Managed Security Services: CISO Does Not Bear Sole Liability
Benedikt Langer
8 min. read In many organisations, the CISO is seen as the person who stands accountable for security. ...
10 min read
The Deloitte Tech Leadership Study lists 71 percent of companies with five or more tech leaders in the C-suite. “Operator to orchestrator,” the slide says. Yet the real orchestrator inside large corporations is rarely a C-level executive—it’s a PMO. And it’s the exact composition of that PMO that will determine whether AI roll-outs succeed by 2026.
Key Takeaways
RelatedSenior tech talent is becoming scarcer / Tech mandates in the supervisory board
The 2026 Deloitte study hits the nail on the head. C-level tech leadership is more fragmented than five years ago. CIO, CDO, CISO, CAIO, chief digital officer, head of data now sometimes sit side-by-side in the board or report directly to the board. What the study does not say: these five roles do not meet operationally at C-level. They meet inside the big programmes, and there the PMO is the place where coordination either works or collapses.
Over the past 18 months I have accompanied three AI roll-outs in German corporations that began as board-level initiatives. All three had a C-level sponsorship set-up that looked good on the board slide. Two of them have stalled in the programme phase within the last nine months. The point where they stalled was always the PMO—not because the people were weak, but because the mandate was missing.
A daily stand-up that runs three minutes too long is the difference between a meeting that produces decisions and one that merely exchanges status reports. In an AI roll-out, that gap quickly multiplies to weeks.
This is the most common setup. The PMO is positioned within the organization as an extension of the compliance and risk function. Its mandate is to report, not to decide. Risk registers are maintained, RAID logs are updated, and stage-gate reviews are prepared. If a stakeholder adds a requirement, it goes straight into the backlog. If a supplier delays delivery, the risk entry is updated.
Risk registers are useless if they’re maintained purely for compliance reasons. They become filing cabinets where open issues are sorted without any decisions being enforced. In a standard transformation, this setup might last two years. But not in the 2026 AI rollout. The iteration speed is so high that a PMO that only sorts information falls behind every sprint.
Concrete example from a mid-sized corporation, anonymized: During the first nine months of an AI rollout, the PMO of an energy provider logged 47 risk entries and closed four with escalation to the program leadership. The remaining 43 were reassessed quarterly. In the ninth month, an auditor visited the program and asked who actually decides on those 43 entries. No one knew the answer. Two months later, the program leadership resigned.
The PMO reports directly to the CIO or CAIO and does what those leaders instruct. Methodologically, this sounds reasonable: short decision paths, clear reporting, a single sponsor. In practice, however, leverage vanishes when the rollout crosses the CIO’s organizational boundary—which it always does in AI deployments. Data comes from business units, compliance from legal, change management from HR, and budgets from finance.
When the PMO requests data from a business owner, the owner first checks with their own manager. The manager rarely welcomes extra work, and the PMO has no direct escalation path. The request stalls. The PMO escalates to the CIO. The CIO escalates to the board. The board points back to the program sponsorship setup. Three weeks lost, one requirement unanswered.
If no one can say no to scope, you don’t need a PM tool. You need a conversation. And in a PMO without mandate, that conversation never happens because the PMO isn’t where the question gets decided.
This setup is the most insidious because it looks healthy at first glance. The PMO has a mandate, a budget, and a direct reporting line to the CFO or COO. What it lacks is the authority to make methods binding across the organization. Each sub-project chooses its own approach: one follows SAFe, another Disciplined Agile, a third classic waterfall, a fourth an internally defined hybrid model.
Methodologically, this isn’t wrong—it’s textbook contemporary. In practice, it prevents any cross-workstream governance. An AI rollout that simultaneously needs data pipelines from three business units, an MLOps platform, a governance layer, and model-risk management cannot be coordinated across four different approaches. Not because the methods are flawed, but because the handovers between them become prohibitively expensive.
The most common transformation I’ve seen is the one that, after two years, looks like the old organization with new job titles. That’s exactly what Scenario 3 reliably produces: plenty of methodological diversity, little coordination, and ultimately a rollout that exists on paper but is carried by isolated workstreams in reality.
In AI rollouts with clear cross-functional scope, it should report to a program sponsor positioned outside the CIO’s line of sight—most often the CFO or COO, as these roles carry the mandate needed. Reporting lines directly to the CIO only work if the CIO themselves holds cross-functional leverage within the board, which will no longer be the default in many corporations by 2026.
None of them in isolation. Successful AI rollouts typically blend a robust Stage-Gate framework for regulatorily sensitive hand-offs with agile iteration cycles in model and data workstreams. Pushing a single method through to the end usually backfires during model-risk management or compliance audits.
When the share of program decisions made inside the PMO drops below 30 percent for several consecutive sprints. That is not normal in any maturity phase; it signals the PMO has lost its steering mandate. At that point, the question becomes whether the PMO or its mandate is the root cause. Replacing both is usually cheaper than letting both limp along.
Smaller than most programs anticipate. In the three rollouts I’ve seen, the functional floor was five full-time equivalents: one program manager, one method owner, one stakeholder coordinator, one reporting owner, and one quality lead. The PMO only needs to grow once each workstream requires its own sub-PMO and the central team shifts to pure coordination.
The CAIO sets the AI strategy, owns the model portfolio, defines data policy, and prioritizes use cases. The PMO executes the program. When the two functions blur, one collapses. When they align, the CAIO provides the PMO with a clearly defined escalation and decision corridor—not day-to-day operational involvement.
More from the MBF Media Network
Image source: AI-generated (May 2026), C2PA certificate on file.
Images in article: AI-generated (May 2026)