An AI governance committee works best with a small group: an executive chair, plus security, privacy, legal, data or engineering, procurement and a business owner. Give it a written charter, a regular cadence and clear decision rights. Reuse an existing risk body if you have one.
A model from US federal guidance
OMB memorandum M-25-21, issued 3 April 2025 for federal agencies, is one public example. It directs large agencies to convene an AI governance board chaired at deputy secretary level or equivalent, with the agency Chief AI Officer as vice chair. Representation includes IT, cybersecurity, data, budget, legal counsel, privacy, civil rights and civil liberties, and, where relevant, management, human capital, procurement and the program offices using AI. Agencies may rely on existing governance bodies, and consult outside experts as needed.
You are not bound by that memo, but the seat list is a good checklist for a company.
Suggested seats for a company
- Executive sponsor (chair). Has authority to accept risk. NIST's GOVERN 2.3 says executive leadership takes responsibility for decisions about AI risk.
- Security. Threats, access, vendor security reviews.
- Privacy and legal. Data protection, contracts, regulatory exposure.
- Engineering or data science. Knows how systems actually work.
- Procurement or vendor management. Controls the intake of third-party AI.
- Business owners. Represent the use cases and the value.
- Someone who speaks for affected users, such as support or customer success.
NIST also encourages diverse teams in AI risk decisions (GOVERN 3.1), covering disciplines and experience as well as demographics.
Charter essentials
- Purpose and scope.
- Decision rights: what the committee approves (new high-tier systems, exceptions to policy) and what teams decide themselves.
- Escalation path to the executive team or board.
- Cadence: monthly at first, then quarterly once routine, plus ad hoc for incidents.
- Standing agenda: new systems, incidents, exceptions, metrics.
- Records: decisions, rationale, dates.
Avoid the common traps
Too many seats means no decisions. Too few means blind spots. Aim for six to eight members, with others invited per topic. Do not let it become a bottleneck: low-tier systems should follow a checklist without meeting.
Running the first meeting
Bring the inventory, even if it is rough, and a list of open questions. Agree on the charter, pick the chair, and choose three decisions the group will make in the next month, such as approving the acceptable use policy, setting the tiering rules, and deciding the owner for each system. End with action items that name people and dates. Publish a short note of decisions afterward so teams outside the room know what changed.
Quick check
Can the security steering committee double as the AI committee?
Often yes, if you add privacy, legal and data representation and give it AI on the agenda. Separate it only when volume demands.
Does it need a Chief AI Officer?
Not for most companies. The federal memo requires that role for agencies. Elsewhere, what matters is a named executive accountable for AI risk decisions.
Sources
Last reviewed: 19 October 2026.
