AI Risk & Governance Lead

About the Role:

We're looking for a North America AI Risk & Governance Lead to own the substance of AI risk at our organization — what the risk tiers actually mean, what controls are required at each tier, and whether our AI initiatives genuinely comply with law, policy, and contractual obligations, not just process.

This role aligns to the Global AI Risk team as its North America representative — adapting global risk standards and policy for the North America regulatory landscape, and feeding regional risk findings and regulatory developments back to the global team.

This role is also distinct from the AI Governance & Performance Lead, who runs the governance operating cadence (Steering Committee, intake, KPI reporting) day to day. You own the risk framework and policy those processes are built on — the regulatory landscape, the control requirements, and the judgment calls about what's actually acceptable risk. You'll work in close partnership with that role, plus Legal, Privacy, Security, and Compliance.

What You'll Do:

• Serve as the North America representative to the Global AI Risk team, localizing global risk standards and policy for the North America regulatory landscape and feeding regional findings back to the global team
• Design and maintain the AI risk assessment framework and risk-tiering criteria — data sensitivity, model risk, regulatory exposure, and reputational risk
• Monitor the regulatory landscape (EU AI Act, U.S. state AI laws, sector-specific regulations) and translate requirements into internal policy and controls
• Partner with Legal, Privacy, Security, and Compliance to ensure AI use cases meet regulatory, contractual, and internal policy requirements
• Conduct or oversee risk assessments for new and existing AI use cases, with particular focus on higher-risk tiers
• Own AI risk policy documentation — acceptable use policies, model risk management standards, and third-party/vendor AI risk requirements
• Evaluate third-party AI vendors and tools for data handling, IP, and compliance risk before adoption
• Develop and maintain an AI incident response process for model failures, bias findings, or data issues
• Partner with the AI Governance & Performance Lead to ensure risk requirements are embedded in the intake and governance operating cadence, not bolted on after
• Deliver risk training and practical guidance to AI Product Owners, engineers, and business stakeholders
• Maintain an audit-ready risk register and documentation trail across the AI portfolio
• Advise senior leadership on emerging AI risk topics and recommend policy or control changes

Basic Qualifications:

• Bachelor's degree in a relevant field (Law, Risk Management, Business, or related), or equivalent practical experience
• Minimum 5 years in risk management, compliance, legal, privacy, or a related governance field, ideally with AI/ML or data risk exposure
• Working knowledge of AI-related regulation and standards (EU AI Act, NIST AI RMF, ISO 42001, or similar)
• Experience designing or operating risk assessment frameworks in a large, matrixed enterprise
• Strong documentation and policy-writing skills; comfortable producing materials that would hold up to audit or regulatory scrutiny
• Ability to translate legal/regulatory language into practical, actionable guidance for technical and business teams
• Confident enough to push back on stakeholders — including senior ones — who want to move fast past a real risk
• Strong cross-functional collaboration skills, particularly with Legal, Security, and Compliance

Preferred Qualifications:

• Minimum 8 years in risk management, compliance, legal, privacy, or a related governance field, with direct AI/ML risk experience
• JD, advanced degree, or relevant certification (CIPP, CRISC, CISA, or similar)
• Experience with AI-specific governance frameworks and their practical implementation (NIST AI RMF, ISO 42001)
• Prior automotive or manufacturing enterprise risk/compliance experience
• Experience evaluating or negotiating AI vendor contracts from a risk perspective
• Familiarity with model risk management practices in a regulated industry (financial services, healthcare, or similar)

Success in the First 12 Months Looks Like:

• A documented, enforced AI risk framework mapped to the department's risk tiers
• A functioning process for evaluating third-party AI tools and vendors before adoption
• Zero major compliance surprises — issues get caught and addressed before they become incidents
• Trusted advisor relationships with Legal, Security, and Compliance, and with the AI Governance & Performance Lead