A small group with authority, not a forum. Chair it with the accountable executive. Seat the operations leaders whose processes run agents, plus risk, compliance, legal, data protection and information security, and a technology lead. Internal audit attends but does not vote, so it can still audit the committee. Every member should hold a decision right, not just an opinion.
Why does the make-up matter so much?
Because the committee's composition decides what it notices. A committee of technologists will discuss models and accuracy. A committee of lawyers will discuss liability. Neither will ask whether the arrears team can stop an agent in five minutes, which is the kind of question that matters when agents act.
The committee also has to avoid becoming the owner of every decision. Agents' decisions belong to the process owners whose work they do. The committee sets policy, approves appetite and limits, challenges, and resolves disputes. What AI agent governance means in practice is mostly done in the processes, not in the meeting.
Who should sit on it, and why?
| Seat | Why they are there | Holds |
|---|---|---|
| Accountable executive (chair) | One named person answers for agents overall | Final decision on disputes; sign-off on policy |
| Heads of operations running agents | They own the decisions agents make | Proposals for new agents and wider authority |
| Chief risk officer or delegate | Second-line challenge | Approval of limits and risk appetite |
| Compliance | Regulatory duties | Approval where rules apply to the process |
| Legal | Contracts, liability, disclosures | Advice and approval of customer-facing terms |
| Data protection officer | Personal data use and impact assessments | Approval of data access and assessments |
| Information security | Identities, credentials, access | Approval of access and connection designs |
| Technology or platform lead | Running and integrating agents | Feasibility and operational readiness |
| HR (when agents affect staff) | Workforce change and staff-facing uses | Input on role changes and staff communications |
| Internal audit (observer) | Independent assurance | Nothing; it reports separately |
Keep it to the people who hold those rights. A committee of twenty meets rarely and decides little.
Why should internal audit observe rather than vote?
Because audit must later test whether the committee worked. If it voted on a decision, it cannot independently assess it. Attending lets audit see how decisions are made; staying out of the vote keeps its view clean.
How is accountability assigned and recorded?
Through terms of reference that state what the committee decides, what it delegates, and what it escalates to the board. Each decision is minuted with who proposed it, who approved it, and on what evidence. A decision log, separate from the minutes, lets anyone trace an agent's authority back to the meeting that granted it.
The committee should also measure itself. Are policies followed? Are recertifications on time? Are incidents closed? Our guide on measuring AI agent governance suggests what to track.
What does this look like in practice?
Take a mid-sized insurer setting up its committee. The first draft has fourteen members, including two data scientists and a vendor representative. The chief operating officer, as chair, cuts it to nine. The data scientists attend when their work is on the agenda; the vendor is invited to specific sessions, not seated.
At its first meeting, the committee approves the agent policy, sets risk appetite in terms of actions, and delegates approval of new depth-2 agents to the relevant head of operations plus risk. Anything at depth 4, or touching claims decisions, comes to the committee. The first item it hears is a proposal to let the claims agent settle small glass claims at depth 3; it approves within limits, with a review at the first recertification.
What mistakes should you avoid?
- Accountability by committee. The committee approves, but named people still own each agent and each decision.
- Approving everything centrally. The committee becomes a queue. Delegate within appetite.
- Discussing models, not actions. The agenda should be authority, evidence and incidents.
- Treating model guardrails as governance. They are a technical feature, not decision rights; see guardrails are not governance.
The committee's first task is usually approving the policy; see how to write an AI agent governance policy and our guide to agent governance.
Questions people ask
Should the committee be separate from the existing risk committee?
It can be a subcommittee of it. What matters is a clear line to the board and a decision log, not a separate structure for its own sake.
How often should it meet?
Monthly while agents are being introduced, then quarterly, with a route for urgent decisions between meetings.
Do we need external members?
Not usually. An external adviser can help early on, but decision rights should stay with people accountable inside the business.