Establishing an AI Governance Committee: An Inside Look at OneTrust’s Process | Blog | Resources

OneTrust Named a Visionary in the 2026 Gartner® Magic Quadrant™ for AI Governance Platforms

On-demand webinar coming soon...

Blog

Establishing an AI Governance Committee: How to Structure Roles, Speed Approvals, and Reduce Rework

Knowing where to start an AI Governance Committee can be overwhelming, as companies set to govern responsibly, reduce risk for people, and help the business move faster with confidence.

Adomas Siudika

OneTrust AI Governance Committee, Privacy Counsel, FIP

Bex Evans

Product Marketing Director

October 10, 2025

[Building the right structure](/content/blog/establishing-an-ai-governance-committee-an-inside-look-at-onetrusts-process/#building-the-right-structure "Building the right structure"/index.html)
[Defining the scope of AI Governance](/content/blog/establishing-an-ai-governance-committee-an-inside-look-at-onetrusts-process/#defining-the-scope-of-ai-governance "Defining the scope of AI Governance"/index.html)
[Classifying AI by risk](/content/blog/establishing-an-ai-governance-committee-an-inside-look-at-onetrusts-process/#classifying-ai-by-risk "Classifying AI by risk"/index.html)
[Governing different AI technologies](/content/blog/establishing-an-ai-governance-committee-an-inside-look-at-onetrusts-process/#governing-different-ai-technologies "Governing different AI technologies"/index.html)
[Embedding human oversight](/content/blog/establishing-an-ai-governance-committee-an-inside-look-at-onetrusts-process/#embedding-human-oversight "Embedding human oversight"/index.html)
[New oversight for agentic and autonomous AI](/content/blog/establishing-an-ai-governance-committee-an-inside-look-at-onetrusts-process/#new-oversight-for-agentic-and-autonomous-ai "New oversight for agentic and autonomous AI"/index.html)
[Setting committee cadence and workflow](/content/blog/establishing-an-ai-governance-committee-an-inside-look-at-onetrusts-process/#setting-committee-cadence-and-workflow "Setting committee cadence and workflow"/index.html)
[Defining clear roles and responsibilities](/content/blog/establishing-an-ai-governance-committee-an-inside-look-at-onetrusts-process/#defining-clear-roles-and-responsibilities "Defining clear roles and responsibilities"/index.html)
[Getting started with AI governance](/content/blog/establishing-an-ai-governance-committee-an-inside-look-at-onetrusts-process/#getting-started-with-ai-governance "Getting started with AI governance "/index.html)
[Key questions about AI governance](/content/blog/establishing-an-ai-governance-committee-an-inside-look-at-onetrusts-process/#key-questions-about-ai-governance "Key questions about AI governance"/index.html)

White paper: How to develop an AI governance program

Learn more about getting started with AI Governance initiatives.

[Download now](/content/resources/how-to-develop-an-ai-governance-program-white-paper/ "Download now"/index.html)

Here is how OneTrust set up our committee and the practical steps you can adapt for your organization.

AI projects deliver the most value when risk and reward are understood early. Delays often happen when data readiness, privacy, and compliance checks occur too late in the process. A well-structured governance committee brings these considerations forward, so teams can move faster and with confidence.

The purpose of an AI Governance Committee is simple: ensure that AI systems comply with responsible AI principles, meet regulatory requirements, and operate with controls that can scale. With the right approach, the Committee moves becomes a forum for direction, collaboration, and decision-making.

Building the Right Structure

At OneTrust, our AI Governance Committee includes representatives from Legal, Ethics and Compliance, Privacy, Information Security and Architecture, Research and Development, and Product Management. This cross-functional model works because governance is inherently interdisciplinary. Legal provides oversight, privacy ensures lawful processing, and engineering brings visibility into model performance and data dependencies.

Each member plays a defined role. The committee sets direction, while smaller working groups handle day-to-day reviews. Business owners and data stewards contribute context and evidence to support decisions. This layered approach enables quick, informed approvals and helps avoid rework later in the project lifecycle.

Effective governance relies on diversity of thought and expertise. Bringing together privacy, security, data, product, and legal teams helps surface blind spots and leads to more balanced decisions. Each perspective enhances the others, resulting in faster consensus and more defensible outcomes.

Defining the Scope of AI Governance

Every committee needs a shared understanding of what counts as an “AI system.” At OneTrust, we align with regulatory definitions that cover software using techniques such as machine learning or knowledge-based approaches to generate outputs like content, predictions, or decisions.

A clear scope ensures that automation and AI systems are reviewed consistently. Whether it’s a customer chatbot, a fraud detection engine, or a resume screening tool, the committee must understand what data is used, what risks are present, and how those risks are mitigated. Think of use cases that teams already run. Different cases span customer operations, risk, and people decisions, and each brings distinct governance needs. Some examples include:

Customer support chatbots that answer FAQs, combining scripted flows with intent detection and escalate with guardrails for disclosures and scope.
Recommendation engines suggesting products or content based on behavior, with controls for consented data and transparency on why items appear.
Autonomous supply chain agents that monitor inventory, shipping routes, and supplier updates in real time, generating purchase orders or rerouting shipments with minimal human oversight, and thus require clear policies for human intervention, traceability, and accountability when decisions compound across systems.

Classifying AI by Risk

We adopt the risk classification system outlined in the EU AI Act and align internal policies to those categories:

Unacceptable risk systems are prohibited, such as those used for social scoring.
High-risk systems affect people’s rights or safety, like HR screening tools or employee monitoring software.
Limited or minimal risk systems, such as spam filters, require lighter oversight.
General-purpose AI systems, including generative AI models, demand flexible governance across multiple use cases.

This classification drives how reviews are conducted, which policies apply, and what level of evidence is needed for approval.

Governing Different AI Technologies

Different AI types bring different governance needs. Predictive AI relies on data quality and fairness. Generative AI introduces questions of content accuracy and disclosure. Agentic AI adds autonomy, requiring new safeguards around control and accountability. A single governance model must adapt to all three while keeping oversight efficient.

One way to simplify this is to use a “buy versus build” framework. When using third-party tools, focus on contract controls, privacy, and continuous monitoring. When developing in-house, ensure that data validation, explainability, and security reviews are embedded in the process.

Embedding Human Oversight

Our AI Use Policy prohibits unacceptable systems and sets the process for all other categories. We leverage OneTrust Third-Party Risk Management (TPRM) and developed AI-risk extensions to our existing risk assessment templates. Using this process, we’re able to assess AI-linked risks, which in some instances are connected to other standards, like privacy, information security, and ethics risks domains.

Automation accelerates work, but human judgment remains essential, especially for high-risk systems. Our committee extends existing third-party risk and privacy assessments with AI-specific questions, including model explainability and data adequacy. These assessments are automated where possible but always reviewed by a human to ensure context and accountability.

For example, HR systems processing personal information undergo additional checks for bias and fairness. This ensures both compliance and trust in how outcomes are reached.

New Oversight for Agentic and Autonomous AI

Agentic AI introduces autonomy, tool use, and compounding decisions to traditional AI governance models. When designing autonomous AI systems such as agents, the role of human intervention is a critical factor for safety, accountability, and effectiveness – and it must be paired it with guardrails that address agentic AI-specific risks:

Decision control: Restrict actions to approved tools and environments.
Traceability: Log every action and prompt for full auditability.
Data governance: Enforce least privilege and redact sensitive information.
Compliance evidence: Retain approvals, test results, and monitoring records.

Together, these guardrails prevent unauthorized actions and maintain accountability between human and machine decision-making.

Setting Committee Cadence and Workflow

OneTrust’s executive-level committee meets quarterly to review strategy, policy, and performance. Smaller working groups meet more often to assess individual use cases or policy updates. Electronic voting supports faster decisions between meetings, keeping momentum high.

A typical agenda covers three areas:

Review and approval of AI-related initiatives
Policy and procedure updates
Monitoring and reporting on alignment with responsible AI principles

Standardized workflows help teams move through intake, review, and approval with clarity. Each project goes through defined stages—intake, risk tiering, privacy and security review, data readiness checks, and final approval. These steps ensure consistency, traceability, and an auditable record of every decision.

Defining Clear Roles and Responsibilities

Role clarity prevents duplication and delays. Here’s how responsibilities are typically divided:


Role	Ownership
Executive Council	Strategy, risk posture, and final approvals
AI Program Lead	Runs intake, triage, reviews, and reporting
IT Governance	Platform configuration and technical standards
Data & Analytics Governance	Data quality, lineage, access, and model validation for build scenarios
Risk Governance	Risk taxonomy, tiering method, and oversight
Privacy & Legal	Privacy by design, transparency, and policy alignment
Security	Safeguards for models, data, and infrastructure
Business Owner	Sponsors the use case and provides context and evidence
Data Stewards	Supply data knowledge, quality checks, and records of processing
Procurement and Vendor Management	Lead due diligence and vendor monitoring for buy scenarios

Getting Started With AI Governance

Standing up an AI governance program does not need to be overwhelming. Start by naming the people who will own intake and risk tiering. Publish then the decision gates and artifacts. Begin with buy versus build guidance so teams understand who performs what, and where contracts or validation are the primary controls. Expand training and stewardship as adoption grows.

To see these practices in action and hear how cross-functional teams structure roles and approvals, access the on-demand webinar “Forming the AI Committee: Roles and responsibilities for enterprise-wide governance.”

Key Questions About AI Governance

What is an AI Governance Committee and why do you need one?

A cross-functional group that sets policy, approves use cases, and oversees risk across AI systems. It speeds approvals by defining roles, artifacts, and decision gates, and reduces rework through consistent evidence and monitoring.

How do you define an AI system for governance purposes?

Use a broad definition aligned to regulation. Include systems that produce predictions, recommendations, content, or decisions. Scope common cases like fraud detection, recommendation engines, customer chatbots, and HR resume screeners.

What oversight is required for AI agents and autonomous workflows?

Match oversight to risk. Apply human in the loop for high-impact steps, human on the loop for supervised autonomy, and human out of the loop only for low-risk, tightly constrained tasks. Add guardrails for decision control, visibility, data governance, and audit evidence.

How do you scale reviews without slowing delivery?

Standardize intake, risk tiering, and PIA extensions. Reuse templates, automate evidence collection, and enable electronic voting for time-sensitive approvals. Keep humans in the loop for higher-risk steps.

What are the first steps to launch an AI governance program?

Name owners for intake and risk tiering, publish decision gates and required artifacts, set buy versus build guidance, and train teams on policy, privacy by design, and safe GenAI use. Expand to monitoring as adoption grows.