How to set up an AI committee with senior leadership

In many companies, the AI committee is born in a predictable way: each area buys a different tool, the team uses AI with no rules and the board of directors starts asking questions. Out of that comes a meeting with too many people and too little agenda. Before setting the first date, choose the owner and write down what the committee decides and what it doesn’t.

Who sits on the committee

The committee needs the people who decide on money, risk and people, not everyone with an interest in the topic. In practice, it fits around a small table, with five to eight people.

• An owner on the executive team: the CEO or a C-level executive with the CEO’s mandate. Breaks ties, takes decisions to the board and is accountable for the results. Without that seat, the committee recommends and no one executes.
• Business areas: the directors of the areas where use cases originate, such as sales, operations and finance. They know where the value is and keep the use running after the pilot.
• Technology: the CIO or CTO, to say what’s feasible with the architecture, data and contracts the company already has.
• Legal and privacy: legal and the data protection officer, because almost every relevant case touches contracts, intellectual property or personal data protected by data protection law (in Brazil, the LGPD).
• Information security: to define what information can leave the company, in which tool and under what control.
• People and HR: because AI changes roles, targets and the way performance is evaluated, and someone needs to plan the training.

The mandate in a few lines

A good mandate fits on half a page and can be read aloud at the first meeting. A text to adapt: "The company’s AI committee exists to:"

• Decide where AI comes in first, with prioritization criteria known to every area.
• Approve and review the AI usage rules, including which data can be used and in which tools.
• Name an owner for each approved use case and track the results.
• Monitor risks and incidents and decide how to handle them.
• Ensure that leadership and teams are trained to use AI with quality.

Also write down what the committee doesn’t do: it doesn’t approve every personal productivity tool, doesn’t review prompts, doesn’t replace the areas’ budgets and doesn’t manage projects. That second list is what keeps the committee from becoming a bottleneck.

How often to meet and how to decide

One meeting a month is usually enough, with biweekly meetings while rules and priorities are being defined. More than that becomes project tracking, which is the areas’ job.

On how to decide, three rules solve most of the problems:

• Every proposal arrives in writing and in advance, on one page: the problem, the proposed use, the data, the risk and the owner.
• The committee hears the areas, and the owner decides when there’s no consensus.
• What can’t wait goes through an asynchronous path, with a set response time.

The standing agenda

A short agenda that’s always the same keeps the meeting predictable and exposes what’s stuck:

1. Pending decisions and missed deadlines.
2. New use cases, assessed against the prioritization criteria.
3. Progress on the approved portfolio: what delivered results, what stalled and why.
4. Risks and incidents in the period, and what was done.
5. Adjustments to the usage rules.
6. Training: who already uses AI at work and where the gaps are.

Always close with the list of decisions made, who carries them out and by when. If the minutes don’t fit on one screen, the meeting discussed too much and decided too little.

How to prioritize use cases

AI priorities are decided with the criteria of any investment, plus two that are often forgotten: data and an owner. Assess each proposal on five points:

• Value: which decision, cost, revenue or deadline changes, and for whom.
• Feasibility: whether it can be done with the tools and contracts that already exist, or requires integration and a new purchase.
• Data: whether the data needed exists, is accessible and is reliable. A use case without data is just an intention.
• Risk: what happens if AI gets it wrong, who notices the mistake and whether personal or sensitive data is involved.
• Owner: whether there’s an area executive who answers for the use after the pilot. No owner, no approval.

An example: the same meeting receives a proposal to summarize supplier contracts for the procurement team and another to use AI to pre-approve customer credit. The first has clear value, available data, manageable risk and a procurement director who wants to own it. The second may be worth more, but it involves decisions about people and sensitive data. The first goes ahead now. The second comes back with a risk analysis and a design for human review.

With the same budget, whoever chooses where to bet gets further than whoever spreads pilots across every area.

The difference isn’t the investment. It’s the direction.

How to use the NIST AI RMF and ISO/IEC 42001

The committee doesn’t need to invent a governance structure. The NIST AI Risk Management Framework divides AI risk management into four functions, and each one becomes a concrete responsibility:

• Govern: the mandate, roles, usage policy and responsibilities. It’s the committee itself at work.
• Map: an inventory of AI uses, the context of each one, who is affected and what data goes in.
• Measure: how to assess the quality, errors and risks of each use, before and after it goes into operation.
• Manage: prioritize the risks, decide how to treat them, respond to incidents and revisit what didn’t work.

For generative AI, the same page has the NIST AI 600-1 profile, published in July 2024.

ISO/IEC 42001 is the path for companies that need to demonstrate governance to clients, auditors or regulators. It sets requirements for an AI management system, applies to organizations that provide or use AI and allows certification. A sensible order is to organize the work around NIST and move to ISO when there’s external demand.

How to keep the committee from turning into bureaucracy

An AI committee fails when everything has to go through it. Use doesn’t stop: it goes underground, as happens when the team uses AI in secret.

• Risk tiers: low-risk uses, such as drafting an email without sensitive data or summarizing a public document, are cleared by the policy. Only what involves sensitive data, decisions about people, clients or integration with systems goes up to the committee.
• A decision deadline: every proposal gets an answer within a set time. The committee’s silence can’t work as a veto.
• Rules, not cases: the committee approves the generative AI use policy and the criteria for data security when using AI, not every prompt.

In Almai’s view, training starts with the people at that table. Someone who has never drafted a memo or analyzed a spreadsheet with AI tends to decide out of fear or out of enthusiasm, and both are expensive. That’s why the AI-First Executive Journey works on AI in the board’s routine and decisions before reaching priorities and governance, a topic the Advanced Modules go deeper into.

The first meetings, in order

In a large company, AI governance starts in the first meetings, which determine whether the committee will decide or just observe. A sequence that works:

1. Before anything else: the CEO names the owner, defines the members and approves the mandate in writing.
2. First meeting: present the mandate and the routine, and commission an inventory of the AI the company already uses, including informal use.
3. Second meeting: approve the first version of the usage policy and the risk tiers, with legal and security.
4. Third meeting: apply the criteria to the inventory and the areas’ proposals and approve a short portfolio, with an owner and a deadline for each case.
5. Fourth meeting: define how each case will be measured and approve the training plan, starting with the board itself.
6. From then on: a regular routine, with a bigger review of priorities and rules every quarter.