The AI committee, and what gives it teeth

Most firms in this sector now have an AI committee. Most of those committees are briefing forums that receive updates and approve nothing. The difference between the two is not seniority or agenda quality. It is whether anything in the organisation cannot happen without the committee's decision.

The four things that give a committee teeth

A gate. At least one decision must require its approval before work can proceed. Go-live for high-risk systems is the natural one. If every system can go live without touching the committee, it is an audience.

A budget or resource lever. A committee that can require testing to be done, and can direct the resource to do it, can act. One that can only recommend produces minutes that record concerns nobody acted on, which is a worse record than no minutes.

A standing register review. The committee that reviews the AI register every meeting is the only body positioned to notice that a system has been live for two quarters without its promised bias test, or that eleven entries have the same business owner who left in March.

A reporting line that reaches the board. Not for status, but so that an accepted residual risk is accepted somewhere with the authority to accept it.

Composition follows the decisions

The membership question answers itself once the decision list exists. Go-live approval for a high-risk system needs someone who can speak for the business, someone who can speak to the testing evidence, legal or data protection on disclosure and impact assessment, risk on the residual position, and independent review. Anyone not needed for a decision is there to be informed, and can be informed by the minutes.

One structural point for supervised Swiss firms: FINMA's expectation of independent review separate from the developing unit means the committee cannot be composed entirely of the people who built the systems. A committee chaired by the head of data science, attended by the data science leadership, reviewing data science deliverables, does not meet that expectation however competent it is.

What a committee should actually look at

Three standing items produce most of the value.

Classification decisions taken since the last meeting, with the reasoning, not just the outcome. The reasoning is what gets challenged, and the committee is the body that can say the reasoning is too thin before a regulator does.

Conditions attached to previous approvals, by status. Overdue conditions are the single best leading indicator of a programme losing control, and they are invisible unless someone reports them.

Incidents and near misses, including events judged not reportable with the reasoning. The not-reportable decisions are more informative than the reportable ones, because that is where the judgement was exercised and where a pattern of shading the judgement would show.

Add one periodic item: the aggregate position. US interagency model risk guidance now expects firms to consider aggregate model risk across the estate rather than model by model, and that view has no natural owner below the committee.

Minutes are an artefact, not a record of attendance

Committee minutes in an AI programme are evidence. They will be read by an auditor, possibly by a supervisor, and in a dispute by someone hostile. Minutes that record a decision, the residual risk accepted, who accepted it and on what basis are worth having. Minutes that record that a paper was presented and noted are worth nothing and, in the case of a concern that was raised and not acted on, worse than nothing.

Record dissent. A committee where the data protection officer objected and was overruled, with the reasoning on both sides in the minute, is a functioning governance body. One where objections are resolved in the corridor before the meeting produces clean minutes and no evidence of challenge.

Worked example: a committee with no gate

A bank's AI committee meets monthly, chaired by the COO, with strong attendance. Over eighteen months it reviews a strategy, approves a policy, receives quarterly dashboards, and discusses the AI Act timeline four times.

Internal audit then asks a single question: name a system that did not go live, or went live later, because of this committee. There is none. Every system in the register went live on the date the business set, and the committee saw most of them after launch.

Audit's finding is not that the committee is ineffective at oversight. It is that the committee does not perform oversight at all, because no decision was ever routed to it. The paper trail is worse than absence: eighteen months of minutes evidence a body that was informed of everything and prevented nothing, which is the record a supervisor would read as a governance failure rather than a gap.

The remedy is one line in the policy: no system classified high-risk under any applicable regime goes live without committee approval, recorded with the residual risk accepted and by whom. Everything else about the committee stays the same. The line is what converts it into a control.

As of 24 September 2026.