Managed Security Services: CISO Does Not Bear Sole Liability
Benedikt Langer
8 min. read In many organisations, the CISO is seen as the person who stands accountable for security. ...
Two benchmark studies have landed on the same executive board table this week: The NewVantage 2026 AI & Data Leadership Executive Benchmark Survey reports 38.5 percent of organizations now have a Chief AI Officer (CAIO) role, IBM’s data shows 26 percent, while internal AWS figures circulate at 60 percent. Gartner forecasts that by the end of 2026, over 40 percent of Fortune 500 companies will have a CAIO. In DACH-region boardrooms, a question has now emerged that still sounded philosophical in 2024: Do we need a Chief AI Officer-or is a “CIO-plus” model sufficient?
What is a Chief AI Officer (CAIO)? A CAIO is a C-level role with consolidated responsibility for AI strategy, architecture, governance, and value creation across the entire organization. The position differs from the CIO role through its explicit focus on AI-specific topics (model lifecycle, data readiness, AI compliance, talent development) and from the CDO role by adding responsibility for AI-driven value generation and product integration. In practice by 2026, three variants exist: CAIO with full executive authority, CAIO as a reporting line under the CIO, or AI lead without a C-suite title.
The 38.5 percent figure from the NewVantage report is significant in two ways. First, it reveals momentum: in 2023, the number stood at just 11 percent. Second, it highlights variability-not every organization with a CAIO has equipped or empowered the role in the same way. While 90 percent of respondents report increasing AI investments, only a portion have adapted their organizational structures accordingly. It is precisely this gap that becomes the boardroom priority for the second half of 2026.
A candid look at the AWS figure: the commonly cited 60 percent CAIO adoption rate comes from internal AWS partnerships dashboards. This is therefore not an independently validated market view, but rather a snapshot of the enterprise customer base of a single hyperscaler. For board-level discussions in the DACH region, the NewVantage figure (CIOs/CDOs/CDAOs across 334 global companies) offers a more robust benchmark. The IBM number from the Institute for Business Value (26 percent) falls in between and supports the observation that organizations in Western Europe are still more cautious in adopting the role than their U.S. counterparts.
An honest retrospective is more expensive than three offsites. But only one of them changes anything. For the CAIO decision, no keynote is enough; it needs an honest organizational retrospective.
The practical question in the boardroom is rarely “do we need a CAIO” but rather “what changes to the budget, reporting lines, and accountability for success when we introduce one”. Three patterns have emerged in DACH corporations for 2025/2026.
The decision between these three patterns is rarely made purely on content. It often depends on how deeply the CIO is anchored in the organization, whether there is a CDO or Chief Data Officer (and how their mandate works), and whether the company markets an AI product or primarily uses AI internally. A B2C platform with AI features in its product needs a different CAIO than an industrial company that uses AI in manufacturing.
A common anti-pattern: The board appoints a CAIO without clearly clarifying interfaces with the CIO and CDO. The result is overlapping budgets, duplicate vendor contracts, and sometimes publicly fought disputes over direction. We are currently observing exactly this situation in two DACH corporations that appointed a CAIO in 2025 without operationally securing the role. The consequence: The CAIO is quietly replaced after 14 months, the AI initiative loses momentum, and the CIO takes over everything again.
An underestimated dimension of the role is supervisory board communication. A CAIO who delivers a consistent AI risk and value contribution cockpit to the presidium each month relieves the board and strengthens the position with investors. Three mandatory contents have proven successful in our mandates: A value contribution tracker with euro figures per use-case cluster, a risk register with model, data and vendor risks, and a talent barometer (development, attrition, external benchmarks). Those who cannot deliver these three artifacts do not yet have a functioning CAIO, but an AI responsible person with an official business card.
For the supervisory board, three concrete questions arise that should be addressed in the next meeting. First, who in our organization bears consolidated responsibility for AI value creation and AI risk; is this person equipped with budget and mandate? Second, how do we measure AI ROI today; does the measurement approach match the 36% premium that central AI leadership models achieve according to the NewVantage benchmark? Third, what role does the EU AI Act play in the CAIO or CIO-plus oversight structure; who ensures that high-risk systems do not go into production without compliance approval?
In our conversations with boards and executive boards, a sequence has proven effective that takes into account the typical DACH corporation context. Step one: Appointment of an AI Lead (VP-level) under the CIO with a clear mandate for architecture, governance and talent. Step two after six to nine months: Evaluation of whether the role should be elevated to the C-suite, depending on the AI share in the business model. Step three after twelve to eighteen months: Formal CAIO appointment with budget mandate, if the business model is clearly AI-driven. Those who skip this sequence are buying an executive risk that will become a personnel issue in 12 to 18 months.
The numbers from the benchmarks speak for the role, but they don’t speak to every organizational form. A CAIO without a clear business case is an expensive gesture toward analyst expectations in 2026. A CAIO with mandate and result responsibility is one of the most effective C-level levers that boards can pull in the coming 24 months. The difference lies not in the title, but in the architecture of the role.
The bridge from international benchmarks to DACH reality is often surprising: What is considered “established” in US corporations after twelve months regularly takes 18 to 24 months in DACH, because the additional coordination loops (works council, corporate DSB, local compliance) take time. Those who plan the CAIO role in DACH at US pace underestimate exactly this dimension. The good news: The forced order impulse often leads to decisions that pay off in later audits.
German, Austrian and Swiss corporations are structurally differently positioned in the CAIO discussion than their US counterparts. Co-determination, strict data protection culture and the EU AI Act make the role more complex than a simple US playbook might suggest. A CAIO in DACH must, in addition to the business value dimension, also consider the works council perspective, data protection coordination (in corporations usually through the DSB and a corporate data protection officer) and the compliance anchoring for high-risk AI systems. This is not a brake, but a differentiation opportunity. Those who fill the role with this structural sensitivity protect the organization from the typical “let’s implement quickly now” pitfall that led to regulatory trouble for several US banks in 2025.
In conversations with headhunters who are actively placing CAIOs in DACH in 2026, we hear a common thread: The most successful candidates have three things in common. They come from a line with KPI responsibility (not just consulting or research), they have weathered at least one EU regulatory project (DORA, MDR, GDPR rollout); they are communicative in boards without falling into consulting phrases. Those who apply these three filters in hiring reduce the rejection rate to under 20 percent. Those who don’t are at the known 50 percent who fail in the first 18 months.
A practical checklist that the board can run through in a single meeting: Is an AI-driven business model core expected within 24 months, or is it primarily about internal efficiency? Is the current CIO strategically and operationally able to additionally take on AI leadership? Is there a candidate pipeline that credibly fills a CAIO role, or does the job posting only produce resumes with three months of experience in the topic? What does the interface with Legal, Data Protection and Works Council look like; is it reflected in the current C-structure? Those who answer all four questions positively should fill the CAIO role. Those who hesitate on two or more questions should stick with CIO-plus or AI Lead and re-evaluate in nine months. One final observation for the agenda: The boards that have set up a clean CAIO structure in the last twelve months consistently report that the most difficult point was not the appointment, but the first quarter after the appointment. In this quarter, it is tested whether the CIO, CDO and CAIO are actually reading the same strategy. Those who do not bring these three roles together in a common format in Q1 (monthly steering, joint OKR setting, uniform KPI logic) inevitably create friction. The supervisory board’s perspective on this is sobering: If three board members each present their own AI numbers, the structure doesn’t work, regardless of how sonorous the titles are.
The role becomes operationally relevant with 2,000 employees or when AI investments exceed five percent of the IT budget. Below this threshold, a Head of AI under the CIO is typically the more efficient structure, as the coordination costs of a C-level position would consume the additional mandate.
In our conversations with headhunters, the range is €280,000 to €450,000 base salary plus variable component, depending on industry and company size. We see higher values in banking and pharmaceuticals, lower values in mid-sized corporations with an internal focus.
The CDO (Chief Data Officer) is responsible for data strategy, governance, and platform; the CAIO is responsible for AI strategy, model lifecycle, and AI value contribution. In practice, this means: The CDO provides data readiness, while the CAIO utilizes it for product and process AI. The roles must work closely together, but they are not redundant.
A CAIO without budget mandate in DACH corporations is typically a misappointment. The role is then perceived as a ‘coordinator’ without leverage on resources. After 12 to 18 months, the person often leaves the organization because successes cannot be achieved against resistance from CIO and CFO lines. A practicality check: If the role doesn’t receive its own budget of at least two percent of the IT budget, it’s better not to implement it.
A CAIO typically coordinates compliance for EU AI Act requirements across departments. Legal responsibility remains with management, while operational implementation and documentation fall to the CAIO. Deploying a CAIO without access to legal and data protection resources creates compliance risk rather than alleviating it.
Source cover image: Pexels / Werner Pfennig (px:6949494)