Decision Forums and Governance Bodies

Chapter 9 moved the routine work of AI governance into pipelines, and Chapter 12 placed use-case ownership with the teams closest to the business. Neither removes the need for people to meet and decide. Somebody must set the risk appetite, accept residual risk, rule on unforeseen exceptions, stop an agent at two in the morning, and answer to supervisors and works councils. This chapter describes the forums an organisation needs, what each decides, how decisions are tiered by risk class, and the charters and decision-tier policy that make the structure testable as code.

Chapter 9 argued that a committee can decide but cannot enforce, observe or remember at delivery pace. The corollary is often missed: pipelines cannot decide anything that has not already been decided. A gate applies a threshold but does not set it, and a waiver record names an approver who must have the mandate to approve. Governance as code therefore relocates human judgement rather than eliminating it, and the quality of that judgement depends on the forums in which it is exercised.

Most organisations already have more forums than they need and fewer than they think. Typically each existing body believes it has a say over AI, none has a mandate that names it, and the first high-risk use case visits all of them in sequence: many meetings, few decisions, and no record of who accepted which risk on what evidence. The design task is to give every AI decision exactly one home, put routine decisions in policy, and make every forum consume evidence from pipelines rather than slide authors. Architecture as Code (Chapter 11) made the same move for architectural governance (66, Nordqvist, 2025), and Chapter 16 applies it to portfolio steering.

Primary topics explored

1. Why forums still matter after governance as code
2. The European anchors
3. The forums and what each decides
4. Decision tiers by risk class
5. Mandates, quorum, cadence, and evidence
6. Reviewing the forums themselves