Skip to content

IT

IT owns the infrastructure: cloud environments, any on-premise hardware and software, and their security. That covers access control, firewalls, encryption, data classification and audit trails.

Tool and model selection

The Centres of Excellence choose the models and AI tools they use, based on what customers need. IT reviews each choice to make sure that:

  • security has been accounted for
  • the tool or architecture fits the existing estate
  • infrastructure costs are allocated correctly
  • the vendor's documentation and service levels allow security, compliance or regulatory failures to be passed back to the vendor on terms acceptable to the business and its customers

Compliance separately confirms the choice meets regulatory standards.

Neither side has a veto

IT and the Centres of Excellence sit at the same level, and neither can veto the other. A hard IT veto would slow the business down every time it needs a new capability. No escalation route at all would leave security exposed to decisions made by a single centre.

Most reviews are settled directly between IT and the team requesting the tool. When they cannot agree:

  • security, compliance or regulatory issues go to the board-level AI owner, who decides whether to accept, mitigate or reject the onboarding
  • cost issues go to finance, which decides whether the risk is acceptable, and owns the resulting margin impact if it accepts it. If finance does not accept the risk, IT escalates to the board-level AI owner.

Escalation should be the exception, not the norm.

Evidence status

Evaluated against an illustrative scenario. Not yet tested in a live organisation.