With AI now widespread, the lack of effective oversight is becoming a critical business risk. This isn't just a policy issue; it's creating urgent demand for a new class of specialist who can manage AI risk. These hybrid roles, blending tech, security, and compliance, are what companies are struggling to find right now.

The conversation around AI in business has shifted from *if* companies should adopt it to how they manage the consequences when it goes wrong. And it does go wrong. Recent studies show that around two in three organizations have experienced an AI-related incident in the past two years. The problem is that readiness hasn't kept pace with adoption. Fewer than half of those companies have a documented plan for how to respond.

The gap between AI adoption and control isn't about budget. It's about talent. While over 90% of organizations have allocated funds for AI governance, the real bottleneck is finding people who can build and run these programs effectively. It's a clear signal that writing policies is one thing; implementing and enforcing them is another.

This is a major challenge for technical leadership. One recent PwC survey found that 44% of CISOs see shortages in AI oversight and governance skills as a significant barrier to progress. The issue is that accountability is fragmented. When an AI system produces a harmful result, who is responsible? Is it the data science team that built it, the CISO who is supposed to secure it, or a compliance officer who wrote the policy? With only 5% of companies reporting clear lifecycle accountability for AI, the answer is often nobody.

"Technology and controls alone aren’t enough. Organizations also need clear accountability for AI risk—who owns the decisions, who is responsible when an AI system behaves unexpectedly and where human oversight is required." - PwC Research

This ambiguity creates risk. It also creates a market for a new type of professional who can bridge these internal gaps.

AI governance isn't a single job; it's a new function that requires a team of specialists with distinct skills. We're seeing demand for several new and evolving roles that sit at the intersection of technology, risk management, and regulatory compliance.

Here are a few key roles that are becoming crucial:

• AI Governance Lead or Chief AI Officer: This person owns the entire framework. They don't just write rules; they define what constitutes acceptable risk, establish review gates for new models, and decide what happens when an incident occurs. Already, about a third of companies have appointed a dedicated leader for this function.
• AI Risk and Compliance Specialist: This role is the translator. They take broad regulations like the EU AI Act and GDPR and map them to concrete technical controls. They are responsible for gathering the evidence needed for audits, especially in high-risk areas like recruitment and finance.
• AI Security Engineer: This is not a traditional AppSec role. These engineers specialize in adversarial AI—testing for things like prompt injection, data poisoning, and model extraction. It requires a deep understanding of both machine learning and offensive security tactics, a rare combination.
• Model Risk Validator: This professional acts as an independent challenger to the data science teams. They test models for bias, accuracy, and drift before they go into production, setting the thresholds for when human oversight is required or a model needs to be pulled.
• AI Incident Response Manager: Standard incident response playbooks don't work for AI failures. This manager creates and leads the response to incidents like model hallucinations or unsafe autonomous actions, coordinating between legal, security, and communications teams.

Finding talent for these roles is a major recruitment challenge. The scarcity isn't just about a lack of data scientists; it's about the unique blend of skills required. You need someone who understands how a model works, the legal framework it operates within, and the business context it serves. These people are rare.

The biggest capability gap appears to be in security. Research shows that 52% of cybersecurity leaders feel least prepared to handle adversarial attacks against their own AI systems. This is a new discipline. Experience in network or application security doesn't automatically translate to securing a large language model. It requires a different mindset and a new set of tools, creating a demand for a new kind of network security engineer who can think like an attacker in an AI-driven environment.

That's the real challenge. The market isn't just looking for more compliance officers or more data scientists. It's looking for people who can operate in the space between them. People who can ask the right questions of a model, document its behavior, and explain its risks to non-technical stakeholders.

Given how new these roles are, companies can't rely solely on the external market to build their AI governance teams. There simply aren't enough experienced candidates to go around. A more practical approach combines strategic external hires with a strong focus on internal training and mobility.

Organizations should look at their existing talent. Do you have security engineers interested in machine learning? Data privacy officers who can get up to speed on the EU AI Act? Product managers who understand the business impact of model failures? These are the people who can be retrained to fill these new roles. This isn't just a good idea; it's becoming a compliance requirement. The EU AI Act, for instance, explicitly requires organizations to ensure staff have an appropriate level of AI literacy.

In the past year, organizations have reported a wide range of AI-related incidents. These include inaccurate AI outputs (40%), policy violations (33%), customer complaints (28%), and data breaches (27%).

Investing in training and creating clear career paths for these specializations is vital. It's how you build a sustainable governance function rather than just plugging holes with expensive external hires. It also requires a focus on operational stability, leaning on professionals who manage system stability and can apply those principles to the unpredictability of AI systems.

For tech professionals, this shift presents a clear opportunity. If you're a software developer, SRE, or security engineer, specializing in AI governance is a smart career move. While generalist developer roles may see pressure from AI-driven automation, these specialized governance roles are in high demand and require deep human expertise.

This isn't about becoming a compliance expert who writes documents all day. AI security is a deeply technical field that involves red-teaming models, developing new detection methods, and building secure infrastructure. Model validation requires strong statistical and analytical skills. These are challenging engineering problems to solve.

The professionals who will succeed are those who can combine their technical depth with an understanding of risk and a willingness to work across different business functions. It’s a chance to move from building features to ensuring the entire system operates safely and responsibly.

The need for AI governance has moved from a theoretical discussion to an urgent operational demand. The high rate of AI-related incidents shows that simply adopting the technology without building guardrails is unsustainable. This has created a clear and growing talent gap for a new type of hybrid professional—one who can manage technology, security, and regulation simultaneously.

For hiring managers, the challenge is to recognize that these are not just reskinned compliance roles; they require deep technical expertise. For tech professionals, it's a field ripe with opportunity to specialize in a durable, high-impact area. Building these teams is a critical requirement for any company that wants to use AI responsibly and effectively.

1. AI Threats Top Cybersecurity Preparedness Gap, PwC Finds
2. EU AI Act
3. Home - Computable.nl
4. Laatste nieuws
5. Actueel
6. Dit zijn de gevaren van ai (6) voor mens en maat­schap­pij - Computable.nl

Written by our AI, read by a flesh-and-blood recruiter.