AI Governance Committee and AI Governance Office

In 2018 Axon, the company best known for the Taser and police body cameras, set up an AI Ethics Board. It recruited serious people: law professors, privacy and civil liberties advocates, and AI researchers. The board was not decoration. In 2019 it advised against putting face recognition on Axon’s body cameras, and the company agreed¹.

In the spring of 2022 the board voted 8 to 4 against even a narrow pilot of drones armed with Tasers. On 2 June, nine days after the school shooting in Uvalde, Texas, Axon announced that it was developing such drones to be stationed in schools. On Sunday 5 June, as criticism mounted, Axon’s chief executive announced that the company was pausing work on the project². The pause came too late to keep the board. On 6 June nine members made their resignations public, writing that the announcement had bypassed the company’s own commitment to consult them³.

Here is the contradiction. Axon had one of the most respected AI ethics bodies in any industry, and at the one moment when its judgment mattered most, it could not stop anything. Its expertise was real. Its authority was not. The board was advisory, so when management disagreed, the only lever left to its members was to walk out.

Axon’s board was an external panel rather than an internal governance committee, but the lesson carries over. What makes a governance body work is not who sits on it. It is what the body is allowed to decide, and what happens when someone disagrees.

The core idea

As The AI Governance Operating Model showed, governance scales when the center keeps what must be consistent and risk decides how far each decision travels. Many organizations run that model through two formal structures with different jobs.

The AI Governance Committee is a cross-functional decision and oversight body. It sets direction, takes the decisions that need several functions with authority in one room, accepts or refuses material risk, and handles what is escalated to it. The AI Governance Office is an operating function. It runs intake, routing, the inventory, standards and training, evidence and follow-up, every working day. Below both sit the business and product teams, who still own outcomes, as AI Roles, Ownership and Accountability established.

Without the committee, hard decisions drift or get made by whoever shouts loudest. Without the office, the committee’s decisions stay on slides. And when the committee becomes the workflow, executives become a queue.

What the committee decides

A committee’s scarcest resource is executive attention. It should spend that attention only where cross-functional or executive judgment is genuinely needed: high-impact AI uses, the acceptance of material risk, enterprise policy, significant exceptions, strategic priorities and serious incidents. It should not see every low-risk request, every model version or every technical detail. That work is real, but it belongs elsewhere.

The Axon board shows the second half of the design. For every type of matter, the charter must say not only whether the committee is involved but how.

Three verbs do most of the work. Where the committee decides, its answer stands unless a higher body overrules it. Where it recommends, someone named takes the decision and must record why if they disagree. Where it is informed, it sees the item in a portfolio report and does not debate it. Axon’s board effectively had only the middle verb, and no rule for what happened when its recommendation was rejected. That is the gap to close: write down the verb, and write down the route a disagreement takes.

A useful test for any agenda item is whether it needs several functions, with authority, at the same table. If it does not, it should be decided before the meeting. Material risk acceptance and its conditions are treated in depth in AI Evaluation and Approval Gates; here the point is only that the committee is where the largest of those calls are made.

Who sits at the table

Membership should follow the organization’s AI risks and decisions, not a standard list. Committees typically draw on the business, technology, data and AI, security, privacy, legal, risk and compliance, and product. A logistics company may need operations at the table; a media group may need its editorial standards lead.

The chair matters more than the headcount. A good chair runs the agenda around decisions rather than status updates, insists that each item ends with a recorded outcome, and has enough authority to settle a disagreement or take it higher. Many committees are chaired by an executive who owns enterprise outcomes, such as the chief operating officer, rather than by the head of a single function whose own proposals will come before it.

The committee also needs built-in challenge. Technology wants to ship, risk wants less exposure, the business wants more value. Those pressures are healthy if the committee makes the trade-off explicit and records who accepted it. Internal audit, as the third line in the Institute of Internal Auditors’ model, stays outside the vote so that it can later give independent assurance on the decisions made⁴.

What the office operates

If the committee is where decisions are made, the office is where governance becomes a routine. It turns policy and decisions into a system that runs on an ordinary Tuesday.

A common design failure is an office that can recommend but cannot coordinate. To run the system it needs documented authority to do five things: request information from any team using AI, route a request to the reviews it needs, keep the inventory, track the conditions attached to approvals, and escalate when a team does not respond. An office that has to ask permission to ask questions is an administrative team, however capable its people are.

Two boundaries keep the office honest. First, it is not the owner of AI systems or their risks; the business owns the outcome and the technical owner owns the system. Second, it is not an advocate. When it prepares a decision for the committee, it assembles the evidence, states whether required reviews are complete and records dissent. The business owner makes the case. An office that lobbies for approval, or for rejection, loses the trust that makes routing work.

Many organizations also have an AI center of excellence, which builds capability: platforms, reusable components, engineering practice. The governance office runs risk, policy and the decision process. Small organizations often combine the two, or place the office inside an existing risk or compliance team, and that can work, as long as someone is named to run intake, routing and follow-up, with written authority to do it.

Where the two meet

The committee and the office meet at one point: the escalation. The office decides which requests stay on a delegated path and which cross an escalation trigger and go up. The routing logic itself belongs to the operating model, and the tiers that feed it are the subject of AI Inventory and Risk Classification. What this chapter adds is the hand-off.

Typical triggers are high impact on customers or employees, material financial exposure, significant autonomy, a regulatory concern, a major policy exception and a serious incident. They must be written precisely enough that two people in the office would route the same request the same way. A trigger that depends on someone’s sense of importance is not a trigger.

The decision paper is where the office earns its keep. A good one fits on two pages: what the system does and for whom, the evidence from reviews, the legal view, the options including a smaller version, the business owner’s recommendation and any dissent. A committee that complains it cannot decide has often been sent forty slides of status instead.

A charter and a decision log for each body

Two structures can overlap badly: both approving, both setting policy, both chasing the same team. A short charter for each one prevents that.

The committee meets when decisions need it, often monthly for portfolio and risk review and quarterly for an enterprise review, with a short-notice route for a serious incident. Meeting more often does not make governance stronger. The office works continuously.

The decision log is the committee’s memory. Each material decision gets an entry: what was decided, the rationale, the risk accepted, the conditions, the accountable owner and a review date. It turns a meeting into a commitment someone can be held to, and it is among the first records an auditor or regulator will ask for. The office keeps the evidence behind each entry.

The standards point the same way. ISO/IEC 42001, the AI management system standard, asks top management to assign and communicate responsibilities and authorities for relevant roles⁵. The NIST AI Risk Management Framework asks that roles and lines of communication be documented and that executive leadership take responsibility for decisions about AI risk⁶. A one-page charter for each body is the simplest way to show both.

Up to the board

Above the committee sits executive leadership and, in many companies, the board. Boards are moving quickly to name where AI oversight sits. Among the 80 Fortune 100 companies EY reviewed, the share disclosing that at least one board committee oversees AI rose from 11 percent in 2024 to 40 percent in 2025. The audit committee is the most common single home, named by 21 percent of all filers; other committees, such as technology or governance, are named by 25 percent⁸. The two add up to more than 40 percent because some companies assign AI oversight to more than one committee, as EY’s own footnote notes.

Naming a board committee is the easy part. A second study measures two different things across the S&P 500. The share of companies disclosing AI as a risk rose from 12 percent in 2023 to 83 percent in 2025. The share of directors with disclosed AI expertise rose only from 1.5 percent in 2021 to 2.7 percent in 2025⁹. Boards will depend on what reaches them. The chain is office, to committee, to executive leadership, to the board or a board committee, and the office is usually the one that consolidates the portfolio, the significant risks, the incidents and the open conditions into a report the board can read. It provides the evidence; it does not take the board’s decisions.

Story: one day in a port operator’s governance office

The following is an illustrative composite, built from patterns common in port and terminal operations rather than from one company. The terminals, people, requests and numbers are invented to show the mechanics.

A container terminal operator runs four terminals and has been using AI for three years. Its AI Governance Committee is chaired by the chief operating officer and meets monthly. Its office has three people, led by a former operations planner, with a written mandate to request information, route reviews, keep the inventory, track conditions and escalate.

At eight, the office lead triages four new requests. A tool that extracts data from customs and shipping documents, an updated berth-planning model and a translation aid for customer emails all stay on the delegated path, with a privacy check on the emails and approval by the business owners. The fourth is different. A terminal manager wants a tool that allocates crane shifts using each operator’s productivity score. Because it allocates work using individual performance data, it crosses a written trigger for employee impact, and counsel’s view is that it would probably be high-risk under Annex III of the EU AI Act. It goes to the committee.

At half past ten, the office learns that the gate team has switched on a new AI feature in the truck-appointment system without registering it. The lead does not need to ask anyone’s permission. She asks the gate manager for a description within five days and notes that, if it does not come, the matter goes to the committee chair.

By noon she has finished the decision paper on the crane-shift tool: what it does, who it affects, the vendor’s evaluation, the pilot data, the legal view, three options, the terminal manager’s recommendation and HR’s written dissent. She does not recommend approval or rejection. She states which reviews are complete and which are not.

At two, the committee meets with five items, all material. On the crane-shift tool it chooses the middle option: a pilot at one terminal, scores used only to balance shifts and never in discipline, the works council consulted before the pilot starts, and a review in ninety days. It refers one other item, a model whose potential financial exposure exceeds its delegated limit, to the executive committee.

At half past four, the lead writes five entries in the decision log, each with its rationale, conditions, owner and review date, and adds them to the quarterly report that goes to the board’s audit committee. Just before she leaves, the gate manager sends the description. Registering turned out to be faster than explaining why he had not.

Nothing on that day was heroic. The committee spent its two hours on decisions that needed it. The office did everything else, and had the authority to do it.

What this means for leaders

Four lessons follow for anyone who sits on, chairs or sponsors these structures.

1. Give each body one verb per matter. Decide, recommend or be informed, written in the charter, with a route for disagreement. An advisory body without that route will be bypassed when it matters most.
2. Give the office a mandate, not a mailbox. Written authority to request, route, record, track and escalate is what separates an operating function from an administrative one.
3. Make the hand-off the product. Precise triggers, a two-page decision paper and a decision log with review dates are where the two bodies succeed or fail.
4. Build the line to the board before the board asks. Decide which committee of the board receives AI reporting and what the office consolidates for it.

Check yourself

1. The AI governance committee should approve every AI system.MythFact
2. An expert advisory board can protect an organization even if its charter gives it no decision rights.MythFact
3. The governance office owns the risks of the AI systems it tracks.MythFact
4. The office can approve low-risk AI if that authority is delegated explicitly.MythFact
5. The more often the committee meets, the stronger governance is.MythFact
6. Board committee oversight of AI among Fortune 100 companies roughly quadrupled between 2024 and 2025.MythFact

Reflection: find the verb

What comes next

The committee decides and the office operates, but the office cannot route what it cannot see. Lifecycle governance starts with two questions: what AI systems do we actually have, and which of them need stronger governance? The next chapter, AI Inventory and Risk Classification, answers both.