Most guides to setting up an AI council describe a committee for a bank or a hospital system: a dozen members, an ethics board and a quarterly report to the board of directors. A company of 200 people can't staff that, and doesn't need to. What it needs is a handful of leaders who can say yes or no to AI requests, name an owner for anything others rely on, and meet often enough that people stop working around them. A council that only advises does the opposite. Requests queue up, staff use their own tools in the meantime, and the council ends up governing a list that's months out of date.
What is an AI council?
An AI council is a small group of leaders who decide how the company uses AI (which tools are approved, which uses need extra checks, what can be spent and who owns each AI system others rely on) and who meet on a fixed rhythm to keep those decisions current. It goes by other names: an AI governance committee, an AI steering committee, an AI committee or an AI governance council. They describe the same job.
This guide is for the leaders setting one up in a company of 20 to 1,000 people: COOs, CEOs, HR and People leads, IT and security leads, and partners in law and accounting firms. It covers when you need one, who sits on it, what it decides, how often it meets, why councils stall, and a charter you can copy. It isn't legal advice.
Do you need an AI council?
You need an AI council once more than one team relies on AI and nobody can say who decides which AI tools and uses are allowed. In most companies that point arrives early. People start using AI on their own long before anyone approves it, and our guide to shadow AI covers why.
Large companies have mostly answered this already. In a Conference Board survey of 130 senior governance, sustainability and citizenship executives, run from January to March 2026, 52% of respondents said their company coordinates AI through a "centralized enterprise-wide AI council, steering committee, or equivalent". Another 29% coordinate across functions without one central body, 7% leave AI to each function or business unit, and 12% have no formal coordination. The respondents skew toward larger, mostly US companies, so treat it as a picture of where big companies are, not a benchmark for yours.
Size changes the shape, not the need:
| Company size | What works |
|---|---|
| Under 50 people | No separate council. AI becomes a standing item on the leadership meeting you already hold, with one named person running AI day to day. |
| 50 to 250 people | A council of five or six leaders. It meets monthly for 90 days, then quarterly. |
| 250 to 1,000 people | A council of seven or eight, plus a named AI lead in each business unit who brings requests to it. |
What every size needs is the decisions a council makes, written down and owned by someone. A 30-person firm that has approved tools, a data rule, a spending limit and a named owner for its one shared AI workflow is better governed than a 600-person company with a council that hasn't decided anything.
AI council, AI governance committee or AI steering committee?
The names are used for the same thing, and you can call yours whatever fits your company's habits. The real difference is in what the group is allowed to do.
| Advisory council | Deciding council | |
|---|---|---|
| What it produces | Recommendations and principles | Approvals, refusals, limits and named owners |
| Who acts on it | Someone else, later | The council, at the meeting |
| Budget | None of its own | A spending limit it controls, within the company's |
| What happens to a request | Joins a queue | Gets an answer by a set date |
| Typical outcome | Staff work around it | Staff bring requests to it |
Name it whatever you like. Make it the second kind.
Who should be on an AI governance committee?
An AI governance committee needs one leader who can commit budget as its chair, the person who runs AI day to day, and the leaders who own the risks AI touches: IT and security, legal or compliance, HR, and the busiest business units. About six seats are enough at 200 people.
Where the companies in the Conference Board survey have an enterprise-wide AI body, it most often includes technology leaders (88% of respondents), legal and compliance (84%) and business units (73%). Sustainability (19%) and corporate citizenship (8%) are rarely there. The US federal government's version is more formal. A White House memo from April 2025, M-25-21, told the largest federal agencies, those covered by the Chief Financial Officers Act, to convene an AI governance board within 90 days, chaired at deputy-secretary level with the agency's chief AI officer as vice-chair, and with representatives for IT, cybersecurity, data, budget, legal counsel, privacy and civil rights. Strip out the titles and the pattern is the one that works at 200 people: a senior chair, the AI lead as deputy, and every function that carries a risk.
| Seat | Why it's there | At 30 people | At 200 | At 1,000 |
|---|---|---|---|---|
| Chair: COO, CEO or managing partner | Commits budget and breaks ties | ✓ | ✓ | ✓ |
| AI lead (runs AI day to day) | Brings requests, keeps the AI list, answers between meetings | ✓ | ✓ | ✓ |
| IT and security | Approved tools, sign-in, data access | ✓ | ✓ | ✓ |
| Legal or compliance | Laws, contracts, vendor terms, client confidentiality | Outside counsel as needed | ✓ | ✓ |
| HR or People | Hiring tools, training, how jobs change | ✓ | ✓ | |
| Business-unit leaders | Where the work and the requests come from | One | Two | |
| Finance | Spending limits and the case for builds | When spending is on the agenda | When spending is on the agenda | ✓ |
Three rules keep the membership honest:
- Keep it small. Every extra seat slows the decisions down. Bring experts in for a single item rather than adding a seat.
- Put users on it. A council made only of IT, legal and security will approve little and learn less. The business-unit seats are where the requests come from.
- Give every member a backup. Councils stall when one member is away and their part of a decision waits for them.
What does an AI council decide?
An AI council decides the few things that affect more than one person or carry real risk: which tools are approved, what data can go into them, what can be spent, which shared or high-stakes uses go ahead, and who owns each one. Everything else stays with the teams.
The council's decisions:
- Approved tools. Which AI tools and plans staff can use, and on what terms. Approve a few good tools on company plans rather than banning the rest.
- The data map. Which kinds of data may go into which tools: client data, personal data, health information, financial records.
- Spending limits. A ceiling for AI spending, a small budget for experiments, and who can approve what below the ceiling.
- Shared and high-stakes uses. Anything others will rely on (a shared assistant, an automated workflow, an agent with access to company systems) and anything that affects decisions about people, money or clients.
- Owners. A named owner and a backup for every shared or high-stakes use, with a date to review it.
- Incidents and exceptions. What happens when something goes wrong, and when a rule can be broken.
- Retirements. Switching off tools and uses that no longer earn their place.
What it leaves to teams: personal, low-stakes use of approved tools within the rules. A marketing lead drafting a post in the company's approved assistant doesn't need the council's permission. If every prompt needs a sign-off, people will stop asking.
These map closely onto the Govern function of the NIST AI Risk Management Framework, the free framework from the US National Institute of Standards and Technology. It calls for "roles and responsibilities and lines of communication" to be "documented and are clear to individuals and teams throughout the organization" (GOVERN 2.1), for "executive leadership" to take "responsibility for decisions about risks associated with AI system development and deployment" (GOVERN 2.3), for "mechanisms" to "inventory AI systems" (GOVERN 1.6), and for processes for "decommissioning and phasing out AI systems safely" (GOVERN 1.7). If a customer or auditor asks how you govern AI, a council with a charter, an AI list and a record of decisions answers most of it. Our AI audit guide covers what they'll check.
How often should an AI council meet?
Monthly for the first 90 days, then quarterly, with one longer review each year. The early meetings set up approved tools, the data map, spending limits and the first owners. After that, the council's job is to check the decisions still hold and to take the bigger requests.
Most requests can't wait three months, so the council needs a front door: one place where anyone can bring a request (a form, an inbox or a channel), and a promise that the AI lead answers within 10 working days. The lead decides what's within the rules the council set and brings the rest to the next meeting, or to the chair if it can't wait.
| Meeting | When | How long | What happens |
|---|---|---|---|
| Setup meetings | Monthly, first 90 days | 60 to 90 minutes | Approve tools, set the data map and spending limits, name the first owners |
| Council | Quarterly | Half a day | Check where time saved by AI went, fund builds, review owners and dates that are due, decide what the front door couldn't |
| Annual review | Yearly | One day | Review the charter, the rules, vendors and the full AI list |
Keep a one-page record of every meeting: what was decided, who owns it and when it'll be reviewed. That record is your evidence when a client, regulator or auditor asks.
Why AI councils stall
Most AI councils that fail don't fail on risk. They fail on time. Requests sit for weeks, staff find their own tools in the meantime, and by the time the council meets, it's approving what's already in use or refusing what people have stopped asking for.
The fix is to separate deciding from owning. A council is a meeting. An owner is a person. Our framework gives every shared or high-stakes use a named owner, a backup who can stop it, and a review date, and keeps the council for the decisions that need several people. Owners and backups, in module 7 of our free course, sets those up, and the three meetings puts the rhythm in your calendar. The other common failure is a council with no list of what's running. Your AI list, in module 3, builds one.
Four signs a council has stalled:
- No date on any decision. Approvals with no review date are never looked at again.
- A queue at the front door. If requests wait longer than the promised 10 working days, staff stop sending them.
- No refusals and no retirements. A council that never says no or switches anything off isn't deciding.
- The same tools in use as before it started. If staff still use personal accounts, the approved tools aren't good enough or nobody knows about them.
AI council charter template
Copy this, replace the brackets and cut what doesn't apply. One page is enough. Read it alongside your AI usage policy: the policy tells staff the rules, and the charter says who makes and changes them.
[Company] AI council charter
Purpose. The AI council decides how [Company] uses AI, so that staff can use it safely and the company gets value from it.
What the council decides. Approved AI tools and plans. Which data may go into which tools. AI spending limits. Whether shared or high-stakes AI uses go ahead. Who owns each shared or high-stakes use, and when it's reviewed. How incidents are handled. Exceptions to these rules. Which tools and uses are retired.
What it leaves to teams. Personal, low-stakes use of approved tools within the AI usage policy.
Members. Chair: [COO / CEO / managing partner]. AI lead: [name], who also runs the front door. Members: [IT and security], [legal or compliance], [HR], [business unit], [business unit]. Each member names a backup. Finance joins when spending is on the agenda.
Meetings. Monthly until [date 90 days from the first meeting], then quarterly, with a full review every [month]. A meeting goes ahead if the chair or the AI lead and half the members are present.
Decisions. By agreement where possible. If not, the chair decides. Every decision is recorded with an owner and a review date.
Front door. Anyone can bring a request to [form / inbox / channel]. The AI lead answers within 10 working days: approved within the rules, refused with a reason, or brought to the council.
Incidents. Anyone who sees AI output or an AI tool causing harm can stop it and must tell [the AI lead / the owner] the same day.
Records. The AI lead keeps the AI list and a one-page record of every meeting for at least [three] years.
Review. The council reviews this charter every [month]. Changes need the chair's approval.
How to set up an AI council in 30 days
01 · Name the chair and the AI lead
Pick a chair from the leadership team who can commit budget, and the person who'll run AI day to day. The lead does most of the work between meetings, so make sure it's in their job description, with the time to match. Our guide to AI enablement covers what that role owns. This produces the two people who will draft everything else.
02 · List what's already running
Before the first meeting, find the AI already in use: the tools staff pay for, the free accounts, and the AI features vendors have switched on inside software you already use. The free Shadow AI Audit covers all three. This produces the list the council will make its first decisions about.
03 · Draft the charter and pick the members
Fill in the charter above. Keep it small (about six seats at 200 people, seven or eight at 1,000) and give every member a backup. This produces a one-page charter the chair can sign.
04 · Hold the first meeting and make three decisions
Approve a short list of tools on company plans, agree the data map, and set a spending limit. Leave principles and values for later. Three real decisions in the first meeting tell staff the council matters. This produces the starting guardrails. Module 2 of our course sets up all six starting guardrails.
05 · Open the front door and tell everyone
Tell staff what's approved, where to bring requests and when they'll hear back. Pair it with an amnesty for tools already in use, so people put them on the list instead of hiding them. This produces the stream of requests the council will work on.
06 · Name owners and put the meetings in the calendar
Give every shared or high-stakes use on the list an owner, a backup and a review date. Book the monthly meetings for 90 days and the first quarterly one. This produces a council that runs on a schedule instead of on someone's memory.
If you want a hand setting it up, our AI governance work starts with the list and the charter, and a consultation turns them into a plan for the first 90 days of AI deployment.
Sources
- Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, National Institute of Standards and Technology, January 2023: the Govern function's categories and subcategories (GOVERN 1.6, 1.7, 2.1 and 2.3) quoted in the section on what a council decides.
- M-25-21: Accelerating Federal Use of AI through Innovation, Governance, and Public Trust, Office of Management and Budget, April 2025: the requirement for CFO Act agencies to convene an AI governance board within 90 days, and its chair, vice-chair and membership.
- From Principles to Practice: Governing AI in the Corporation, The Conference Board, 2026: the survey of 130 executives (January to March 2026) on how companies coordinate AI and who sits on enterprise-wide AI bodies. We read the full report as a PDF copy posted by the Society for Corporate Governance.