection—a small library if you will—of 10 or so prompt blocks. These little promptlets can aid in the construction of new prompts: “I want this formatted specifically in a CSV table format,” for example.

It’s a challenge, Lewis admits—balancing continuous education while not trying to “bombard the employees” with hours of training.

“We can’t control every single aspect of what every single employee does at all times. We’re trying to provide as many guardrails and make things as easy as possible,” Lewis said.

Illustration of an opened book laying on a book shelf with floating ai prompts above.

Best practices for building a prompt library

Three pros share what they learned about collecting good queries.

When it’s time for cyber insurance, there are a lot of questions as part of the process—seemingly endless questions.

Matt Hillary, chief information security officer (CISO) and SVP of security at Drata, a security and compliance automation platform, has to sit down annually with the chief financial officer (CFO) and general counsel (GC) to ask and answer questions like:

Do you have multi-factor authentication for remote access?

Do employees have install rights on those laptops?

Has there been a security breach in the last two years?

CFOs have budgets allocated for cyber insurance, and insurers set premium rates based on buyers’ security controls. Amidst this back and forth, CISOs are tasked with dutifully conveying an accurate cybersecurity picture to their financial colleagues.

Hillary and other CISOs and consultants who spoke with IT Brew shared effective strategies for answering finance and security questions effectively and early in the cyber insurance process.

“It’s kind of an unofficial marriage between the CISO, GC, and CFO within the company. If you don’t have a solid connection or relationship—and a working relationship and an influential type of relationship—within that cohort of those three, you’re doomed for a really painful experience as a CISO,” Hillary said.

Throughout his career, Hillary has had to answer a cyber insurance questionnaire ranging from one page to up to 70 questions.

The questionnaire allows insurers to understand a potential customer’s risk exposure, and to assign insurance options and costs accordingly.

Common questionnaire sections include: information privacy (does the applicant encrypt data when transmitted over public networks?), information-security organization (what frameworks has the company complied with?), email security (do you provide a quarantine service to users?), and internal security (do you use MFA to protect privileged user accounts?).

A CISO can provide expertise to a CFO, who may lack an understanding of past security incidents and current controls. According to Nadine Moore, managing director and senior partner at Boston Consulting Group, a line of questioning could be, “Is data encrypted? Well, there’s a lot of data inside companies. Is it all encrypted? Is some of it encrypted?”

Data is a complicated subject for CFOs and security pros alike. When Hillary supported veterinary and dental clinics, calculating all data elements—a potential cyber insurance prep task—might lead to multiple database queries (and even an exclusion of, say, pet records, which don’t count as protected health information).

Defining all data elements could lead to a CFO asking, “We have 

 of these records? Why do we even have those records?” Hillary said.

According to Identity Theft Resource Center, the first half of 2025 saw 1,732 data compromises—54.9% of 2024’s total of 3,155 incidents, putting it slightly ahead of last year. IBM’s latest Cost of a Data Breach report, which reviewed security incidents between March 2024 and February 2025, calculated an average loss of $4.44 million.

Here’s one common cyber insurance question a CFO asks a CISO, especially at an expanding company, according to Mimecast CISO Leslie Nielsen: 

To answer that question, Nielsen pulls cost calculations from reports like 

 and Verizon’s Data Breach Investigations Report (which analyzes figures like median ransomware amounts). If costs increase by a certain percentage, perhaps a group discusses upping their coverage to cover a similar percentage increase, Nielsen said.

As CISOs augment security capabilities, their organizations can get more coverage and better insurance pricing, Moore told us. However, flipping a security-question checkbox from “no” to “yes” requires budget and IT effort.

Adding a company-wide control like multi-factor authentication is “not a ‘let’s put it in over the weekend’ thing,” Moore said. She added that orgs should bring documentation to the cyber insurance meeting, like external audits, to demonstrate security posture.

Hillary emphasized the importance of regular meetings via risk steering committees to keep the CFO informed—and to make sure the first time a CFO, CISO, and GC get together for questions isn’t an hour before the cyber insurance broker arrives.

“I have not seen a CFO yet be surprised by these requirements,” he said. “And in fact, I’ve been more on the side of CFOs being like, ‘What more do you 

? Like, how do we help you make sure that we’re protected here?’”

Two hands filling out a digital questionnaire

When it’s time for cyber insurance, here’s what a CFO needs from the CISO

Here’s how to sort through the seemingly endless questions.

John McKenny began his mainframe career in 1981, managing printers and reports generated by a powerful, refrigerator-size computer built to process and automate then-paper-based workflows at railway company CSX Technology.

Forty-plus years later, McKenny, now SVP and general manager for BMC Software’s mainframe business, helps clients operate and optimize the same mainframe technology from his railroad days—only the tech is now faster, sleeker, smaller, and AI-equipped.

While it’s tempting to think that virtually all modern enterprise IT workloads live in the cloud, or at least within on-premises hardware conceived and designed within the past 20 years, today’s mainframes still support critical applications in insurance, banking, government, and many other firms handling lots of transactions.

But what does the future of the mainframe look like, as more companies push to the cloud and begin to lose track of old languages (like COBOL) found in the decades-old hardware? We spoke with mainframe engineers like McKenny about how the mainframe is modernizing and opening its giant doors to emerging technologies and emerging enthusiasts.

A mainframe, a large-capacity computer with very high processing power, got its name from “the large cabinet or ‘main frame’ that held the central processing unit (CPU) of early computer systems,” 

,” designed in 1937, is considered the first mainframe computer. While early models had dimensions ranging from 2,000 to 10,000 square feet, says IBM, newer releases throughout the decades have shrunk to a more modest size, perfect for slotting into a data center.

Mainframes enable transactions at blazing speeds. IBM’s latest-gen mainframe system, the z17, released in April 2025, for example, boasts a processing capability of “up to 5 million inference operations per second with less than 1 ms response time.”

The mainframe, by design, has built-in features supporting can’t-fail applications, including redundant hardware components, a workload-balancing structure called 

, and advanced warnings of a faulty part.

“I’ve gotten calls from IBM throughout my career, and they’ve said, ‘Hey, one of your memory modules is failing. We’re on our way to replace it’…and nobody has any idea that that failure occurred,” Steven Perva, an expert mainframe innovation engineer at Ensono, told IT Brew.

Almost a century after their creation, mainframes, given their central role to many businesses, have remained in data centers and taken on new features.

One way to modernize, according to Perva, involves changing the software development approach for mainframes. Perva has been using new extensions to enable tools and capabilities familiar to non-mainframers, such as the AI code editor VS Code, the remote-access management interface SSH, and Microsoft Copilot code explanation.

Before these access methods, applications were (and still are, according to Perva) typically developed via TSO/ISPF command-prompt interfaces, also known as “green-screen” interfaces featuring 

-like green text on a black background. API connectivity, introduced by the z/OS Management Facility tool has enabled new coding options, Perva wrote to us in a follow-up email.

“It’s almost like a kid having a job that says, ‘Hey, we have all these new toys that are coming out. We want you to tell us which ones are fun,’” Perva said.

McKenny, too, has seen developers use similar code tools to write and update an application running on the mainframe. “By developing that in VS Code, they have access to look at and interact with information from the mainframe about that application, to get an explanation of that application, to get some insights as to how it works and all that can be done in a modern interface,” McKenny told IT Brew.

Many mainframes feature COBOL—the “Common Business-Oriented Language” invented in the 1950s. Expertise is currently in 

, as modernization, for some, might mean getting rid of all that COBOL.

Hassan Zamat, SVP at Kyndryl and the global practice leader for core enterprise and its mainframe-as-a-service platform zCloud, uses generative and agentic AI tools to translate legacy code like COBOL into modern programming languages like C# or Java, in addition to recommending architectural improvements.

Modernization could also mean a “hybrid” approach, pulling some on-mainframe functions into virtual mainframe environments in the cloud. A common “hybrid” scenario Perva sees: Orgs will move their development environments off the mainframe. “We see a lot of people who want to automate their testing, and they’re not developing all the time, so it doesn’t make sense for them to have a dedicated, forever-running development environment,” Perva said.

Tools like BMC’s AMI Ops and IBM Z’s AIOps use AI capabilities to monitor for disruption-causing events.

BMC’s annual mainframe survey, released in September 2025, revealed an emerging interest in the mainframe from younger IT professionals. Around 66% of the more than 1,000 global mainframe practitioners and stakeholders surveyed identified as millennial or Gen Z—an increase from 37% in 2018. Almost all (97%) of this year’s total respondents see the mainframe as a long-term platform or platform for new workloads—like generative AI assistants and even faster fraud detection and credit-risk scoring, McKenny shared as a few examples.

McKenny hopes to retire in the next 10 years or so, he said, leaving a place for a new generation responsible for taking the platform forward. “When you have someone that has a responsibility to develop on, to secure, to manage, to operate this environment for the next 15 or 20 or 25 years of their career, they’re more interested in looking at, ‘Hey, what are some of the new and different ways that we can exploit the power of this platform?’”

A man at a workstation, circa 1970. Behind him is an IBM System/370 mainframe computer. Credit: f8 Imaging/Getty Images

How the mainframe is modernizing, according to today’s IT pros

Mainframe practitioners discuss the “new toys” they’re playing with these days.

Like a best man speech at a wedding reception, business data is often unstructured and messy.

Take insurance, for example. “Sometimes the auto insurance customer database is not directly connected to the homeowner database or to the life insurance database. And so if you want to get a holistic view of the customer, what sounds like a trivial event is not trivial,” Alex Singla, senior partner at McKinsey and co-leader of its AI arm QuantumBlack, told IT Brew.

Singla helps clients across industries deploy AI to solve business problems—and that, in simple terms, can come down to connecting datasets to decision-making algorithms.

, many orgs have spent or plan to spend on AI in 2025 (78% of global senior leaders, according to a 

Following McKinsey’s Media Day on September 8, Singla spoke to us about how IT teams are being impacted as companies try out AI—and how one role for IT, amid these AI deployments, might be especially data-driven.

How can IT evaluate whether an AI tool is actually useful in a certain context, or whether it’s just being pushed by executives who are excited about AI?

I think IT needs to be part of that decision-making process and not have it being thrust upon them. And the reason I say that is because any of these solutions and tools come with a level of [questions]: How will this interact and play within my own infrastructure? And how will it actually connect and work?…IT needs to play a role in understanding what that will look like.

IT can [also] do an amazing job understanding what data needs will be required to make that AI solution work: How good is our data? Where does it reside? Will it need to be real-time data, or not real-time data? If it’s real-time, what are the implications of that, in terms of not just where it resides, but how much it will cost.

If it’s real-time data feeds, and it sits on a cloud platform, all of a sudden I’m consuming much greater cloud consumption than I might have typically [consumed], and therefore I need to track what the cost will be. So, as I think about the value, it’s not just the upside of what that AI solution might provide, but it’s also the cost side of that equation.

What kinds of data sources are commonly used in AI deployments that an IT pro should already be ready to connect with or understand?

Many AI solutions will benefit from your own finance data, your customer data, your product data; if it’s maybe an efficiency play, you have people data. Those are, in our view, “no-regret” things to get structured in ways in which AI can leverage and use them over time. Like finance, for example: At any point somewhere you’re going to have to connect the impact back into the finance systems, right? So, how it connects to that will be important. Product and customer are usually enormous data sets that are not always clean; let’s put it that way. It takes real work to get them in good shape.

The data is in so many different spots. The data is not always captured consistently, and so you get a lot of messy data, or gaps in the data…And the more messy that is, the more expensive it becomes, particularly when that data sits in a cloud.

Is IT being asked to do everything? And what are ways to make sure an IT professional doesn’t get overwhelmed with this process?

What I sometimes see is people get so excited about the opportunities but they don’t fully appreciate how long some of these things take to build—not just from a technical perspective, but then rollout and scale across the organization. I think the technical professionals can continue to reinforce just the time it takes to do some of these things.

Like the data-engineering side and getting the data structure in good shape: That’s often the long pole in the tent. Building the models and building the solutions—of course, you need great, smart people to go do that, but that’s usually a solvable problem. It’s getting the data structured up front, getting access to it, and then rolling it out and scaling it, which has less to do with technology, and has become such a huge part of driving an impact.

As execs put AI to work, IT has a role to play in handling all the data

McKinsey’s Alex Singla shares which data sets need some cleaning up.

When Google’s AI Overviews arrived in May 2024, search engine strategists—the specialists who make a living by getting web pages to the top of people’s query results—took notice.

With the implementation of Overviews, Google’s first page search results, a target destination for anyone creating and optimizing content, suddenly sat below a response generated by Gemini, the company’s AI engine.

“Our initial reaction was, ‘Well, how is it going to work in the future? What kind of query is it going to take in, and how do we adjust to that?’” Tavish Harrison, a freelance SEO strategist, told IT Brew. “And I’m pretty sure every SEO on the planet was trying to adjust then, to figure out what it was doing exactly.”

Sarah McNaughton, founder of content-strategy consultancy McNaughton Digital Media, sees SEO as the “middleman” between the content team and engineering teams. While an SEO strategist might find relevant keywords and phrases to place within a story, much of the practitioner’s work is technical and unseen by a reader.

A site and its content, for example, needs to be indexable and contain the right “schema” or classifying metadata that a crawler can find and process for its output. Google also 

, so an IT pro and an SEO pro may have to coordinate to ensure that apps are functioning properly.

With AI Overviews taking a bite from search results, the SEO strategist role might appear to be in trouble. Following staff cuts of around 21%, Business Insider CEO Barbara Peng 

 that the company would pull back on areas sensitive to search traffic, like its SEO and Google-driven commerce business. The same month, the 

 a decline in news sites’ organic traffic (i.e., the number of visitors who arrive at a site via unpaid search results).

Meanwhile, AI is racking up pageviews. From August 2024 to July 2025, the market of over 10,500 AI tools recorded “nearly 100 billion estimated web visits,” according to a study from 

. The top 10 chatbots, led by ChatGPT, experienced a 123.35% year over year increase in web traffic, adding over 30.9 billion new visits.

But Noam Dorros, a director analyst at Gartner, said today’s SEO strategist should be excited about being in the field. It’s AI that’s allowing today’s SEO experts to play a more active business-leading role, informing strategy and helping people understand the evolutions of the search results, he said.

“It’s the shiny new toy out there,” Dorros told IT Brew. “AI is the elephant in everyone’s room, and they all want to know what to do. How do we measure it? And SEO specialists and people with SEO experience are the ones who can help and answer those questions.”

Today’s SEO strategists are adapting their techniques beyond the earlier paradigm of researching keywords and placing them throughout a web page or article, in the hopes that a search crawler will place their website at the top of a results page. “We are long, long past the days of targeting a single keyword for one article. That’s been outdated practice for a long time,” McNaughton said.

McNaughton lately has advised almost all clients to build FAQ sections for content—a structure that hopefully aligns with a person’s long-winded queries to a chatbot.

“We don’t know for sure, but just based on my own personal usage and other people’s usage, I’d say that it’s a good guess that people are going to be a little more verbose in their searches on [large language models] than they are on Google,” McNaughton said.

With click rates decreasing, Josh Petit, SEO manager for Monster, sees SEO undergoing a radical change in success metrics. These days, he considers search engine strategy a “real-estate game”: a blitz to get citations into AI Overviews, Google’s “People Also Ask” function (which shows related questions), its set of accompanying Image Packs, or whatever arises next.

Impressions—or how many times your site is seen—is more important for his team than click-through rates these days, according to Petit: “It’s not necessarily all about just the clicks.” To give his team the best chance “to take up as much space as possible,” he recommends an article make a question its own header and answer it directly “to make it real easy for AI to pull that answer,” Petit told us.

People are trying to do whatever they can to ensure visibility, according to Dorros.

“The difficulty is, these engines are all black boxes, right? They’re not giving playbooks to anybody to say, ‘This is what exactly you should do to show up,’” he said, adding that the people who have seen changes and algorithm updates are the ones best equipped to translate the new developments to marketing leaders.

For now, SEO strategists are left to rely on their bank of tried-and-true tactics, such as assigning metadata schema or arranging some frequently asked questions, and their own cleverness. When it comes to AI Overviews or whatever capability comes next, strategists like Harrison want to know what a new feature is doing and what powers its decisions.

“Curiosity is the basis that we all work from,” he said. “SEO isn’t a foundational thing in the organization itself, right? Because it is shifting, and people need to know how that’s adjusting. And I think that’s exciting.”

A search bar with colorful digital squares filling it up with AI stars surrounding it

How AI is impacting the SEO strategist role

Three search engine experts share why they’re still excited to be optimizing. 

, who on staff is going to own up to these AI aberrations?

 in August titled “Ready or Not: Governing AI in a Fragmented Regulatory Landscape,” an IT Brew attendee asked:

Who should ultimately own AI compliance? Is it IT, legal, or another business unit?

Many orgs are likely asking a version of this question as they seek clarity on AI policy and who should lead that effort:

While CIOs and CTOs have often been the leads of IT initiatives, some companies want a 

 for today’s tech deployments. A May 2025 report from AWS, which polled 3,739 senior IT decision-makers in nine countries, found that 60% of organizations (both large and small) have appointed a dedicated AI executive.

A Gallup poll of US employees, conducted in Q2 2025, revealed only 22% of surveyed enterprise AI users said their company has communicated a clear plan or strategy for implementing the technology.

While Guru Sethupathy, founder and CEO of AI-governance platform FairNow, told attendees during IT Brew’s 

 that AI governance is a “shared responsibility.” “Ultimately, you still want someone who’s a decision-maker, because you don’t want to get lost in a kind of paralysis by analysis,” he added.

Sethupathy and other industry pros who spoke with IT Brew agreed on the shared responsibility of AI governance, but had slightly different views on who should be involved and who gets to make the big decisions.

AI governance refers to policies, process, regulations, and ethical guidelines considered as the technology is designed and deployed. The discipline will likely examine an AI tool’s impact on factors such as data privacy, transparency, and fairness.

Sethupathy sees “key stakeholders” like business, IT, compliance, and legal teams involved in the process of responsible AI deployment, but he stressed the importance of having that “ultimate decision-maker” chosen by the company.

“The question then becomes who’s ultimately responsible for calculating the trade-off between value and risk,” he said during the event. “Each company does that in a different way.”

Nathan Olson, senior manager of digital solutions at advisory, tax, and assurance firm Baker Tilly, agrees that AI governance should be a “shared responsibility” and a “collaborative model.” In the midsize orgs that he counsels, Olson sees:

IT pros examining model behavior, data pipelines, and infrastructure

Legal teams overseeing alignment with regulations

Business units defining specific use cases and ethical boundaries

But governance “ownership,” he said, falls to the group, which he recommends should meet regularly to approve or review existing use cases for efficacy, risk, and compliance.

“It’s important to have a clearly defined and maybe an AI governance charter of what responsibilities fall to what teams specifically,” he said.

Rohan Sen, a principal in PwC’s cyber data and tech risk practice focusing on data risk and responsible AI, sees the importance of cross-disciplinary collaboration with business leaders in IT, legal, cybersecurity, and privacy—those who own a particular risk domain in a company.

IT has an especially important AI governance role to play, surfacing various technology choices (like one model provider over another) and communicating their impact, he said.

Ultimately, Sen recommends having a single authoritative role—maybe a chief compliance officer, chief risk officer, or chief privacy officer, he said—to “break ties” and make the ultimate decisions once risk players in a committee provide their input.

“Otherwise, what you have is a whole bunch of different viewpoints, and nobody to be a referee or an emcee to say, ‘Okay, having heard all of these different viewpoints and considerations, what should we actually do?’” Sen concluded.

Photo collage of an AI icon in between two hands pointing at each other contained within abstract shapes.