Lesson · 8 min · Stage 1
Building a governance program
Learning goal: Start and grow a program with clear decision rights.
For reference purposes only. Not legal advice.
Draft: not yet fact-checked or legally reviewed
Key points
- Start with one accountable owner, a short policy and a register of systems.
- A RACI matrix makes decision rights explicit. Every activity needs exactly one Accountable person.
- Separate the charter (what and why) from the operating model (how).
- Four clusters of work: executive oversight, model ownership, audit and compliance, and operational support.
- Propose changes to a steering group as findings, implications, recommended change and rationale.
Who this is for: anyone new to the topic. Related stage: Set up governance.
Start small, then grow
A new program does not need a large committee. It needs a named owner, a short policy people can follow, and a list of the AI systems already in use. Grow from there as risk and scale grow (see the lifecycle).
RACI: who decides, who does
A RACI matrix assigns four roles to each activity:
- Responsible: does the work. More than one person can be Responsible.
- Accountable: answers for the result, holds final approval and veto. There must be exactly one.
- Consulted: gives input before a decision.
- Informed: is told afterwards.
Three common mistakes: no Accountable person (nobody owns production monitoring, so blame moves between teams); two Accountable people for one approval (deadlock); and “Consulted” on everything (legal must review every tiny prompt tweak, so engineering stalls).
Four clusters of work
Governance work falls into four clusters, along two axes: strategy vs day-to-day, and business accountability vs independent assurance.
| Focus | Business accountability | Independent assurance |
|---|---|---|
| High-level strategy | Executive oversight: steering group, risk appetite, principles | Audit and compliance: legal, privacy, security, risk, internal audit |
| Day-to-day work | Model ownership: product lead accountable for a model’s performance, value and impact | Operational support: data science, ML operations, engineering |
Charter and operating model
The charter states purpose, authority, scope, targets, meeting rhythm, quorum and escalation. The operating model says how work flows: teams, decision levels, tooling. Changing a target is a charter amendment. Changing who approves low-risk exceptions is an operating model adjustment.
Taking a change to the steering group
Use four parts: Findings (facts from the data, for example “remediation has slowed 40% this quarter”); Implications (the risk or business impact); Recommended change (and whether it is a charter amendment or an operating model adjustment); Rationale (why this change solves the problem, for example freeing the group’s time for high-risk deployments).
What to do now
- Download the AI use policy template.
- Check each activity in your RACI for exactly one Accountable person.
- Write one page: your charter in five lines.
Sources
- Supplied governance study notes (module 1)
Reviewed 2 Oct 2026. Sources: NIST AI Risk Management Framework; ISO/IEC 42001 standard page.
Terms used: Accountability, Operating model, RACI.
Part of: Leaders path.
Was this page useful? Tell us what is missing or wrong ↗ · Report a correction