AI Governance Committee: How to Set One Up in Australia

An AI governance committee is a small, cross-functional group with a written mandate to decide how your organization uses AI, who is accountable for it and what gets escalated to the board. It only works if it starts from facts. Before it writes rules, it needs an honest map of which AI tools your staff already use and for what. Get that map first, then build the committee around it.

CalibreforumStart AI Governance With VisibilityCalibre Forum’s AI readiness assessment maps employee AI use and delivers a scored report with a clear 90-day action plan.Visit

TL;DR

An AI governance committee defines decision rights, accountability and escalation pathways. It is not a talking shop and not a replacement for the board.
Steering committee, governance board and oversight committee are mostly different names for the same job. Pick the one that fits your size and write a charter.
Membership should cross disciplines: business owners, risk, legal, procurement, IT and data, and people and culture.
Start with visibility. A committee that governs tools it cannot see governs only the tools someone mentions.
Australia relies on voluntary guidance, with the AI6 practices as the practical baseline, so your charter should map to those.

What an AI governance committee actually does
Steering committee, governance board, oversight committee: which name?
Step 1: See your real AI use before you form the committee
Step 2: Choose members who cover the risk
Step 3: Write a charter with decision rights
Step 4: Build one front door for AI use cases
Step 5: Set a meeting rhythm that produces decisions
Step 6: Anchor it to Australian guidance
Step 7: Check whether the oversight is working
Common mistakes to avoid
See your AI use before the first meeting
FAQ
Sources

What an AI governance committee actually does

The Human Technology Institute at UTS describes AI governance structures as the way an organization defines decision-making processes, sets clear lines of responsibility and accountability, and creates reporting and escalation pathways. Dedicated bodies such as AI councils or committees are a common way to put that into practice.

In day-to-day terms the committee:

reviews high-risk AI use cases before they go live;
oversees the policies and practices that support responsible use;
reports on AI use, risks and opportunities to senior executives or the board;
connects AI projects to the strategy and business objectives;
builds trust with staff, customers and other stakeholders through transparency.

That list comes from the same UTS report, and it is a useful test of your own committee. If yours does not do these things, it is a discussion group.

Why not just use the IT risk process?

Many organizations assume the existing IT risk framework will cover AI. The Australian Institute of Company Directors reports that HTI research suggests existing IT risk frameworks are largely unsuited to AI, because of its speed of change, its opacity, the difficulty of testing outputs and the difficulty of identifying where AI is used in the organization and its value chain. The last point matters most for smaller businesses: you cannot assess what you cannot find.

Does a committee make a difference?

The IAPP’s 2025 governance profession report, as cited by UTS HTI, found that organizations with an AI governance committee encountered fewer issues when developing AI systems and fewer challenges in governance reporting. UTS also reports that putting the right disciplines in one forum speeds up capability building and shortens the feedback loop between policy and practice.

Steering committee, governance board, oversight committee: which name?

Readers search all of these terms, and in practice the differences are about emphasis rather than structure.

Name	Typical emphasis	Fits best when
AI steering committee	Direction, priorities, investment decisions	You are still deciding where AI should be used
AI governance board	Formal approvals and accountability	AI is already embedded in customer-facing or high-stakes work
AI oversight committee	Monitoring, review and assurance	Policies exist and you need to check they are followed

These are our working distinctions, not formal categories. What matters is the mandate in the charter, not the label.

Size matters more than name. A business of 30 to 200 people does not need a standing board with sub-committees. A small group that meets on a fixed rhythm, with a named chair and a clear route to the owner or board, can do the whole job. UTS HTI also notes that a dedicated AI governance process can be adopted on a transitional basis and mainstreamed into normal decision-making once AI processes are established and capability has been built. So you can start small and fold it into business as usual later.

Step 1: See your real AI use before you form the committee

The most common failure in a new committee is that it starts with a policy workshop. Members argue about principles while staff keep using whatever tools they signed up to last month: personal chatbot accounts, browser extensions, meeting recorders, AI features switched on inside software you already pay for.

The committee’s first input should be evidence of what is happening. There are a few ways to gather it:

ask each department head what their team uses (fast, but you hear only what managers know);
review software and expense records (finds paid tools, misses free ones);
survey every staff member, anonymously, about the tools and workflows they actually use.

The third gives you the most complete picture, and anonymity is what makes the answers honest. People will not admit to using an unapproved tool if they think it will be traced back to them. Our guide on running an AI staff survey honestly and anonymously covers the design. If you want to understand the risk side first, see shadow AI in the workplace.

This is the problem our AI readiness assessment is built for. It surveys every staff member anonymously, installs no software and collects no individual data, then combines the answers into a scored report with a 90-day action plan. A committee that opens its first meeting with that report has an agenda.

Printed AI readiness report and action plan

Step 2: Choose members who cover the risk

UTS HTI suggests convening business owners, risk, legal, procurement, IT and data, and people and culture in one forum. For a smaller organization, one person often covers more than one of those roles. The point is coverage, not headcount.

A workable seven-person group for a mid-sized business might look like this:

Executive sponsor: a director or owner with authority to approve and to stop.
Chair: accountable for the agenda, decisions and the report upward. This is often the operations or risk lead.
IT or data lead: knows the systems, integrations and access controls.
Legal or compliance contact: may be internal or an external adviser who joins when needed.
Procurement or finance: sees what is being bought and renewed.
People and culture: owns training, policy communication and staff concerns.
Business unit representative: rotates, so the people actually using AI have a voice.

Two cautions. First, do not make the committee all executives; the HTI emphasis on cross-functional composition exists because policy written without the people who use the tools tends to miss how work really happens. Second, name one person as accountable. The National AI Centre’s implementation guidance says organizations should assign, document and clearly communicate who is accountable for the AI management system, including third-party providers and systems, testing, concerns and redress, and continual improvement. Committee accountability without a named individual tends to dissolve.

Step 3: Write a charter with decision rights

UTS HTI finds that dedicated governance bodies tend to have a formal mandate: a written charter that sets out scope, terms of reference, decision rights and escalation pathways. The AICD likewise advises that boards review committee charters to make sure AI issues are covered and use external experts for periodic briefings.

A one-to-two page charter is enough if it answers these questions:

Scope: which AI uses are covered? Include tools built in-house, bought, embedded in other software and used informally by staff.
Decision rights: what can the committee approve alone, what needs the executive sponsor, and what goes to the board?
Thresholds: what makes a use case high-risk (for example, it touches customer personal information, informs decisions about people, or produces content published externally)?
Escalation: who is told, how fast, when something goes wrong?
Reporting: what does the board or owner receive, and how often?
Review: when is the charter itself reconsidered?

The UTS HTI operating model says the board should make sure there is a process and structure to decide how AI is used and governed, including approving high-risk AI systems and use cases and approving AI policies and processes. Your charter should say which of those approvals the committee makes on the board’s behalf.

Pair the charter with a policy

The charter says who decides. The AI policy says what staff may and may not do. They need each other, and both should be short enough to be read. We have written about what an Australian AI policy should include and how to enforce it, and there is a template outline and clauses for small businesses.

Step 4: Build one front door for AI use cases

UTS HTI describes effective bodies as having a single intake and registration process through which every AI use case passes, with risk-based approval thresholds and standardized review. In plain terms: one form, one register, one place to ask.

A lightweight version:

Anyone proposing a new AI tool or use fills in a short form: what it is, what data goes in, who sees the output, who owns it.
The chair triages it as low, medium or high risk against the thresholds in the charter.
Low risk is approved and logged. Medium and high get a fuller review at the next meeting.
Everything approved goes into a register with an owner and a review date.

The operating model also expects the structure to be able to filter out AI investments that are not aligned with strategy or that are legally, ethically or commercially unsound. That is the other half of the intake: it protects the budget as well as the organization.

Vendors need their own scrutiny. Our one-page AI vendor risk checklist gives the committee a consistent set of questions for any supplier, and AI access control covers who should be able to use what.

Step 5: Set a meeting rhythm that produces decisions

A committee that meets without a decision list becomes the kind of bureaucratic bottleneck or theater that critics warn about. A rhythm that suits a mid-sized business:

Monthly for the first three months, while the register is built and the first use cases are reviewed. Keep it to 45 to 60 minutes.
Quarterly after that, with ad hoc sessions for any high-risk request.
A standing agenda: new requests, register changes, incidents and near misses, training status, one item for the board report.
Written minutes recording decisions, owners and dates.

The AICD recommends carefully considering the frequency and nature of management reporting to the board so oversight is timely and informed. For a small business, a one-page quarterly summary to the owner or board is usually enough: tools in use, approvals made, incidents, what changes next.

People are part of the rhythm too. A committee can approve the best policy and still fail if staff do not understand it. Structured learning helps, for example accredited AI training programs that give members and staff a common baseline, and our own notes on what staff need to know about AI security.

Step 6: Anchor it to Australian guidance

Australia has no single AI law that tells a committee what to do. The practical baseline is voluntary. According to the AICD’s 2026 director’s guide, the National AI Centre’s AI6 replaces the earlier Voluntary AI Safety Standard and consolidates its ten guardrails into six practices. It comes in two versions: Foundations for organizations getting started, and Implementation guidance for governance professionals and technical experts. The AICD notes that the guide, like the National AI Centre’s guidance, emphasizes accountability, planning, risk measurement and management, transparency, testing and human control.

The earlier standard’s ten guardrails are still a good checklist of topics for a charter: accountability, risk management, data governance, testing, human control, transparency, contestability, supply-chain transparency, record-keeping and stakeholder engagement. They are set out in the Voluntary AI Safety Standard published in August 2024.

For directors, Standards Australia’s AS ISO/IEC 38507:2022, published on 14 October 2022, adopts the international standard that guides governing body members in enabling and governing the use of AI so that it is effective, efficient and acceptable.

If your organization is a Commonwealth entity, additional mandatory requirements apply under the Digital Transformation Agency’s policy for the responsible use of AI in government. Private businesses should still take notice, because existing laws such as privacy and consumer law apply to AI use regardless of any AI-specific rule. Talk to your lawyer about which obligations bind you. For data handling in particular, see our practical guide to AI data governance.

Step 7: Check whether the oversight is working

Governance does not end at approval. The AICD says governance systems and processes should be regularly reviewed to check whether targets and outcomes are being achieved, and that AI use should align with a broader organizational strategy that is itself reviewed. It also advises an iterative, flexible, human-centered approach, with mechanisms that track and report impacts on consumers, employees, suppliers and contracting parties.

Some measures that make that concrete:

Coverage: share of AI tools in use that appear in the register.
Speed: days from request to decision for low, medium and high-risk items.
Incidents: number and severity of AI-related issues, and how quickly each was closed.
Staff understanding: training completion and what staff say in follow-up surveys.
Drift: tools that appeared since the last review without going through intake.

The coverage and drift measures only work if you re-survey. Usage changes quickly, and a snapshot from six months ago will not show the browser extension someone installed last week. Repeating the survey each quarter gives the committee a trend instead of a single picture. The AI governance checklist for small business is a good companion for those review meetings, and AI risk mitigation and AI model risk management help with the high-risk items.

Common mistakes to avoid

Starting with policy before evidence. You write rules for the tools you imagine, not the ones in use.
No decision rights. The committee can discuss but not approve or stop anything.
Too senior, too slow. If every request waits for a quarterly meeting, staff will route around it.
No register. Without a list of approved uses and owners, nobody can say what the committee covers.
No feedback loop. Staff never hear what was decided, so they stop asking.
Treating it as permanent and static. AI changes fast; review the charter at least annually.

Our view: governance starts with visibility

We built Calibre Forum around a simple observation: most organizations that ask how to set up an AI governance committee have not yet seen how AI is used in their own business. The committee is the right structure. The missing piece is the map.

That is why our assessment surveys every staff member, anonymously, rather than relying on what managers think is happening. Honest answers are the foundation. When people know no one is tracking them individually, and nothing is installed on their devices, they tell you what they actually use.

We then combine those answers into a scored report that shows existing capabilities, risks and gaps, and gives a 90-day action plan. For a new committee, that plan is a ready-made first quarter: the first agenda, the first register, the first priorities.

Our advice is to run the assessment before the first meeting and again each quarter. The committee then governs reality, and can show the board that it is improving.

Anthony

See your AI use before the first meeting

Our AI readiness assessment gives a new committee its starting point: an anonymous, organization-wide staff survey, a scored report and a 90-day action plan. The one-off report is A$1,990. If you want quarterly surveys and reports to track progress, the membership is A$2,388 per year. You can see what is in the readiness report and how the process works from setup to report before you decide.

Calibreforum

FAQ

Do we need an AI governance committee if we are a small business?

You need clear accountability and a way to decide on AI use. In a small business that can be a three or four person group meeting quarterly. The BSI and UTS guidance both indicate the body need not be a formal board; what matters is a written mandate, a named owner and a route to the leadership.

Who should chair an AI governance committee?

Choose someone with authority across functions and time to follow up, often the operations, risk or technology lead. The executive sponsor should be a director or owner who can approve or stop projects. The chair is accountable for decisions and for reporting upward.

How often should the committee meet?

Monthly in the first few months, while you build the register and review initial use cases, then quarterly with ad hoc sessions for high-risk requests. Pair each meeting with an updated view of which tools are actually in use, so decisions are made on current facts.

What is the difference between an AI steering committee and an AI governance board?

The names overlap. A steering committee usually focuses on direction and priorities, a governance board on formal approvals and accountability. Whatever you call it, define scope, decision rights and escalation in a charter, because that is what makes it effective.