Who owns what when AI fails? The GenAI shared responsibility model for AI risk across every use case

Your vendor owns more of your AI security than most teams realise. Existing governance frameworks don't make this obvious, because they're designed for the organisation that builds and controls everything. The GenAI Shared Responsibility Model changes the question: not what does the framework require, but which of those requirements are actually yours.

Most organisations approaching AI governance start with frameworks like ISO 42001 and immediately feel overwhelmed. Designed to cover every AI scenario from consumer applications to self-trained models, these standards apply the most demanding controls to every situation. Teams waste effort on controls that don't apply, miss the ones that do, and leave genuine gaps unaddressed in vendor contracts, precisely because the party actually holding the risk is not always the enterprise.

The root problem: AI security risk is not uniform. It shifts fundamentally based on how your organisation deploys AI. The right question is not "what controls do we need for AI?" It is "which risks are ours, and which belong to the vendor?"

This presentation introduces the GenAI Responsibility Stack, a GenAI Shared Responsibility Model mapping security accountability across five deployment tiers, from Consumer App to Self-trained Model. Colour-coded by who owns each layer (end user, enterprise, or vendor), the model makes accountability visible at a glance. Identify your tier, and the model immediately shows which risks require internal controls and which require third-party contract negotiation, turning a sprawling compliance problem into a targeted, column-specific action plan that practitioners can use directly to shortlist the controls relevant to their deployment.

An opt-in sixth layer extends the model to agentic pipelines, where the enterprise carries full responsibility for goal logic, tool permissions, memory, and agent identity. The session maps agentic risk against both the OWASP Top 10 for LLMs and the newly published OWASP Top 10 for Agentic Applications 2026 (December 2025), introducing Agentic Execution Risks (ASI01 through ASI10): goal hijacking, tool misuse, identity abuse, and cascading failures not addressed by existing LLM frameworks. The shift from LLM to agent is not incremental: a language model produces an answer; an agent takes an action, potentially running for 30-plus hours with non-human identities now outnumbering humans 82 to one in enterprise environments.

The session closes with a practical SSDLC control mapping showing how each development phase must evolve for agentic deployments, covering agent scope definition, tool permission matrices, human approval gates, blast radius analysis, and per-decision causality logging as the APRA CPS 234 compliance hook.

Attendees leave knowing which risks are theirs, which belong to their vendors, and exactly what to do about both.