The Roles of the CIO, CTO and CISO Are Changing
So Are the Lines Between Them
AI is reshaping technology leadership, decision-making and accountability across the enterprise.
In my last edition of TechExec Insights, I discussed two mistakes organizations continue to make with AI: allowing adoption to move faster than governance and treating AI as simply an IT initiative.
That raises an important question:
If AI is no longer just an IT responsibility, what does that mean for the CIO, CTO and CISO?
The roles have been evolving for years. AI is accelerating that change and increasingly blurring the lines between them.
The challenge isn’t simply who owns the technology.
It’s who owns the decisions surrounding it.
From Assistance to Autonomy
AI is moving beyond providing information and recommendations.
Agentic AI can increasingly take action—initiating workflows, updating records, communicating with customers and executing operational tasks.
That changes the questions leaders must ask:
Can AI do this?
Should AI do this?
How much autonomy should it have?
When must a human intervene?
Who is accountable when something goes wrong?
I believe organizations should think about AI as a continuum of autonomy:
Assist: AI recommends. A person decides.
Act with Approval: AI prepares or initiates. A person authorizes.
Act Within Guardrails: AI operates independently within defined policies and permissions.
Operate Autonomously: AI makes and executes certain decisions within established boundaries.
The goal shouldn’t be maximum autonomy.
The goal should be appropriate autonomy.
The Roles Are Converging
The CIO is increasingly responsible for connecting technology to business operations, processes, and outcomes.
The CTO must connect emerging technology and innovation to measurable business value—not simply what technology can do.
The CISO must look beyond traditional cybersecurity and help the organization understand AI-related security, data, access, third-party and business risks.
And increasingly, these responsibilities overlap.
Consider an AI system capable of executing a business process.
The CTO may determine what is technically possible.
The CIO may determine how it integrates with systems and operations.
The CISO may evaluate security and risk.
Legal, HR, finance and operations may also have a role.
But ultimately, someone must decide:
AI Will Expose Weak Processes
There’s another issue organizations may underestimate.
AI will expose weak business processes.
Many organizations still rely on institutional knowledge, informal approvals and undocumented exceptions.
People can navigate those ambiguities.
AI can’t reliably automate a process that hasn’t been clearly defined.
Before organizations automate, they may need to document and improve the process itself.
That’s not an AI problem.
It’s an operating-model problem that AI makes visible.
Five Questions Leaders Should Be Asking
1. Where is AI already influencing decisions in our organization?
2. Which decisions should always require human judgment?
3. Are our processes defined well enough for greater AI autonomy?
4. Who owns the technology, cybersecurity, and business risks when AI acts?
5. Are we measuring AI by implementations, or by measurable business outcomes?
These questions are ultimately about more than AI.
They’re about leadership.
My Perspective
Having spent decades across CIO, CTO, cybersecurity and technology leadership roles, I see AI as an enormous opportunity for technology executives.
But it also raises the bar.
The leaders who will be most valuable are those who can connect technology, business strategy, operations, cybersecurity, risk, and people.
The strategy shouldn’t be:
“Let’s deploy AI everywhere.”
It should be:
“Let’s identify where AI creates meaningful business value and establish the governance, security and human oversight necessary to use it responsibly.”
That’s the difference between AI adoption and AI transformation.
The Leadership Question Has Changed
As AI becomes more autonomous, the roles of the CIO, CTO and CISO will continue to evolve—and increasingly intersect.
The organizations that navigate this successfully will need clarity around:
Who decides.
Who oversees.
Who challenges.
Who remains accountable.
Because as AI becomes more autonomous, human accountability becomes more important, not less.
What do you think?
Are the roles of the CIO, CTO and CISO becoming more distinct, or are the lines between them beginning to disappear?
When those lines overlap, who owns the decision?
I welcome your perspective.
