AI Governance Charter, Committee and RACI

Why This Topic Matters
Every AI security program needs a foundation of authority, accountability and oversight before any technical control is deployed. In the ISACA Advanced in AI Security Management (AAISM) body of knowledge, the AI governance charter, the AI governance committee and the RACI (Responsible, Accountable, Consulted, Informed) matrix are the three instruments that turn the board's intent into an operating structure. Without a charter, an AI program has no mandate and no defined scope. Without a committee, there is no cross-functional forum to make risk-based decisions on AI use cases. Without a RACI, roles overlap or fall through the cracks, which is the root cause of many AI incidents (unapproved models in production, undocumented training data, no one owning a bias finding). ISACA consistently tests the principle that governance precedes management: the board and senior leadership set direction and accountability; management executes. Expect exam questions that probe whether you understand who approves, who owns, who executes and who merely needs to know.

What Is an AI Governance Charter?
An AI governance charter is a formally approved document, typically ratified by the board or an executive steering committee, that establishes the AI governance function. It answers the questions: Why does this body exist? What is in and out of its scope? What authority does it have? How does it report? Key components usually include:
• Purpose and mandate – alignment of AI use with business strategy, risk appetite, ethics and legal/regulatory obligations (e.g., EU AI Act, NIST AI RMF, ISO/IEC 42001).
• Scope – which AI systems, lifecycles (design, development, procurement, deployment, monitoring, retirement) and third-party/vendor AI are covered.
• Authority – power to approve, defer, or prohibit AI use cases; to require risk assessments; to escalate to the board.
• Membership and quorum – who sits on the committee, chair, voting rights.
• Roles and responsibilities – often referencing a RACI.
• Decision rights and escalation paths – thresholds for board involvement.
• Reporting and metrics – KPIs/KRIs, frequency of reporting to executive leadership and the board.
• Review cycle – the charter itself must be periodically reviewed and re-approved.
The charter is a governance artifact: it is about direction and accountability, not about how to tune a model or configure a firewall.

What Is an AI Governance Committee?
The AI governance committee (sometimes called an AI steering committee, AI ethics board, or Responsible AI council) is the cross-functional decision-making body created by the charter. Its typical composition includes:
• Executive sponsor / chair (often the CIO, CDO, Chief AI Officer, or Chief Risk Officer)
• CISO or AI security lead
• Legal and compliance / privacy officer (DPO)
• Data science / AI engineering leadership
• Business unit owners who deploy AI
• Risk management and internal audit (audit usually attends in an advisory, non-voting capacity to preserve independence)
• HR and ethics representatives where workforce or fairness impacts exist
Core functions: approve AI policies and standards, review and approve high-risk AI use cases, oversee the AI risk register, monitor incidents and model performance drift, ensure regulatory compliance, resolve cross-functional conflicts, and report to the board. The committee operates at the governance layer: it sets expectations and oversees; it does not build or operate models day-to-day.

What Is a RACI Matrix in AI Governance?
A RACI matrix maps activities (rows) against roles (columns) and assigns one of four letters:
• R – Responsible: does the work. There can be several R's per activity.
• A – Accountable: ultimately answerable; approves or signs off. Exactly one A per activity – this is the rule exams love.
• C – Consulted: two-way communication; provides input before the decision or deliverable is finalized.
• I – Informed: one-way communication; kept up to date after the fact.
Variations include RASCI (adds Support) and RACI-VS (Verifier, Signatory), but AAISM primarily uses classic RACI.
Example AI governance RACI rows: define AI risk appetite (A = Board, R = CRO, C = CISO/Legal, I = business units); approve new high-risk AI use case (A = AI Governance Committee, R = business owner, C = CISO/Legal/Privacy, I = internal audit); perform AI threat modeling (A = CISO, R = AI security team, C = data scientists, I = committee); monitor model drift and performance (A = model owner, R = MLOps team, C = data science lead, I = committee); respond to AI security incident (A = CISO, R = SOC/IR team, C = Legal/PR/model owner, I = executive leadership).

How They Work Together
1. The board sets risk appetite and approves the charter.
2. The charter establishes the committee, its authority and reporting line.
3. The committee issues AI policies and adopts a RACI to operationalize roles across the AI lifecycle.
4. Management (CISO, model owners, data science, MLOps) executes under the RACI and reports KRIs upward.
5. Internal audit independently assures that the structure actually operates as documented.
6. The charter and RACI are reviewed when the business, regulations or AI portfolio change (e.g., adoption of generative AI, new jurisdictions, major incidents).
This mirrors the COBIT distinction: governance = evaluate, direct, monitor; management = plan, build, run, monitor.

Common Pitfalls Tested on the Exam
• Assigning two Accountable parties to one activity (creates ambiguity).
• Making the data science team Accountable for AI risk acceptance (risk acceptance belongs to the business/risk owner, not the technical team).
• Having internal audit as Responsible for implementing controls (destroys independence).
• Treating the committee as an operational body that reviews every model configuration (that is management's job; the committee oversees).
• A charter without defined escalation thresholds or a review cycle.
• Confusing the CISO as the owner of AI business risk; the CISO advises and secures, but the business owner owns the risk.
• Omitting Legal/Privacy from C on use cases involving personal data or regulated decisions.

Exam Tips: Answering Questions on AI Governance Charter, Committee and RACI
1. Identify the layer. Ask: is the question about governance (direction, accountability, oversight) or management (execution)? Charter and committee questions almost always want the governance-layer answer – board/executive approval, oversight, escalation – not a technical fix.
2. Apply the 'one A' rule. If an answer option lists shared or multiple accountability, it is usually wrong. If a scenario describes confusion over who signs off, the best answer is typically to revise the RACI to designate a single Accountable role.
3. 'Who is ultimately accountable?' For enterprise AI risk, the answer is senior management/the board. For a specific AI system, it is the business/model owner. For AI security controls, it is the CISO. For regulatory compliance decisions, it is the compliance/legal function with business ownership. Pick the highest appropriate owner, not the person doing the work.
4. 'What should be done FIRST?' When establishing an AI program, the first step is obtaining executive sponsorship and an approved charter (mandate and scope) – before inventories, risk assessments or tooling.
5. 'What is the BEST way to...' When the problem is unclear roles, choose RACI/role definition. When the problem is lack of authority or scope, choose charter. When the problem is siloed decisions, choose a cross-functional committee.
6. Independence matters. Internal audit should be Consulted or Informed, or a non-voting advisor; never Responsible or Accountable for designing or operating AI controls.
7. Watch for 'C vs I' distinctions. Consulted means input is required before the decision; Informed means notification after. Legal and privacy are usually C on use-case approval; the board is usually I on routine matters and A on risk appetite.
8. Charter components. If asked what a charter must contain, favor answers about purpose, scope, authority, membership, decision rights, reporting and review frequency; reject answers about model hyperparameters or specific tools.
9. Eliminate operational distractors. Options that have the committee personally reviewing code, testing models or approving each prompt template are distractors; the committee sets policy and approves high-risk use cases.
10. Think ISACA mindset. ISACA favors answers that are risk-based, aligned to business objectives, documented, approved by appropriate authority, and periodically reviewed. When two options seem right, choose the one that strengthens accountability and oversight rather than the one that adds a technical control.

Quick Self-Check
• Can you name six charter components? • Can you explain why only one A is allowed? • Can you place the board, committee, CISO, model owner, data scientists and internal audit on a RACI for 'approve a high-risk AI use case'? • Can you state the difference between the committee's oversight role and management's execution role? If yes, you are ready for this section of the AAISM exam.