Beyond the DPO Model? The EU AI Act’s Accountability Framework Without a Mandated AI Officer

The EU AI Act presents an institutional puzzle. Although it imposes extensive obligations on providers of high-risk AI systems and requires such systems to be subject to human oversight, it does not create a designated governance function comparable to the Data Protection Officer (DPO) mandated under the GDPR in specified circumstances. Examining this difference through an organisational lens, the article argues that both regimes combine entity-level accountability with internal compliance requirements; their central institutional difference lies in whether the law also mandates a designated cross-cutting governance function. The GDPR does so through the DPO, whereas Article 17 of the AI Act requires providers’ quality management systems to include an accountability framework setting out the responsibilities of management and other staff but leaves providers to determine how those responsibilities are coordinated internally. Drawing on comparative legal analysis, including consideration of the Digital Omnibus on AI, the article identifies proportionality, organisational flexibility and reliance on existing sectoral governance arrangements as possible explanations for this difference. An illustrative examination of corporate practices further shows how some organisations use AI officers, ethics committees and embedded review processes to coordinate distributed compliance responsibilities even where no such coordinating function is legally mandated.