Does Your Business Need an AI Council?

A team wants an AI tool. IT considers security, the manager looks for time savings, and someone raises customer data. Who can approve it, and what evidence do they need? An AI Council gives that decision a clear home.In shortAn AI Council is a small, cross-functional forum that sets direction and oversees important AI decisions.A small business may use an existing leadership meeting instead of creating a separate committee.Give the forum authority to prioritise opportunities, set boundaries, approve or escalate proposals and review results.Invite the people who understand the work and the relevant risks; do not assume every specialist must attend every meeting.Keep a short record of decisions, owners, conditions and review dates.What is an AI Council?An AI Council connects commercial aims with operational reality, staff experience, data protection and security.The UK government's AI Knowledge Hub describes the role of an AI governance board, or AI representation on an existing board, as providing oversight, accountability and strategic guidance. Its guidance is written for public-sector programmes, so an SME should adapt the principle to its own scale rather than copy the structure. Source: UK Government AI Knowledge Hub.The ICO lists a steering group, committee, meeting or equivalent as an option for oversight. It also calls for assigned responsibilities and practical procedures where AI handles personal data. Source: ICO AI governance and accountability toolkit.An AI Council therefore need not be a new layer of bureaucracy. It may be a regular agenda item in a management meeting, provided the right people can make decisions and follow them through.When does a dedicated council become useful?Start with the decisions you face. If one owner can see all the proposed uses and involve specialists when needed, an existing meeting may suffice. A dedicated forum becomes more useful when:several departments are buying or building AI tools;proposals compete for budget, data access or staff time;decisions affect customers, employees or other people;no single manager has the expertise or authority to resolve recurring questions; orpilots start successfully but stall before anyone decides whether to adopt them.Coordinated decisions, rather than headcount, are the trigger. The ICO recognises that one person may cover several functions in a smaller organisation. Source: ICO guidance on organisational roles.What should the council decide?Give it a written remit. For most SMEs, five areas are enough to begin.Priorities. Which business problems deserve attention, and what result would justify the effort? A proposal to automate a poorly understood process may need process work first.Boundaries. Which tools and types of information can teams use? Who can approve exceptions? The council should commission or approve a usable AI policy, with specialist input where needed.Pilots and resources. Which ideas move into a limited test? Who owns the process, supplies the data, checks the output and measures the result? A working group can do the detailed work; the council makes the investment and adoption decisions.Risks and escalation. Which proposals require security, legal, HR or data protection assessment before use? Who can pause a tool when concerns emerge? The council should connect with existing risk and incident processes.Results. Which trials have improved speed, quality, capacity or service? Which should be changed or stopped? Count outcomes and rework, rather than treating the number of AI accounts as proof of value.Set a threshold: routine uses follow policy; process owners approve defined local tests; significant proposals come to the group.Who should take part?Begin with a senior sponsor who can allocate time and resources, plus leaders close to the proposed uses. Include the person responsible for IT or security and the data protection lead where their expertise is needed. HR, finance, commercial or customer representatives can join for relevant decisions.Invite people who understand the work. A leader may know why proposals are delayed; a coordinator may know the steps and exceptions. They can join for the relevant item.Three or four regular members can invite others by topic. Record the chair, decision-log owner, spending authority and pause authority. The ICO calls for clear roles and senior management accountability when AI processes personal data. Sources: ICO audit toolkit and AI accountability guidance.How to run a useful first meetingAsk for a short list of current tools, proposed uses and outstanding questions before the meeting. Then use a 45-minute agenda:10 minutes — What is already happening? Confirm current uses, owners and immediate issues.10 minutes — Which problems matter? Choose one or two processes worth investigating.15 minutes — What decisions are needed? Agree permitted tests, conditions, specialist reviews and owners.10 minutes — What happens next? Set dates for evidence, a policy draft and a follow-up decision.Record each proposal, decision, reason, owner, conditions and review date. The agenda timings are illustrative.An example: two promising ideas, different decisionsImagine a 60-person services business. Marketing proposes AI-assisted first drafts of public-facing content. HR proposes a tool that ranks applicants. Both promise to save time, but they have different consequences if the output is wrong.The council asks each team to define the process, the data, the intended benefit and the human checks. Marketing may run a controlled trial using approved tools and editorial review. HR's proposal needs specialist assessment before any applicant data is processed or decisions are influenced. The council names owners and records what evidence is needed for a later decision.The scenario illustrates different review needs, not an automatic legal classification.Give the council a reason to existThe test is whether the council answers questions, unblocks useful experiments and stops unsuitable ones.Start with a one-paragraph remit: “We prioritise AI opportunities, set boundaries for responsible use, assign owners and review evidence before wider adoption.” Adapt it to your business, then make the first decisions visible to the people affected.This week's action: Identify one unresolved AI decision and the people needed to make it. If your current leadership meeting can resolve it and record the outcome, begin there.Explore the governance seriesAI governance for SMEsAI policyAI ChampionsAI working groups90-day governance review FAQs Does every SME need an AI Council? No universal rule requires a group called an AI Council. The ICO lists a steering group, committee, meeting or equivalent as an oversight option. Source: ICO AI governance toolkit. Who should chair an AI Council? Choose a senior person who can resolve issues and secure resources. Their job is to ensure decisions have evidence, owners and follow-up, with specialist input as needed. How often should an AI Council meet? Monthly is a workable starting rhythm for active pilots. Set a route for urgent issues between meetings and adjust frequency to demand. Is an AI Council the same as an AI working group? The council sets priorities and approves, expands or stops uses. A working group maps a process, tests a change and reports evidence. People may serve in both. What should an AI Council produce? A short remit, use list, decision log, named owners and review schedule. Staff should know where to bring ideas or concerns.

This article was written by Peter Lowe. The ideas and opinions are his own; AI was used to assist with drafting and editing.