Why governance: it is not bureaucracy, it is protection

AI governance is not another document in a drawer. It is the structure that protects your company from 3 concrete risks:

1. Regulatory risk: the AI Act imposes fines of up to EUR 35M. Without governance, you have no evidence of compliance.
2. Reputational risk: algorithmic bias in hiring or a chatbot generating inappropriate content can destroy years of reputation in a single day.
3. Operational risk: shadow AI (uncontrolled usage) means client data flows to external services without your knowledge.

Well-designed governance does not slow down innovation. It enables it. When the team knows what they can and cannot do, they move faster, not slower.

The AI committee: composition and operations

The AI committee is the body that makes AI decisions within the organization. It does not need to meet every week. It needs to exist and have authority.

Recommended composition

• Executive sponsor (CEO or General Manager): provides legitimacy and authority. Does not need to attend every meeting, but must approve key decisions.
• AI lead (CAIO, CTO, or Head of Innovation): chairs the committee, proposes initiatives, reports progress.
• Legal/Compliance: validates that initiatives comply with the AI Act, GDPR and industry regulation.
• HR: change management, training, impact on job roles.
• IT/Security: infrastructure, data security, integrations.
• 1-2 business directors (rotating): ensure AI solves real business problems.

Operations

• Frequency: monthly (biweekly during the launch phase)
• Duration: 60 minutes maximum
• Typical agenda: metrics review (10 min) → new AI requests (20 min) → risks/incidents (15 min) → decisions (15 min)
• Output: minutes with decisions, owners, deadlines. Published internally.

What the committee decides

• Approve new AI tools
• Classify systems by risk level (AI Act)
• Approve AI usage in processes affecting people (HR, credit, healthcare)
• Review AI incidents (hallucinations, bias, data leaks)
• Prioritize AI investments

The CAIO: do you need one?

The Chief AI Officer (CAIO) is the executive role responsible for AI strategy. In 2026, 1 in 4 large companies has one. But not all need one.

You need a CAIO if

• More than 500 employees
• AI is a core part of the business model
• Multiple simultaneous AI projects
• Highly regulated industry (finance, healthcare, legal)

You do NOT need a CAIO (yet) if

• Fewer than 200 employees
• AI is a productivity tool, not core business
• 1-3 active AI projects
• The CTO or Head of Innovation can assume the role part-time

Alternative: part-time "AI Lead"

For SMEs and mid-sized companies: designate a person (typically with a combined technical and business profile) who dedicates 20-30% of their time to coordinating AI strategy. A formal title is not necessary. Authority and dedicated time are.

AI risk framework for executives

As an executive, you need to evaluate 5 risk categories before approving any AI initiative:

1. Data risk

What data does the system process? Is it personal? Sensitive? Where is it stored? Who has access?

Mitigation: data policy, anonymization, enterprise plans, encryption.

2. Regulatory risk

Is the system high-risk under the AI Act? Does it affect decisions about people? Are there sector-specific requirements?

Mitigation: risk classification, impact assessment, registration, documentation.

3. Bias risk

Does the system make or influence decisions that affect people? Could it discriminate by gender, age or origin?

Mitigation: bias audit, diverse training data, human oversight.

4. Operational risk

What happens if the system fails? Is there a plan B? How dependent is the business on this system?

Mitigation: redundancy, human oversight, circuit breakers, contingency plan.

5. Reputational risk

What would happen if a journalist published "Company X uses AI for [what you do]"? Would it be positive or negative?

Mitigation: transparency, proactive communication, ethics by design.

3 policies you need (and how to draft them)

1. AI usage policy

Which tools are approved, what data can be shared, what is prohibited. 2-3 pages. The coverage in module B09 serves as a baseline.

2. Data policy for AI

An extension of your existing data policy: how data is handled when processed by AI. Data classification (public, internal, confidential, sensitive) and which AI tier each level may use.

3. AI Act compliance policy

AI systems inventory, risk classification, responsible parties, compliance timeline. Mandatory for high-risk systems before August 2026.

AI systems registry

The AI Act requires registering high-risk AI systems in the EU database. But even for lower-risk systems, an internal registry is good practice:

Registry template

AI SYSTEMS REGISTRY - [COMPANY]

| # | System | Provider | Department | Data processed | AI Act risk | Owner | Start date |
|---|--------|----------|------------|----------------|-------------|-------|------------|
| 1 | ChatGPT Team | OpenAI | All | Internal, no PII | Minimal | IT Lead | 2026-01 |
| 2 | Claude Team | Anthropic | Legal, Executive | Contracts, reports | Minimal | IT Lead | 2026-03 |
| 3 | HubSpot AI Scoring | HubSpot | Sales | B2B client data | Limited | Sales Dir. | 2026-02 |
| 4 | CV Screener AI | [Vendor] | HR | Candidate CVs | HIGH RISK | HR Dir. | 2026-04 |

This registry gives you instant visibility into what AI your company uses, with what data, and which systems need regulatory attention.

What the board must approve

Not everything goes to the board. But these decisions do:

1. AI strategy: vision, annual budget, ambition (optimize vs transform)
2. High-risk systems: any AI that makes or influences decisions about people
3. Budget above [threshold]: define your threshold (e.g., >EUR 10,000)
4. Serious incidents: data leak via AI, detected bias, failure with client impact
5. AI policy: initial approval and annual reviews

Practical exercise

Puntos clave