Part of our guide: AI strategy
In our experience, artificial intelligence (AI) strategy often sits outside operations, yet the operating model the Chief Operating Officer (COO) owns needs to evolve to take advantage of AI, with AI agents taking on some jobs and teams shaped differently. AI's capabilities should shape the operating model, so the COO needs a seat at the AI table. The technology leader should own the platform and technical standards, and the COO should own how AI connects to the operating model, including the processes, roles and operational controls around it, with the technology leader's judgement about what AI can reliably do shaping which processes change and how.
In insurers and banks regulated by the Prudential Regulation Authority (PRA), and in the larger firms regulated by the Financial Conduct Authority (FCA), technology systems normally sit with the senior manager holding the Chief Operations function, known as Senior Management Function 24 (SMF24), covering both operations and technology, so that is usually where AI lands. That role is often split between a COO and a technology leader, and this is where the problems start, because AI tends to be treated as a technology matter and goes to the technology holder, as the survey figures below suggest. The same point holds outside financial services, even where one person leads both operations and technology.
How responsibility for operations and technology is allocated
In firms regulated by the FCA or the PRA, the regulators define senior management functions that firms assign to specific senior managers, subject to regulatory approval.
The FCA has explained how existing senior manager responsibilities cover the use of AI. For banks and insurers authorised by the PRA and FCA-authorised firms in the enhanced tier of the Senior Managers and Certification Regime, technology systems are normally the responsibility of SMF24, and any use of AI falls within the responsibilities of a holder of a senior management function.
The PRA defines SMF24 by responsibilities rather than job title, and its holder should be the most senior individual responsible for managing a firm's internal operations and technology. In a business organised that way the holder is typically the COO, with technology run as part of operations.
Why the role gets split
Many firms aren't organised that way, because technology has its own leader, a Chief Information Officer (CIO) or Chief Technology Officer (CTO), who's as senior as the COO. The PRA's insurance guidance allows the SMF24 role to be shared or split where that reflects how the firm is organised, giving a COO and a CIO of equal seniority as its example. It expects each holder's responsibilities to be set out clearly in their Statement of Responsibilities, and the split must not undermine comprehensive responsibility for operations and technology. The regulation allows the split, and it doesn't prescribe how AI should be allocated within it.
We've found that a split SMF24 role is common and works well for most of what the role covers, and it needs more thought where the operating model has to evolve as well as the technology.
What the survey says about AI strategy ownership
Heidrick and Struggles' survey of AI, data and analytics leaders across industries, conducted in summer 2025 and published in February 2026, found that the CIO, CTO or chief digital officer owned AI strategy in 30 per cent of responses, the chief data and analytics officer in 23 per cent and a chief AI officer or the most senior AI executive in 21 per cent. It recorded COO ownership at 0 per cent of 242 responses overall, and 1 per cent in Europe. Owning the strategy isn't the same as being involved in it, and many COOs will shape AI decisions without owning the strategy.
Where SMF24 is split, we often see that pattern carried into the regulated structure. It's reasonable for AI to go to the technology holder, because it arrives as a system through a vendor, a platform or a data team, and the platform, its security and its resilience need a technology owner. The real question is how AI is delivered compared with how it's used, and in particular how it transforms the operating model and the business. If owning the platform is treated as owning how AI fits the business, the technology can be delivered while the business doesn't transform.
Much of the work of using AI well is in the operating model around it: changing processes, reshaping the roles of the people who act on its outputs and being clear about the decisions it informs and the outcomes for customers. That operating model has to evolve to take advantage of AI, and the COO owns it alongside the executives responsible for particular processes and decisions. The technology leader's judgement about what AI can reliably do shapes which processes can change and how, and where the CIO or CTO already leads transformation, the COO's decision rights over the operating model should be explicit within that work. Owning the platform doesn't make the technology leader the owner of the operating model it serves, and owning the operating model doesn't make the COO the judge of what the technology can do, so the technology leader, the COO and the relevant business executives need to design its use together.
If AI is allocated wholly to technology, the COO can remain responsible for processes without the authority to approve how AI fits the operating model, monitor its effects or suspend its use.
Giving the COO a seat at the AI table
We'd recommend that the CIO or CTO owns the platform and technical standards and that the COO owns how AI connects to the operating model.
The technology holder owns the platform, its security, change control and technical resilience, as well as the technical standards for building, testing and running AI.
The operations holder owns how AI connects to the operating model, including the processes, roles and operational controls around it. Business executives, such as the heads of claims and underwriting, keep responsibility for their decisions and customer outcomes, and the chief risk officer keeps independent oversight and challenge of the risks.
The COO also needs the authority that goes with that: to approve how a use fits the operating model before it goes live, to monitor its effect on the operation and to suspend it if it stops serving the process, alongside the technology leader's authority over technical readiness and the right to intervene on technical grounds. We'd also recommend that the relevant Statements of Responsibilities describe the holders' AI responsibilities explicitly rather than leaving them to the general wording on technology or operations.
A worked example: claims triage
As an example, take an insurer using AI to triage claims, where the CIO or CTO owns the platform, its security and the standards the model is built and tested against, including how its performance is monitored over time. The COO, with the claims director, owns how AI fits the claims process: the criteria for referring a claim to a person, who carries out that review and the right to switch it off if it stops serving the process. The technology leader, the COO and the claims director agree which work can reliably move to AI agents, and the COO and the claims director decide how the team is reshaped. The technology leader, the COO and the claims director agree how the model's effect on policyholders is reported and how a problem is escalated. The claims director keeps responsibility for claims decisions and policyholder outcomes, while the COO owns the model's fit with the operating model, so the board gets a clear answer when it asks who is accountable for what.
What the executive committee should agree
Give the COO a seat where AI is decided. Put the COO, or whoever owns the operating model, alongside the technology leader and the relevant business executives in the forum that sets AI strategy and approves new uses, with independent challenge from the chief risk officer. Agree their decision rights and, where applicable, reflect them in the relevant Statements of Responsibilities.
Name an owner for each material use. For each use of AI that touches a customer, a regulated process or a material control, confirm who is accountable for it, who approves its deployment, who monitors its outcomes and who can suspend it, and give each person the authority and resources for their responsibilities.
Design the operating model and the controls together. Treat each new use as a change to how the work is done, so the technology leader, the COO and the relevant business executives design the process, the roles and the checks alongside the system rather than after it.
A practical first step is to take one live use of AI, such as claims triage, and test whether its technical responsibilities, business decisions and escalation routes are clear. We'd welcome a 30-minute conversation with the leaders involved to test one against what it's delivering and who decides what.