Enter once, for the organisation as a whole when your organisation letter is E or A (this area has no Baseline controls). Go as deep as your organisation letter, and implement in your mode.
Why it exists
Give AI a single body that oversees it across the whole organisation. AI decisions cut across functions — a hiring tool is simultaneously a technology choice, a legal exposure, a privacy question, and a workforce matter — and decisions that cut across functions, taken inside any single function, are decided with blind spots. The committee exists to remove them. If your organisation is small and has no board or committee culture, do not fabricate one: a defined escalation path to the owner-manager fulfils this dimension, and pretending otherwise produces theatre, not oversight. That exemption is deliberate and applies only while you remain small.
What to actually do
Compose the committee across functions — and do not forget HR and the data-protection officer. Bring together technology, security, legal, privacy, human resources, the business, and whoever leads AI. Teams reliably invite the security chief and the lawyers and just as reliably overlook HR and the data-protection officer — yet hiring, workforce decisions, and the processing of personal data are precisely where AI most often touches people directly, and where this framework concentrates its highest risk classification. A committee missing those two seats has its blind spots exactly where the danger is.
Put workforce impact on the committee’s standing agenda. Wherever AI touches employees or job applicants — hiring, evaluation, task allocation, monitoring — the committee, with HR, owns the question of whether that use is fair, non-discriminatory, and compatible with your obligations as an employer. Do not leave this to the team deploying the tool; the team deploying the tool is measuring convenience, not fairness.
Track your dependence on providers, not only your deployments. Concentration on a single AI provider is a strategic risk that belongs at this table: if that provider fails, changes terms, or withdraws a model, every dependent process fails with it. Require the committee to know, at all times, which capabilities rest on a single supplier and what the exit would cost — and connect this to the exit disciplines set out in the Sourcing dimension.
Give the committee the go-live authority for high-risk systems. The committee — not the deploying team, not procurement — authorises or blocks the launch of high-risk AI, on the basis of the risk that remains after mitigations. Authority without a gate is advice; make the committee a gate.
Controls
Enhanced5 controls
Control 15
Establish the committee with a written mandate.
EnhancedPreventiveall rolesthe whole organisation
What it is
The mandate states its authority — including the go-live gate — its composition, and its scope.
How to implement it · Minimum structure
Purpose and scope: all AI use across the organisation
Authority: go-live gate for high-risk systems, with power to block or suspend
Composition: technology, security, legal, privacy, HR, the business, the AI lead; named chair
Reporting line and frequency of reports to the board
Approval by the board and annual review of the mandate
How to start
Draft a two-page mandate with these sections and have the board, or the highest available authority, approve it.
Evidence
The approved mandate and its version history.
Mode: light / standard / full
light
No committee is constituted; a written escalation path to the owner-manager replaces it, and the owner-manager signs each go-live for a person-affecting use.
standard
A compact committee of existing managers works under the mandate and reports to management.
full
A formal committee with a secretariat, terms of reference approved by the board, and regular reporting to it.
Control 16
Set a meeting rhythm and keep it.
EnhancedPreventiveall rolesthe whole organisation
What it is
A committee that meets when convenient governs nothing; the rhythm is fixed and attendance is tracked.
How to implement it · Minimum rules
Fixed frequency set in the mandate (e.g. monthly or quarterly), with dates published for the year
Extraordinary meeting route for urgent go-live decisions or incidents
Agenda sent in advance; minutes with decisions and actions issued within a set period (e.g. one week)
Attendance recorded per seat, with named substitutes
Cancelled meetings and repeated absences reported to the chair and the board
How to start
Publish the meeting calendar for the next 12 months and send the invitations now.
Evidence
The calendar, minutes and attendance records.
Mode: light / standard / full
light
No committee is constituted; the owner-manager reviews AI matters at a fixed point in an existing management meeting and notes the decisions.
standard
The committee meets on a fixed cycle, with a rotating secretary taking minutes and attendance.
full
A secretariat runs the calendar, minutes, action tracking and attendance reporting to the board.
Control 17
Keep the composition multidisciplinary, including HR and the data-protection officer.
EnhancedPreventiveall rolesthe whole organisation
What it is
Absences in those two seats are treated as gaps to close, not as scheduling accidents.
How to implement it · Minimum content
Seats: technology, security, legal, privacy (the data-protection officer), HR, the business, the AI lead
For each seat: named holder and named deputy
Attendance per seat at each meeting
Gap log: any HR or data-protection officer absence recorded with an action and date to close it
Annual review of composition against the systems the committee oversees
How to start
Check the current membership against the seat list and invite HR and the data-protection officer, with deputies, if either seat is empty.
Evidence
The membership list with deputies, attendance records and the gap log.
Mode: light / standard / full
light
No committee is constituted; the owner-manager consults whoever handles HR and data protection, internal or external, before each person-affecting go-live.
standard
Each seat is held by an existing manager, with deputies named and absences followed up by the chair.
full
Seats are formally assigned in the mandate, attendance is reported to the board and persistent gaps are escalated.
Control 18
Review the workforce impact of any AI affecting employees or applicants.
EnhancedPreventiveall rolesthe whole organisation
What it is
A standing review, owned jointly with HR, before such systems launch and periodically after.
How to implement it · Steps
Trigger: any AI used to hire, evaluate, allocate tasks to or monitor employees or applicants
Describe the use, the decisions it influences and who is affected
Assess fairness, risk of discrimination, proportionality of any monitoring and fit with employer obligations
Conclude jointly with HR: approve, approve with conditions, or reject, before launch
Re-review periodically (e.g. annually) and on any change of use
How to start
List every AI that touches employees or applicants, including features inside HR software, and schedule the first review with HR.
Evidence
The workforce-impact review records and their conclusions.
Mode: light / standard / full
light
No committee is constituted; the owner-manager and whoever handles HR complete a short checklist before launch and once a year.
standard
The committee runs the review with the HR manager and records the conclusion in its minutes.
full
A structured review led jointly by the committee and HR, with input from employee representatives where they exist.
Control 19
Track provider concentration and exit readiness.
EnhancedDetectiveall rolesthe whole organisation
What it is
The committee maintains a current view of single-supplier dependencies and their exit cost.
How to implement it · Minimum content
Capability or process, and the provider or providers it depends on
Single-supplier flag
Impact if the provider fails, changes terms or withdraws a model
Exit option (alternative provider, in-house, manual fallback) with estimated time and cost
Contract exit terms: notice period, data return, portability
Review date; the view is presented to the committee at least quarterly
How to start
From the inventory, list each AI provider and count how many processes depend on it alone.
Evidence
The concentration and exit-readiness view and the minutes where it was reviewed.
Mode: light / standard / full
light
No committee is constituted; the named owner keeps a short provider list with a manual fallback noted for each critical process.
standard
Procurement and the AI lead maintain the view and present it to the committee.
full
The view is part of third-party risk management, with exit plans tested for the most critical dependencies.
Advanced1 controls
Control 20
Maintain a regulatory watch.
AdvancedDetectiveall rolesthe whole organisation
What it is
The committee tracks the AI rules applicable in every jurisdiction where you operate, and turns changes into actions.
How to implement it · Minimum content
Jurisdictions where the organisation operates or where its AI reaches people
Sources per jurisdiction: official journals, regulator publications, sector associations, legal advisers
Per rule: what it requires, when it applies, which systems it affects (linked to the applicability map)
For each change: action, owner, deadline and status
Cadence: monthly scan, quarterly summary to the committee
How to start
List the jurisdictions you operate in and assign one named person to check the official sources monthly.
Evidence
The source-linked regulatory tracker and the actions raised from it.
Mode: light / standard / full
light
No committee is constituted; the named owner keeps the watch and the applicability map, possibly through a commissioned update service.
standard
Legal or compliance keeps the tracker and reports changes to the committee.
full
A dedicated regulatory function maintains the tracker across jurisdictions, with change actions tracked to closure.
Evidence
The mandate; minutes and attendance; workforce-impact reviews; the concentration and exit-readiness view; decision and action logs; go-live authorisations and refusals. The applicability map per system (Domain 10, Dimension 3). A maintained, source-linked regulatory tracker is an acceptable means of operating the regulatory watch.
Light mode
How a small organisation meets it.
The named owner keeps the applicability map and the regulatory watch; no committee is constituted, and the owner-manager signs each go-live decision for a person-affecting use.