AI Governance Operating Model

How to use this document

• What it is for. It defines who decides what about AI at [ORGANIZATION NAME], within which deadline, and when a decision moves up a level. It is the single reference for escalation thresholds and approval deadlines; other documents point here.
• Who should own it. The AI lead proposes it; Management approves it.
• Decisions to take first. Choose your level (Section 3), set the escalation amounts according to your spending authority (Section 6) and decide whether to set up an AI committee and with whom.
• Fields to complete. Replace [ORGANIZATION NAME], [OWNER], [AI COMMITTEE], [DATE], [APPROVED BY] and each [COMPLETE]. Amounts and volumes are indicative values.
• What to keep. Unmarked content applies to everyone. Keep only the rows and paragraphs for your level ([BASIC LEVEL], [STANDARD LEVEL] or [REINFORCED LEVEL]) and delete the others.
• Country variants. None. If a rule or regulator requires a specific role (for example, an algorithm officer), record it with the "AI or Algorithm Officer Appointment Record."
• Review. Ask Legal and whoever manages spending authority to review Sections 5 and 6.
• Approval and publication. Approve it, record it in "Version history" and publish it next to the "Responsible AI Use Policy (Including Generative AI)" so staff know whom to contact.

AI Governance Operating Model

Field	Value
Organization	[LEGAL ENTITY NAME]
Model owner	[OWNER] (AI lead)
Level adopted	[COMPLETE: basic / standard / reinforced]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY] (at least yearly)
Contact	[AI GOVERNANCE EMAIL]

1. Purpose and scope

1.1 This model sets how AI decisions are taken at [ORGANIZATION NAME]: who proposes, who assesses, who approves, within which deadline and when a decision is escalated.

1.2 It applies to every decision on AI tools, systems, models, agents, vendors and use cases, in every function and country.

1.3 Decisions are taken within the risk appetite (see "AI Risk Appetite Statement"), using the risk level assigned by the "AI Risk Classification Matrix."

2. Operating principles

2.1 One front door. Every new proposal to use AI comes in through the "AI Use Case Proposal Form" or, for a tool, through the "AI Tool Adoption Policy." The AI lead records it and assigns its lane.

2.2 Decide close to the work. Low-risk matters are decided by the system owner; only what its risk or a threshold in Section 6 justifies moves up.

2.3 Known deadlines. Each lane has a maximum deadline. Silence never means approval: if the deadline passes, the request is escalated automatically to the next level.

2.4 Common vocabulary. The only possible decisions are Approve · Approve with conditions · Reject · Escalate. The life-cycle states are Proposed · Under assessment · Pilot · In production · Under review · Retired.

2.5 Minimum separation. Whoever proposes a case does not approve it alone. At the basic level, it is enough that two different people decide.