How to set up an AI governance committee without slowing innovation

An AI governance committee that puts every request in the same queue and meets once a month gets a predictable result: people start using AI without asking. The committee that works decides the simple cases fast and spends its time only on what can hurt someone. That design fits a mid-sized company, with the people it already has.

The problem the committee has to solve

AI use inside companies already exists, approved or not. Microsoft and LinkedIn's 2024 Work Trend Index, a survey of 31,000 workers in 31 countries, found that 78% of AI users bring their own tools to work. At small and mid-sized companies, 80%. When governance is slow, that number does not drop. It just leaves your field of view.

So the goal of an AI committee is not to approve projects. It is to offer an official path that is faster than the shortcut, and to save heavy scrutiny for the few cases that deserve it.

Why formalize it now

Three references already shape what AI governance is expected to look like, and none of them requires bureaucracy:

• The NIST AI Risk Management Framework, published in January 2023, organizes risk management into four functions (Govern, Map, Measure, Manage). Govern covers roles, responsibilities and policies. In July 2024 NIST released the generative AI profile (NIST AI 600-1), which lists specific risks such as confabulation, data privacy and information security.
• ISO/IEC 42001:2023 is the AI management system standard. It requires a policy, defined roles, impact assessment and lifecycle control, in the same format as other ISO management standards. We wrote about it in ISO 42001 as a maturity yardstick.
• If you sell into the European Union, parts of the AI Act already apply. After the Digital Omnibus, published in July 2026, obligations for high-risk systems listed in Annex III, such as credit and hiring, moved to December 2, 2027. Postponed, not cancelled.

In Brazil, the AI bill PL 2338/2023 is still awaiting a committee opinion in the Chamber of Deputies, with no vote scheduled. But the model it proposes is risk-based, like the European one and NIST's. A committee that already tiers use by risk will need adjustments, not a rebuild, when the law arrives.

The design: three risk tiers

The committee's most important decision is also the simplest: sort uses into tiers, with written criteria that teams can apply themselves. A version that works for most mid-sized companies:

Tier 1, free use under a rule. Official tool, no customer personal data, no decisions about people, a human reviews the output before it leaves the company. Examples: drafting emails, summarizing public reports, coding help in a repository without secrets. It does not go to the committee. The usage policy is enough.

Tier 2, register and check. Uses internal or personal data, but AI only suggests and a person decides. Examples: suggested replies in customer service, ticket triage, a RAG assistant over internal documents. The team fills in a one-page form, and the data and security owners sign off asynchronously. Short, defined deadline.

Tier 3, full review. AI decides or acts on people or money without case-by-case human review, uses sensitive data, or speaks to customers on the company's behalf. Examples: credit approval, ranking job applicants, an agent that issues refunds, a public chatbot. Here the committee meets, asks for an impact assessment, defines monitoring metrics and names who can switch the system off.

Microsoft uses similar logic at a much larger scale. Its Responsible AI Standard v2, published in 2022, defines "sensitive uses" (consequential impact on legal position or life opportunities such as credit, employment and healthcare; risk of physical or psychological injury; threat to human rights) and requires those cases to be reported to the Office of Responsible AI for additional review. Everything else follows the internal standard.

The public chatbot sits in tier 3 for a concrete reason. In 2024 a Canadian tribunal held Air Canada liable for the fare difference owed to a passenger who followed wrong information from the airline's chatbot. The argument that the chatbot was a separate entity was rejected. What the agent tells the customer, the company told the customer.

Who sits at the table

A legal-only committee becomes a veto. A tech-only committee ignores regulatory risk. Tier 3 decisions mix both with business impact, so the table needs:

• A business owner with decision authority, accountable for the outcome of the use case. Without one, the committee becomes an advisory body.
• Technology or data, to say what is feasible and what monitoring will cost.
• The data protection officer or legal counsel.
• Information security, for access, leakage and prompt injection risks.
• Where it exists, risk or compliance, especially in regulated companies.

A small group, with named alternates. If the meeting depends on one person's calendar to happen, the committee will run late.

Operating rules that prevent bottlenecks

1. A written response deadline per tier. For example: tier 2 answered within five business days; tier 3 with a first response within ten. If the deadline passes with no answer, the request goes up to the executive sponsor instead of sitting still.
2. A short form. Purpose, data used, who decides, what happens if the AI gets it wrong, how to switch it off. If the form runs longer than a page, people will fill it in badly.
3. A single inventory of approved AI uses, with owner, tier and next review date. It is the same list a regulator, an auditor or a large customer will ask for.
4. A decision log. Every approval or refusal with a two-line rationale. Within six months this becomes the internal case law that lets teams classify themselves.
5. Reviews triggered by events, not only by the calendar: a model or vendor change, a change of purpose, an incident, a customer complaint.

A sample week

A services company with around 400 employees receives three requests in the same week.

Marketing wants AI to generate ad variations. Tier 1: official tool, no personal data, human review before publishing. Covered by the policy, no meeting.

Customer service wants an assistant that suggests replies based on the customer's history. Tier 2: personal data is involved, but the agent decides what gets sent. The data owner checks legal basis and retention, security checks the vendor, and approval comes within days.

Finance wants an agent that automatically approves debt renegotiations up to a set amount. Tier 3: an automated decision affecting the customer's interests, which triggers the review right under Article 20 of Brazil's LGPD. The committee asks for documented criteria, an appeal path, a log of every decision and a limited pilot with sampled review. The project is not rejected. It starts smaller and with controls in place.

Signs the committee has become a bottleneck

• The request queue grows every month and average response time goes up.
• Tier 1 requests are reaching the committee because nobody trusts the criteria.
• The committee has never refused or conditioned anything, which suggests it is not really looking.
• You find out about significant AI uses by accident, in a hallway conversation or on a credit card bill.

The first 60 days

1. Weeks 1 and 2: inventory what is already in use, with no penalties. Ask managers and check software invoices.
2. Week 3: write the criteria for the three tiers with examples from your own company, and publish the tier 1 usage policy.
3. Week 4: name members and alternates, set deadlines and the form.
4. Weeks 5 to 8: run real requests, log every decision, and adjust the criteria wherever the same doubt keeps coming up.
5. Day 60: review what got stuck, what went through too fast and what is still missing from the inventory.

Next step

If your company does not have a list of AI uses in production today, the committee starts there, not with its first meeting. Building those criteria and following decisions week by week is what Governance As a Service does. And if your next question is what to record for each model decision, read auditing AI models before the regulator asks.