Security/compliance have the external hammer: if they fail, your org will have to pay fines and someone may end up being criminally liable (depends on country).

The ethics department; if they fail, there may be some negative journalism, but who which AI company has positive journalism these days? There's no external hammer for ethics.