Governance committees and decision rights

By the eighth session, Andre had a policy draft, a risk register, risk tiers and a vendor questionnaire. What he did not have was a clear answer to a simple question from Dr. Kaur: "If a vet at the Red Deer clinic wants to try an AI tool for dental charting, who says yes?" Without that answer, every other piece of governance would either be ignored or become a bottleneck. This session was about structures and decision rights: who decides what, at what level, with what information, and how fast.

What governance structures are for

AI governance is the system by which an organization directs and controls its use of AI: the bodies that make decisions, the rights and duties of each role, the policies and standards they apply, and the processes that bring decisions to them. The exam guide asks you to establish governance structures with cross-functional representation and clear accountability, to identify and address regulatory compliance risks in business processes that use AI, and to choose appropriate access controls and data security measures for AI systems.

Good governance does two things that can seem opposed. It stops uses that are unsafe, unlawful or not worth their cost. And it lets good uses go ahead quickly, with confidence, because everyone knows the rules and the path. An organization with no governance moves fast until something goes wrong, and then often stops everything. An organization with heavy governance for every use moves slowly all the time. The aim is proportion: light and fast for low-risk uses, thorough for high-risk ones, using the risk tiers from lesson 7.

The bodies

Cascade Ridge was small, so Andre resisted creating many committees. He settled on three levels, each with a written purpose, membership and set of decisions it could make.

Cross-functional representation was deliberate. The steering group included finance, clinical, privacy and security, data and operations, and the chief executive as sponsor. The exam guide stresses this mix because AI decisions cut across functions: a no-show model is a revenue question, a privacy question, a fairness question and a reception workflow question at once. A committee of technologists, or of finance people alone, would see only part of it.

Decision rights

Bodies are useless without clear decision rights: who may decide each kind of question, and who must be consulted or informed. Andre wrote them as a short table, so that a veterinarian with an idea could see the path in a minute.

The last row matters as much as the others. Anyone accountable for a system must be able to stop it at once when it is causing harm, without waiting for a meeting. A governance structure that makes stopping slow is unsafe.

Dr. Kaur's question now had an answer. A dental charting tool would touch clinical records, so the centre of excellence would screen it and probably assign it tier 3; Hannah would check the data terms; the veterinarian would complete the responsible AI checklist with help; and the steering group would decide at its next meeting, with Dr. Kaur's sign-off. If it passed, it would start as a pilot at one clinic. The path was clear, and it would take about a month, not a year.

Accountability with RACI

For each initiative, the exam guide asks for clear accountability. A common tool is a RACI chart, which lists for each activity who is Responsible for doing it, who is Accountable for the result (exactly one person), who must be Consulted and who must be Informed. The single accountable person is the important part: if two people are accountable, in practice nobody is.

Policies and standards

Structures apply policies. Cascade Ridge's AI policy, approved by the board, was two pages long. It stated the purposes for which the group would use AI and those it would not, such as making clinical diagnoses without a veterinarian or making employment decisions about staff; the principles from lesson 6; the risk tiers and the approval path; the data rules; the requirement for human review of anything clinical or client-facing; transparency to clients; the duty to report concerns; and the owner of the policy and its review date. Detailed standards, such as the responsible AI checklist, evaluation templates and the vendor questionnaire, sat beneath it and could be updated by the centre of excellence without going back to the board each time.

Access controls and data security

The exam guide asks you to choose appropriate access controls and data security measures for AI systems. A strategist should know the principles even if specialists implement them. Least privilege means each person and each system gets only the access it needs. For an AI system, that applies to the people who use and administer it, to the data it can read, and to the tools an AI agent can call. The client-support assistant, for example, would be able to read approved documents and create a callback request, but not read medical records or change bookings.

Compliance in AI-enabled processes

Regulatory compliance risk arises in the business process, not just in the model. The exam guide asks you to identify and address compliance risks in business processes that use AI. For each initiative, Hannah walked the process from start to finish and asked where a rule applied: collecting data, using it for a new purpose, sharing it with a supplier, keeping it, telling clients about it, and making decisions that affect them. The test of appropriate purpose and openness under PIPEDA and the provincial laws shaped what the privacy notice had to say about extra reminders, and veterinary medical associations' rules on records shaped how AI-drafted notes had to be reviewed and signed. Where a requirement was unclear, the steering group asked for legal advice before the pilot, not after.

Keeping governance light

Andre set three measures for the governance process itself: the time from intake to decision for each tier; the number of uses found in the six-monthly review that had never been approved; and the share of steering group decisions that were made at the first meeting where they were presented. Long decision times would show a bottleneck; unapproved uses would show that the process was being avoided, often because it was too slow; and decisions repeatedly deferred would show that proposals were arriving without the information needed. All three would be reported to the board with the portfolio.

Exam scenarios in this area often describe an organization where AI decisions are made by whoever is enthusiastic, or one where a single committee must approve everything and has a long queue. The best answers set up cross-functional bodies with written decision rights scaled to risk, assign one accountable owner per initiative, and keep a fast path for low-risk uses and an immediate path for stopping harm.

Governance across the AI life cycle

Governance is not a single approval. A use passes through several governance points during its life: intake, where it is screened and given a tier; design, where the responsible AI checklist and privacy review are completed; the pilot gate, where evidence on value, risk and adoption decides what happens next; launch, where ownership, monitoring and support are confirmed; regular reviews in production; and retirement, when the system is switched off and its data deleted or archived according to the rules. Each point has an owner and a record. The register of AI systems shows, for every system, where it stands in that life cycle.

Retirement is the stage most often forgotten. An AI tool that is no longer used but still has access to data, or a vendor contract that renews automatically for a feature nobody wants, is a risk with no benefit. Cascade Ridge's register would therefore include a review date for every system, and any system that had not been used for three months would be flagged for a decision: improve it, keep it, or retire it.

A last point about governance bodies is their own discipline. Each meeting of the steering group would have papers circulated three days ahead, a decision log recording what was decided and why, and a short list of actions with owners and dates. That discipline sounds administrative, but it is what makes governance traceable: months later, anyone can see why a use was approved, what conditions were set and whether they were met.