AI Governance at the Crossroads: Why Business Analysis Is Essential for Responsible AI
Key Takeaways
- AI governance is an organizational challenge that requires business analysis leadership as well as technical oversight
- Many AI failures stem from poor requirements, unclear decision logic, and weak data governance
- Business analysis professionals help define accountability, explain AI decisions, and establish human oversight
- The NIST AI Risk Management Framework aligns naturally with core business analysis competencies
- Organizations that integrate business analysis into AI governance early are better prepared for regulatory scrutiny and long-term risk management
Artificial intelligence is accelerating into every corner of business and government. New tools promise speed, scale, and innovation, but they also introduce significant risk. The message from IIBA’s recent member-exclusive webinar with data governance expert Dr. David Marco was clear: AI cannot succeed without business analysis.
Held on Wednesday, February 4, the webinar “AI Governance Regulations Impacting AI Development” explored the rapidly changing AI governance and regulatory landscape. It also reinforced a core principle behind IIBA’s focus on business analysis for artificial intelligence (BA4AI): while AI may be powered by data and algorithms, it’s enabled, guided, and made safe by people who understand context, decision-making, stakeholder needs, and organizational risk.
And that work belongs squarely to business analysis professionals.
AI Governance Isn’t Only a Technical Challenge
Dr. Marco opened the session with a foundational truth: AI governance is not a silo. It’s an integrated framework that spans technology, policy, organizational capability, risk management, and regulation. In other words, AI governance is an organizational challenge, not just a technical one.
Every AI system operates within a broader ecosystem that includes business processes, legal and regulatory exposure, customer experience, data quality, ethics, transparency, and strategic decision-making. Treating AI as a purely technical problem ignores how decisions are actually made inside organizations. These are the areas where business analysis professionals excel.
As noted during the webinar, business analysis professionals are the connectors between systems and the business. They translate stakeholder needs into requirements, ensure alignment with organizational goals, identify unintended consequences, and bridge communication across teams.
This role becomes increasingly critical as AI becomes embedded in everyday decision-making.
Litigation and Regulation Are Surging
One of the most compelling sections of the webinar focused on real-world consequences of poorly governed AI. The speaker highlighted several high-profile cases, including:
- Meta’s $1.4 billion privacy settlement
- Google’s $1.375 billion biometric and location data lawsuit
- LinkedIn facing legal action over using private messages to train AI
- Cigna using an algorithm to deny more than 300,000 health claims in just two months
These cases show that many AI failures are actually governance and requirements failures.
The underlying issues, poor data quality, lack of consent, opaque decision-making, and algorithmic bias rarely stem from the algorithms themselves. They emerge when organizations fail to fully understand their data, processes, and decision logic before automation.
Dr. Marco shared examples of organizations running dozens of duplicate systems or relying on fragile, spreadsheet-driven processes to feed AI models. When inconsistent data and unclear rules are scaled by AI, flawed decisions can multiply rapidly.
Business analysis professionals help prevent these outcomes by mapping where data truly comes from, identifying inconsistent definitions, uncovering hidden decision points, and flagging where automation introduces new stakeholder risks. These activities reduce exposure long before legal or regulatory action occurs.
AI Risk Management Needs Business Analysis Leadership
AI introduces new types of risk that organizations must actively manage, including model drift, hallucinations, black-box decision logic, automated decisions with human impact, and expanding regulatory obligations.
As Dr. Marco emphasized, if you can’t explain an AI application to a non-technical person, you don’t understand it well enough to control it. Explanation, clarity, and interpretability are core business analysis competencies.
If an AI-driven decision cannot be clearly explained, the organization isn’t in control of that decision. It’s as simple as that.
He also stressed the importance of human oversight when AI systems make high-stakes decisions, particularly in healthcare, insurance, and finance. When these decisions affect people directly, organizations must carefully define where human review is required.
Business analysis professionals are essential in defining decision boundaries, determining where human intervention is appropriate, and designing controls that balance efficiency with accountability. Ultimately, AI risk management is contextual work, and business analysis professionals are needed to get it right.
The NIST AI Risk Management Framework: A Natural Fit for Business Analysis
Attendees were walked through the NIST AI Risk Management Framework (RMF 1.0), which provides a practical blueprint for navigating AI risk. The framework has four pillars:
- Govern – Build a culture of responsible AI
- Map – Understand context, use cases, and risks
- Measure – Define and track meaningful metrics
- Manage – Prioritize and mitigate risk
It’s an organizational model rather than a data science model, and business analysis professionals fit naturally into every pillar. Organizations that adopt AI risk frameworks early will be better prepared for regulatory change than those that wait.
Business analysis professionals contribute through stakeholder alignment, problem framing, process mapping, metric definition, requirements negotiation, and change enablement. This presents a clear opportunity for them to lead rather than react.
Why BA4AI Matters Now
Across every theme of the webinar, one message stood out: AI amplifies both value and risk, and business analysis professionals determine which one an organization experiences.
Business analysis helps ensure AI systems are valid, transparent, ethical, compliant, and aligned to real business outcomes. They bring judgment, context, and accountability to every decision.
If AI is the next frontier of organizational capability, business analysis professionals are the compass. Without them, risks go unnoticed, bias goes unchallenged, and accountability goes undefined. With them, organizations gain clarity, control, and confidence.
The takeaway is clear: responsible AI begins with understanding the business, its people, its risks, and its purpose. That is BA4AI in a nutshell, and it’s essential for every organization moving forward.
This webinar is just one of many member-exclusive learning experiences offered by IIBA. Become an IIBA member and unlock networking, community, resources, and much more.
About the Author
Susan Moore is the Community Engagement Manager at IIBA. Before that, she was a business analysis professional with more than 20 years’ experience in finance, insurance, and utilities industries, working on both the business and IT sides of organizations. Susan speaks frequently on business analysis-related topics and is the host of IIBA’s podcast, Business Analysis Live! Susan holds IIBA’s Certified Business Analysis Professional (CBAP) and Agile Analysis Certification (AAC) in addition to other business analysis and agile certifications.
