Role drift is the shift in legal or operational responsibility that can happen when an AI system is modified, repurposed, integrated, or handed to another party. A model may start as one organization’s product, then become another team’s component, service, or operational tool. When that happens, the expected duties for security, compliance, support, and incident response can move without the documentation being updated.
In cyber security, role drift matters because unclear ownership creates gaps: no one knows who patches the system, reviews logs, approves changes, or responds to abuse. Attackers and misuse often benefit from that confusion, especially in shared supply chains and outsourced deployments. Defenders reduce the risk with strict change management, asset inventories, written responsibilities, access control, and updated contracts or runbooks that match the current architecture. The goal is to keep accountability aligned with the system’s real use, not its original design.