AI Steering Committee: how to set up an AI committee in your company (without bureaucracy)

AI without governance is a risk. But governance without pragmatism is bureaucracy. We explain how to create an AI committee adapted to the size of your company, with clear roles, a practical cadence, and a decision model that works from week one

When a company starts adopting artificial intelligence, decisions multiply: which projects should we prioritize? Who approves the use of a new AI tool? Who validates that we comply with the GDPR and the AI Act? Who decides whether a pilot moves into production or is cancelled?

Without a governance body, these decisions are made in a scattered, reactive, and often contradictory way. Marketing adopts ChatGPT, IT bans it, Legal does not know about it, and Operations implements a chatbot without consulting anyone. The result: Shadow AI, unmanaged regulatory risks, and duplicated projects.

The solution is an AI Steering Committee: a small group of people with the authority to make decisions about AI adoption, governance, and scaling across the organization. And no, you do not need to be a multinational to have one.

In this article, we explain what an AI Steering Committee is, why you need one now (especially with the AI Act’s governance obligations), how to adapt it to the size of your company, and which decisions it should make at each meeting. We also include a 30-day launch plan so you can have it working within a month.

What an AI Steering Committee is and what it does

An AI Steering Committee is the governance body responsible for directing the company’s AI strategy. Its main functions are:

• Prioritize projects: Decide which AI use cases to implement, in what order, and with which resources. Use the impact-effort matrix to assess proposals.
• Approve Gate decisions: Validate whether a project moves from Gate 0 (ideation) to Gate 1 (pilot), and from Gate 1 to Gate 2 (production). The committee safeguards the Gates model.
• Manage risks: Review the AI systems inventory, assess regulatory risks (AI Act, GDPR), and approve impact assessments (FRIA, DPIA).
• Monitor ROI: Review the KPIs of each active project using the GO/FIX/KILL traffic light and decide whether to scale, optimize, or stop.
• Define policies: Approve and update the AI use policy, Shadow AI guidelines, and data-quality standards.
• Promote adoption: Identify AI opportunities in business areas, facilitate training, and remove organizational barriers.

The committee does not execute projects. It directs, prioritizes, and governs them.

Enterprise vs SME version: adapt governance to your size

The most common mistake is copying a multinational’s governance model and applying it to a 50-person company. It does not work. Governance must be proportionate to the size of the organization and the volume of AI projects.

Enterprise version (>500 employees)

• Composition: 7–9 members. CTO/CDO (chair), business representatives (sales, operations, HR), Legal/Compliance, Data/IT, and a responsible-AI or ethics lead.
• Cadence: Formal monthly meeting with a structured agenda. Extraordinary meetings for urgent Gate approvals.
• Commitment: Each member dedicates 4–6 hours per month to the committee (preparation, meeting, and follow-up).
• Support: A technical secretary prepares the documentation, KPI dashboard, and Gate briefs for each project.

SME version (10–500 employees)

• Composition: 3–5 members. CEO or general manager (sponsor), a technology/digital owner (even if external), and a business owner from the area with the most AI projects.
• Cadence: A 60–90-minute meeting every two weeks or once a month. No bureaucracy: a clear agenda, documented decisions, and an action plan.
• Commitment: 2–3 hours per month per member. The technology owner takes on the role of technical secretary.
• Pragmatism: In an SME, the committee can be the management meeting with a fixed “AI projects” item on the agenda. You do not need to create a new body if you can integrate the function into an existing one.

Key point: The SME version is not a “poor” version of the enterprise model. It is a proportionate version. An SME with three people making good AI decisions governs better than a multinational with a 12-person committee that meets every quarter.

The committee’s essential roles

Regardless of size, the committee needs to cover four critical functions. In an SME, one person may cover several:

1. Executive sponsor. Someone with the authority to allocate resources (budget, people, and time). Without an executive sponsor, the committee is a group of opinions with no ability to act. In an SME, this is usually the CEO or general manager.
2. Technical owner. Someone who understands the technology well enough to assess project feasibility, data quality, and integration with existing systems. They do not need to be a data scientist: they may be a CTO, IT manager, or external consultant.
3. Business owner. Someone who represents the area that will use AI, can validate the value hypothesis, define business KPIs, and assess whether the real impact matches expectations.
4. Compliance owner. Someone who monitors regulatory compliance: GDPR, AI Act, data policy, and transparency. In an SME without a legal department, this function can be outsourced or assumed by the technical owner with specific training.

Standard committee meeting agenda

An AI Steering Committee meeting should last between 60 and 90 minutes and follow a fixed structure that ensures decisions are made rather than information merely shared:

1. Dashboard review (15 min). Status of each active project with the GO/FIX/KILL traffic light. Updated key KPIs. Discuss only amber or red projects.
2. Gate decisions (20 min). Are there projects that need approval to move to the next phase? Review the Gate brief: value hypothesis, pilot results, metrics, and risks. Decision: GO, FIX, or KILL.
3. New proposals (15 min). Are new use cases being proposed? Run a quick assessment with the impact-effort matrix. If approved, assign a sponsor and Gate 0 date.
4. Risks and compliance (10 min). Regulatory updates, Shadow AI incidents, and updates to the AI systems inventory.
5. Actions and next steps (10 min). Summary of decisions made, owners, and deadlines. Document everything.

The discipline of keeping this fixed structure is what distinguishes a committee that works from one that becomes just another meeting. If no decisions are made in the meeting, something is wrong.

The most common mistakes (and how to avoid them)

1. Creating a committee without authority. If the committee “recommends” but does not “decide”, it is irrelevant. The executive sponsor must have the power to allocate resources and stop projects. Without authority, the committee is organizational theatre.
2. Meeting without data. A committee that discusses opinions instead of reviewing KPIs quickly loses credibility. Require each project to present its updated traffic-light dashboard before the meeting.
3. Bureaucratic overload. If preparing documentation for the committee takes longer than working on the project, governance becomes an obstacle. Keep forms simple and templates standardized.
4. Excluding the business. A committee made up only of technical people approves technologically elegant projects with no business impact. The business owner validates that the project solves a real problem.
5. Failing to document decisions. If committee decisions are not recorded, there is no traceability or accountability, and you cannot demonstrate governance to an auditor or regulator. A simple one-page set of minutes for each meeting is enough.

Integration with the Gates model

The AI Steering Committee is the body that operates the Gates model. In practice, this means:

• Gate 0 (Ideation): The committee reviews the project’s classification brief (value hypothesis, risk level, required data, and sponsor) and decides whether to authorize research and pilot preparation.
• Gate 1 (Pilot): The committee reviews the pilot results (KPIs versus baseline, quality metrics, and DPIA/FRIA where applicable) and decides GO (scale), FIX (adjust and repeat), or KILL (stop).
• Gate 2 (Production): The committee approves the move into production with the complete technical file, monitoring plan, and incident protocol.
• Periodic reviews: Production projects are reviewed quarterly using the traffic light. If a project turns red, the committee decides whether to intervene or retire it.

This integration ensures that no AI project moves into production without oversight, resources are allocated to the projects with the greatest impact, and projects that do not work are stopped in time.

For SMEs: Gates can be simplified into a “continue or stop” decision with minimum documentation: one page containing the hypothesis, results, and decision. You do not need 20-field forms to govern well.

Launch plan: your committee’s first 30 days

If you want to move from concept to action, here is a realistic plan for having your AI Steering Committee up and running in one month:

Week 1: Formation

• Identify the 3–5 committee members with the required roles (sponsor, technical, business, and compliance).
• Schedule the first meeting for the following week.
• Send a briefing in advance: what the committee is, what is expected of each member, and the cadence.

Week 2: Inventory and Shadow AI inventory

• Run a quick audit: which AI tools are being used in the company? Who uses them? With what data?
• List the AI projects in progress or proposed.
• First meeting: present the inventory and align priorities.

Week 3: Policy and prioritization

• Approve the AI Lite Policy (which tools are allowed, which data is not shared, and who approves new uses).
• Prioritize projects with the impact-effort matrix. Select 1–2 to move to Gate 0.

Week 4: First Gates cycle

• Review the Gate 0 briefs for the selected projects.
• Make the first formal decision: GO/FIX/KILL.
• Document the decision and distribute the minutes to the team.

From the second month onward, the committee operates on a recurring basis: a fortnightly or monthly review using the standard agenda, bringing in new projects and reviewing active ones.

The AI Act makes it mandatory (not merely recommended)

The AI Act establishes governance obligations for organizations that deploy high-risk AI systems. This includes maintaining an AI systems inventory, documenting impact assessments, keeping traceability logs, and ensuring human oversight.

Without a governance body coordinating these obligations, compliance becomes fragmented across departments and no one has the full picture. The AI Steering Committee is the natural body to centralize this function.

Also, when a regulatory audit arrives, the first question will be: “Who governs AI in your organization?” Having a committee with meeting minutes and documented decisions is the best evidence of responsible governance.

AI governance starts with a meeting

You do not need a complex framework, a dedicated budget, or a new department. You need 3–5 people with authority, a fixed agenda, a KPI dashboard, and the discipline to meet regularly and make data-driven decisions.

The AI Steering Committee is the piece that connects AI strategy with execution. Without it, projects are launched without prioritization, executed without governance, and cancelled without learning. With it, every AI project has a sponsor, KPIs, a traffic light, and a documented decision at each phase.

If you want to set up your AI Steering Committee, define the version adapted to your company, or integrate the Gates model into your current governance, Impulsa3 can support you in its design and implementation.

impulsa3.com · Digital Transformation and AI for SMEs and ecommerce · servicios@impulsa3.com