Governance & Accountability ยท GOV-04
Oversight forum
A cross-functional forum oversees AI use, risk and performance, with terms of reference, the right membership and a clear link to the organisation's main governance.
Why it matters
AI decisions need technology, data, legal, security, people and business views in the same room. A standing forum gives that, and gives the accountable executive somewhere to take decisions that are bigger than one team.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No forum; AI matters surface ad hoc in other meetings, if at all. |
| 2 Developing | An informal group or community of interest meets, but it has no remit to decide or escalate. |
| 3 Defined | A diverse, cross-functional oversight forum works to terms of reference, meets on a set cycle, records its decisions and can escalate. |
| 4 Managed | The forum tracks its decisions to completion and reports measured performance, risk and benefit to the accountable executive. |
| 5 Optimising | The forum's remit, membership and cadence are reviewed against its effect and adjusted as AI use matures. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- GOV-04.1 An AI oversight forum has terms of reference.
- GOV-04.2 The forum's membership is cross-functional and brings diverse demographic backgrounds and lived experience.
- GOV-04.3 The forum has a defined escalation route.
- GOV-04.4 The forum meets on a set cycle and records its decisions.
Assessment questions
- Is there a group that oversees AI, and what can it decide on its own?
- Which functions sit on it, and who is missing?
- Where do its decisions go, and how do you know they are acted on?
- Terms of reference and membership list
- Agendas, minutes and a decision or action log
How to reach Level 3
- Write terms of reference for an AI oversight forum covering purpose, remit, decision powers, quorum and how it reports to the main governance.
- Appoint cross-functional members (for example business, data, technology, risk, legal and people), and seek members with diverse demographic backgrounds and lived experience, including from outside the usual senior group if needed.
- Define an escalation route from the forum to the board or equivalent, and from delivery teams to the forum.
- Set a meeting cycle and keep minutes that record decisions and actions.
Common pitfalls
- Filling the forum with technical staff only, so ethical and service effects are missed.
- Treating diversity as a box ticked by job title rather than by background and experience.
Starter artefacts
- AI oversight forum terms of reference
- Membership matrix covering functions and backgrounds
- Decision and action log template
Ownership and sequence
- Accountable
- ai governance lead
- Contributors
- executive sponsor, risk lead, security lead, data owner, people lead
- Depends on
- GOV-02
- Roadmap step
- 2
- Lifecycle
- strategy, design, operate
Cross-references
| ISO/IEC 42001 | 4.4 partial; 9.3 partial |
|---|---|
| JSP 936 Part 1 | para 67 partial; para 87 partial; para 90 partial |
| MITRE AI Maturity Model | P1.3 partial; P2.3 direct; P3.2 partial |
| NIST AI RMF 1.0 | GOVERN 2.1 partial; GOVERN 3.1 direct; MAP 1.2 partial |
| UK Data and AI Ethics Framework | Fairness 5 partial; Trade-offs 4 partial; SAT 1.8 direct; SAT 1.12 partial |
| UNESCO AI Maturity Framework | 2.2 direct; 5.1 direct; 5.2 partial |
direct: this control at Level 3 meets the item. partial: it covers part of it.