AI Ownership Landed on IT. Policy Did Not.

Dutch organisations moved responsibility for AI onto the IT department this year, while the share of organisations whose AI use rests on policy and objectives fell from 27 percent to 19 percent. Ad hoc use rose from 32 to 38 percent. IT now owns something the organisation uses more and decides about less. Here is what an IT manager can settle alone, what needs a business owner, and three artefacts that close the gap.

The reader we have in mind is an IT manager, informatiemanager, IT director or security officer at a Dutch organisation of 250 to 5,000 people, with an ICT partner in place, an internal IT team, or both. We are a specialist AI supplier that works next to those parties. We do not run infrastructure, service desks or networks, and the seam described here is the one we land in on every engagement.

What did the AI-Trendonderzoek 2026 actually find?

Berenschot and Nyenrode Business Universiteit published the AI-Trendonderzoek 2026 on 9 October, under the title eerst strategie, dan pas AI. It surveyed more than 200 respondents at Dutch organisations, and the headline is not a slowdown. Enthusiasm rose: the share reporting a guiding AI vision went from 74 percent to 83 percent, and roughly three quarters now call AI use desirable, against 65 percent a year earlier. Risk en Business reported those figures on 9 October 2026.

Underneath them, two lines move the other way. Ad hoc use climbed from 32 percent to 38 percent. Structural use based on policy and objectives fell from 27 percent to 19 percent. More organisations have a vision, and fewer act on one.

The trade account of the report in Consultancy.nl adds the figure that matters most for an IT function: the share of organisations that had assigned nobody as owner of AI knowledge fell from about 30 percent in 2025 to 10 percent, and that ownership increasingly lands with IT, partly because data quality is not in order and technical skill is needed to keep errors out. The same account puts 37 percent of organisations as offering staff no AI training at all, lists digital security, AI literacy, output correctness, data quality and employee skills as the five biggest challenges, and reports close to 40 percent of respondents in services calling AI use structural against 20 percent in industry. Every figure in this paragraph comes from that single account. We have not read the report itself, which sits behind a reservation form, so we pass these on as reported rather than as something we checked.

Why does AI landing on IT make the policy problem worse?

The report's authors draw the right conclusion and stop one step short of the consequence. Their argument, as ManagementSite summarised it, is that organisations may be treating AI too much as a technology question, when structural use asks for decisions about strategy, governance, data and the design of the organisation. In the Consultancy.nl account linked above the authors go one step further: whoever is responsible for business operations decides whether and where AI is wanted, and the IT department supports that.

We agree with the diagnosis. The operational consequence is harsher than it sounds. If ownership of AI knowledge has consolidated into IT while the decisions that make use structural sit with the business, the only function holding a to-do list has no authority over what is on it. Every request arrives at a desk that can answer how but not whether. That is the stalemate behind a vision figure of 83 percent and a policy figure of 19 percent.

Dutch organisations of this size usually have a role built for exactly this gap: the informatiemanager, who sits between business demand and IT supply and is accountable for neither alone. Where that role still exists it is the right home for the AI file, and the question is whether it has been handed the mandate or only the folder. Where it was cut in an earlier reorganisation, AI tends to land on infrastructure or on security by default, and it inherits their instincts: it becomes a thing to be contained rather than a thing to be aimed. Drawing who holds which row before anything is built is what we call an AI RACI.

Which AI decisions can an IT manager make alone?

The useful move is to stop treating this as one pile. Split every open AI question into two groups and the stalemate turns into a routing problem.

Group one is yours outright, with no business sign-off needed: which AI endpoints are reachable from the corporate network and which identities may call them; what is logged when an AI call is made and how long that log is kept; whether an AI tool enters the standard change process and at which tier; which suppliers sit on the register and what evidence each one files; and the data classification that governs what may be pasted into or indexed by a model.

Group two is not yours, however loudly it is asked for: whether a given process should be automated at all; who is accountable when a wrong output reaches a customer; whether the time a tool frees is reinvested or removed; and which budget line pays for the system after the pilot ends.

Most AI policies fail because they try to settle group two by writing group one. A rule that no confidential data goes into a public chatbot is group one, and an IT function can issue it on a Tuesday. A sentence saying the claims team uses AI for first-line triage is group two, and no technical policy can grant it. When a draft policy keeps stalling in review, check which group the stuck clause belongs to. It is nearly always the second. If you are writing the usage policy itself, our guide to drawing up an AI policy carries the group one text in full.

What does the AI Act require after the July 2026 rewrite?

Coverage of the survey repeats a line that has quietly stopped being accurate: that the AI Act has required a sufficient level of AI literacy since February 2025. That was the original Article 4. Regulation (EU) 2026/1744, the digital omnibus on AI, in force since 27 July 2026, replaced it. Providers and deployers must now take measures to support the development of AI literacy among staff and others operating AI systems on their behalf, and the text states expressly that it does not require them to guarantee any specific level of AI literacy for any individual. Gibson Dunn described the same softening while the omnibus was still a proposal.

For an IT manager this changes the artefact rather than the effort. What you need to be able to show is a record of measures offered, to whom and when, matched to the risk of what those people operate. You do not need a pass mark per employee. That is a different document from the one most organisations are building, and a lower bar than a headline about untrained staff suggests. The same regulation moved the Annex III high-risk obligations to 2 December 2027, which is a deferral and not a repeal: if you are building a high-risk system you have more time, not less work. Our AI Act checklist follows the current text, and AI training for companies is where the measures themselves come from.

Which three artefacts turn ad hoc use into something auditable?

None of these needs a board strategy, and an IT function can produce all three in a fortnight.

First, a use register. One line per AI use, not per tool: the process it touches, a named owner in the business, the data classes involved, the supplier, and the date it was last reviewed. A licence count tells you what was bought. A use register tells you what is being decided, which is the question nobody can currently answer.

Second, a decision record. For every line in the register, which of the two groups the open question belongs to, and the name of the person who holds it. Three columns, one page. Its purpose is to turn the unassigned decisions into a list instead of a feeling.

Third, a measures log for Article 4: what AI literacy was offered, to which roles, on what date, and which parts were compulsory for people whose output reaches a customer. This is the evidence the reworded duty asks for. It is cheap to keep from day one and expensive to reconstruct two years later.

What happens to your supplier list when use is ad hoc?

Ad hoc use at 38 percent is not an abstraction. It means tools that arrived through expense claims, free tiers and personal accounts. Each one is a processor nobody assessed, and in this size band that bites twice: supplier-security duties under the Cyberbeveiligingswet for organisations in scope, and the supplier-relationship controls in an ISO 27001 statement of applicability for anyone certified or working towards it. The register is the artefact that the auditor and the customer questionnaire both ask for. We have written separately about detecting shadow AI and the works council's role and about ISO 42001 sitting next to an existing ISO 27001.

There is a supplier-landscape version of the same problem. When a specialist AI supplier joins an estate your ICT partner already runs, the register is what stops each party assuming the other covered a use. We are that specialist, and the first thing we ask to see is the register, not the architecture.

What we would do in the first thirty days

Week one, build the register out of what you already hold: expense data, SSO and identity logs, and a two-question survey that asks what people use and for which task. Do not start by writing a policy. You cannot write one about a set of uses you have not listed.

Week two, sort every line into group one and group two, settle group one yourself that week, and send group two upward with a name proposed against each item rather than an open question. Week three, stand up the measures log and make one short module compulsory for roles whose output reaches a customer. Week four, send the board a single page: what is in use, who owns each use, and which decisions are still unmade.

That page is the strategy the report asks for, written from the bottom rather than waited for from the top. In our experience it is also the only version that survives contact with a procurement cycle. For the longer view of how Dutch adoption reached this point we pulled five years of Eurostat data on AI use in Dutch firms. If you want help turning a register into a plan, that is what we do for mid-sized organisations.

Last updated 14 October 2026. Figures from the AI-Trendonderzoek 2026 as reported in the Dutch trade press in October 2026; AI Act text as amended by Regulation (EU) 2026/1744, in force 27 July 2026.

Frequently asked questions