Decision Forums and Governance Bodies

All courses / AI Governance / Module 4 / Chapter 13

Learning objectives

After the lesson the participant can:

• Explain what pipelines cannot decide and which forum decides it.
• Route a decision to one of the four tiers using risk class and decision type.
• Define a stop authority and a restart rule for a system before it reaches production.
• Draft terms of reference for a forum with mandate, quorum, cadence, evidence and a sunset clause.

Key concepts

Decision tiers

Tier 1 pipeline gates decide routine matters; tier 2, the design authority or model risk committee, decides exceptions and precedent; tier 3, the AI governance board, decides high-risk go-live, residual risk and policy; tier 4, the management body, sets the appetite and accepts risks beyond it.

Management body

The board in a company, or the head of the authority with the management group. It sets the risk appetite for AI, approves the AI policy, accepts residual risks beyond the appetite it delegated and oversees whether the arrangements work.

AI design authority

Often a specialisation of an existing architecture board. It decides reference patterns, golden paths, sourcing choices, deviations from approved patterns and precedent-setting AI Decision Records; its output is a merged record, not minutes.

Stop authority

The chapter's default: the incident commander and the use-case owner may each stop a system unilaterally; restarting requires the use-case owner and, for high-risk systems, the risk function; every stop is reported to the AI governance board.

Governance theatre

The condition in which forums perform oversight without exercising it: approvals nobody can trace to evidence and a high-risk system whose risk acceptance nobody can find. Four rules prevent it, including a deadline after which a decision escalates.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. A forum that never says no deserves as much scrutiny as one that always does. What would each pattern tell you about where the real decision is taken?
2. The chapter insists that a stop path inside the system it is meant to stop fails exactly when needed. Who in your organisation can stop an AI system at two in the morning, and how do you know?
3. A decision never moves sideways to a parallel forum, which is how decisions disappear. Where do AI decisions move sideways in your organisation, and what rule would end it?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. How does the decision-tier policy treat prohibited practices under Article 5 of the AI Act?

   1. They are escalated to tier 4, the management body, for a decision
   2. They are not a tier: the policy rejects them at intake and no forum may approve them
   3. They are decided at tier 3 with the consent of the chief risk officer
   4. They require a waiver of at most 90 days from the design authority
   Show the answer

   B. They are not a tier: the policy rejects them at intake and no forum may approve them
   Prohibited practices are not a tier. The routing block rejects them at intake, and no forum, at any level, has a mandate to approve them.

2. In Hansa Mutual's board terms of reference, what makes a decision invalid even if enough voting members are present?

   1. The absence of the data protection officer, who holds a veto
   2. An evidence pack that was generated automatically from the registers
   3. A recusal by one of the voting members for a conflict of interest
   4. The lack of consent from the chief risk officer
   Show the answer

   D. The lack of consent from the chief risk officer
   The chief risk officer is a consenting member and a required role for quorum: a decision is invalid without that consent. The data protection officer, CISO and internal audit attend in an advisory capacity without a vote.

3. What does the chapter say about the change advisory board and model versions promoted through the pipeline gates?

   1. Such a version is a pre-authorised standard change; the board sees only what policy routes to it
   2. The board must re-approve every model version, with its evaluation report, before the version reaches users
   3. The board replaces the AI governance board for limited-risk systems
   4. The board reviews every prompt change within five working days
   Show the answer

   A. Such a version is a pre-authorised standard change; the board sees only what policy routes to it
   The change advisory board should not re-approve what the pipeline has evaluated. A board that reviews every prompt change will be bypassed within a quarter.