Grace is the Chief People Officer at a 7,500-person national retailer that hires roughly 3,000 people a year across stores, distribution centers, and a corporate office. Three weeks ago her talent acquisition director came within a signature of deploying an AI resume-screening tool across all hourly hiring. The vendor was credible, the demo was clean, and the purchase order was sitting in procurement. What stopped it was an accident: a junior recruiter mentioned the tool to a friend in legal, who asked whether anyone had run a bias audit. No one had. No one had asked whether candidates in New York City would get the notice the law requires. No one had asked who would own the tool once it was live. The deal was paused. Grace realized the near-miss was not a vendor problem or a recruiter problem. It was a governance vacuum: no committee, no decision authority, and no policy saying a screening tool cannot go live until specific people sign off. This lesson is the structure she builds so the next near-miss is a routine approval instead of a crisis.

Governance is not a binder of policies on a shelf. It is the set of standing answers to four operational questions: who decides whether an AI tool can be used, who is accountable when it goes wrong, what has to be true before it goes live, and how a concern gets escalated when something looks off. Without clear structures, roles, and decision authority, organizations lose control in a predictable way. Tools proliferate without review. Decisions get made without adequate consideration of fairness, compliance, or operational impact. Problems go undetected until they become crises.

The design problem is a balance. Get it wrong in one direction and you have governance theater: policies nobody enforces while tools spread anyway. Get it wrong in the other and you have a committee so slow that recruiters route around it, and the underground deployments with no oversight at all become the ones that hurt you. Grace needs governance rigorous enough to have caught the screening tool and light enough that it does not cost her function three months on every decision.

Who Sits on the Committee

The heart of the structure is a standing AI governance committee for recruiting, sometimes called an AI steering committee, and the word standing is doing real work. This is not a task force that meets once and dissolves. It is a permanent body with genuine authority over four things: it approves new tools, it monitors fairness and compliance, it investigates concerns raised from anywhere in the function, and it escalates issues to executive leadership when they exceed its own remit. A committee that can do only the first of those is a procurement checkpoint, not governance.

Grace charters it with seven members, because she needs every function that can see a different failure mode in the room, and because a larger committee stops making decisions and starts holding discussions. The members are: Grace as executive sponsor and chair; the VP of Talent Acquisition who owns recruiting outcomes; a data and analytics lead who can read a fairness metric and commission a bias audit; an employment-law counsel who owns regulatory defensibility; an HR business partner who owns accommodation and candidate experience; an information-security lead who owns data handling and vendor security; and the TA operations manager who owns the workflow the tools plug into. Organizations with an internal audit function should add it as an eighth seat.

Cross-functional membership is the entire point. Recruiting wants speed. Legal wants defensibility. Data wants a measurable fairness baseline and sound data governance. Security wants to know where candidate data lives. HR wants to know what happens to a candidate who needs an accommodation. When those perspectives are siloed, a tool clears the one review it happens to land in and skips the four it needed. The near-miss happened precisely because the screening tool touched recruiting and procurement but never reached legal, data, or HR.

The chair matters as much as the membership. The role needs someone with authority and standing across every function represented, which usually means the CHRO or the general counsel rather than a recruiting leader. The chair holds two powers nobody else does: the authority to decide when the committee cannot reach consensus, and the authority to escalate to the executive team. Without the first, a committee that disagrees simply defers, and deferral is how tools ship unreviewed.

Grace sets the cadence to monthly for the first year, while the function is standing up multiple tools and the policy is still maturing, then quarterly once the approval backlog clears and monitoring is routine. She writes in an out-of-cycle path: any member can convene the committee within five business days for an urgent fairness or legal concern, because the law and the harm do not wait for the calendar. The charter caps the approval SLA at fifteen business days from a complete submission, so recruiters know that governance is a three-week step, not an open-ended one. That published number does more to prevent route-arounds than any enforcement policy.

The cost of skipping this structure is concrete. A financial services company deployed an AI resume-screening tool without committee approval. It turned out to have disparate impact on candidates from certain geographies, and by the time anyone detected it, thousands had already been screened. Committee review beforehand would have required fairness testing and prevented the problem. Instead the company had to manually re-review every candidate the tool had touched, an exercise that was both expensive and embarrassing.

Decision Authority: A RACI for AI Tool Decisions

A committee with no decision rights is a discussion group, and a committee that must approve everything is a bottleneck. The fix is an explicit decision-authority matrix that names, for each type of decision, who is Responsible for the work, who is Accountable as the single owner of the outcome, who must be Consulted before the decision, and who is merely Informed after it. Decision authority is the explicit right to make a call, and writing it down prevents exactly the confusion that let the screening tool reach procurement unowned.

• Approving a new screening or assessment tool. VP of Talent Acquisition Responsible, chair Accountable, legal and data and security and HR Consulted, recruiting team and procurement Informed.
• Signing off on the annual bias audit. Data and analytics lead Responsible for commissioning and interpreting it, employment-law counsel Accountable because the audit is ultimately a defensibility artifact, VP of TA and chair Consulted, full committee and executive team Informed.
• Granting a policy exception. VP of Talent Acquisition Responsible, chair Accountable so exceptions cannot be granted quietly at a lower level, legal and the requesting manager Consulted, full committee Informed so every exception is visible to whoever might be asked to grant the next one.
• Responding to a fairness or compliance incident. Data and analytics lead Responsible for the investigation, chair Accountable for the response, legal and VP of TA and security Consulted, executive team and affected candidates Informed.

The matrix is strict about one rule: exactly one Accountable owner per decision, never two. When the screening tool nearly went live, the failure was that everyone assumed someone else owned the sign-off. Accountable means that if it goes wrong, that person answers for it. Responsible can be shared; Accountable cannot. That distinction is what turns a RACI from a chart into a control.

Tiering Decisions So the Committee Guards What Matters

Not every recruiting decision rises to the committee. If you review everything, the committee becomes the bottleneck it was chartered to prevent. Grace tiers the work so the matrix governs only what needs scrutiny, and publishes the tiers so a recruiter can tell which lane a decision falls into without asking anyone.

• High risk, full committee approval. Any AI tool that assesses hiring-related traits such as culture fit, capability, or potential. AI that makes or heavily influences offer decisions. Historical hiring data used to train or tune a model. Any tool that uses protected characteristics, or proxies for them, as inputs. Screening, scoring, ranking, and assessment sit here by definition.
• Medium risk, data review plus fast-track approval. Tools that improve efficiency without changing decision criteria, such as interview scheduling and coordination. New job descriptions or evaluation rubrics. Changes to interview processes. New sourcing channels or vendor relationships. These go to the VP of TA and the data lead, with the committee informed rather than convened.
• Low risk, notification only. Staffing changes within the recruiting team. Procedural updates that do not affect how candidates are evaluated. Internal communication and training updates.

The value of the tiering is symmetrical. The committee stops spending meeting time on rubric wording, and recruiting leaders stop waiting three weeks for permission to change a template, while the changes that could genuinely affect fairness or compliance still get proper review. The committee guards the screening decisions and stays out of the recruiters' daily work, which is the only way the recruiters keep bringing the screening decisions to the committee.

Roles and What Each Member Is Accountable For

Membership alone does not produce accountability. Each seat needs a written definition of what that person brings and, more importantly, what they answer for. Grace writes one paragraph per role into the charter, because a defined role is what stops the sentence that kills governance: "I assumed that was somebody else's call."

• Committee chair. Ensures meetings happen, drives decisions to closure, escalates to executive leadership, owns overall governance health. Accountable for whether governance works at all.
• Recruiting lead. Explains what problem a proposed tool is solving and advocates for the people who will use it daily. Accountable for the recruiting team's compliance with committee policy.
• Data and analytics lead. Explains how a tool actually works, conducts fairness testing, monitors metrics between meetings. Accountable for data quality and fairness measurement.
• Legal and compliance lead. Assesses regulatory risk, reviews vendor contracts, ensures compliance with FCRA, EEO obligations, GDPR, and jurisdiction-specific rules. Accountable for legal defensibility.
• HR lead. Assesses cultural impact and effects on employee and candidate experience, monitors training and capability needs. Accountable for organizational change management.
• IT and security lead. Assesses security risk, reviews data handling, confirms IT requirements are met. Accountable for data security and system stability.

When every seat has a written accountability, two things change. Nobody can disclaim responsibility after the fact, because the charter says whose lane it was. And when a decision has to be made quickly, everyone already knows who has the authority to make it, which removes the most common source of governance delay: not disagreement, but uncertainty about who is allowed to decide.

Walking One Tool Through the Committee

Abstract authority is hard to trust, so Grace runs the paused screening tool through the new process as the committee's first real case. Because it scores candidates, it is unambiguously high risk and enters the full workflow rather than the fast track. Step one is intake: the VP of TA files a one-page submission covering what the tool does, which roles and locations it touches, what data it uses, and what problem it solves. The fifteen-day clock starts only when that submission is complete, which keeps half-formed requests out of the queue.

Step two is parallel review, where the four Consulted functions assess in their own lane at the same time rather than in sequence, because sequential review is how a three-week process becomes a three-month one. Each lane finds something. Data asks whether there is an applicant-demographic baseline to measure adverse impact against, finds there is not, and that becomes a precondition. Legal flags that some applicants apply from New York City, so Local Law 144 applies and an independent bias audit must be commissioned, published in summary, and paired with candidate notice before any live use. Security reviews where resume data is stored and whether EU candidate data is in scope for GDPR. HR confirms there is an accessible alternative path for a candidate who cannot complete an automated step, an ADA accommodation requirement rather than a courtesy.

Step three is the decision. At the monthly meeting the committee does not vote yes or no; it issues a conditional approval with named gates. Deploy on a single job family only. Build the demographic baseline first. Commission the Local Law 144 audit, publish its summary, and put candidate notice live before the tool touches anyone. Run a quarterly adverse-impact review under the four-fifths rule. Step four is the record: the chair signs, the conditions are documented, and the recruiting team is Informed of exactly what was approved and what was not. The tool that nearly shipped in a week now ships in a quarter, with an audit, a baseline, candidate notice, and a named owner.

The Policy the Committee Owns

The committee is the body; the policy is what it enforces. Grace's AI-in-recruiting policy is short and has five load-bearing components, each written as an obligation with a named owner rather than as a principle, because principles are what governance drifts into when it becomes unenforceable.

Bias-audit and adverse-impact accountability. Every tool that screens, scores, or ranks candidates must have an independent bias audit before deployment and annually thereafter, and the data lead must run a quarterly adverse-impact review using the four-fifths rule, the EEOC threshold under Title VII where any group's selection rate below 80 percent of the highest group's rate triggers scrutiny. The committee owns ensuring those audits are actually commissioned, not merely promised, because a promised audit and no audit look identical in a policy document and completely different in a deposition.

Local Law 144 compliance. For any automated employment-decision tool used on candidates who apply from New York City, the committee is responsible for ensuring the annual independent audit is done, its summary is published, and candidates receive the required notice at least ten business days before the tool is used on them. ADA accommodation ownership. The HR lead owns a documented alternative path so a candidate who cannot complete an automated assessment the same way is evaluated through an equivalent route rather than screened out by the format. Data handling and GDPR. The security lead owns where candidate data is stored, how long it is retained, and the lawful basis and rights handling for candidates in the EU.

Human-in-the-loop decision authority. AI recommends; a named human decides. No automated tool may issue a rejection or an offer on its own, and every adverse decision passes through an identified recruiter who can be asked to explain it. This is the component that keeps the entire system accountable, because there is always a person, not a model, who owns the outcome. It is also the one most often eroded quietly under volume pressure, which is why the committee reviews it specifically rather than assuming it holds.

Escalation and Incident Response

Most concerns should resolve inside the committee. Some have to climb. Grace defines four escalation triggers that move a concern from the committee to the executive team: credible legal exposure, meaning could we be sued; evidence of a fairness violation, meaning is our process or outcome discriminatory; operational disruption significant enough to threaten the ability to hire; and reputational risk to the employer brand. Any one of them converts a committee discussion into an executive decision, and they are written as questions so a member can apply them without needing the chair's interpretation.

The path is deliberately concrete so a concern cannot evaporate into a hallway conversation. A concern is raised through a named channel: a monitored inbox, an ethics hotline, or a direct conversation with a committee member. The data lead and the recruiting lead investigate and document what they find, whether or not the concern is substantiated. If a trigger is met, the chair escalates to the executive sponsor or CHRO within the five-day urgent window. The executives decide to continue, modify, pause, or terminate the tool. The outcome is recorded and communicated back to the recruiting team and to any affected candidates.

One case shows the path working. A recruiting team noticed that an AI tool appeared to be filtering out candidates with certain accents. They raised the concern to the committee, which investigated and confirmed potential bias. Because that met the fairness-violation trigger, it went to the CHRO and legal, the tool was paused, the vendor was questioned, and the company ultimately selected a different tool. Without a written path, that concern would most likely have been raised informally, discussed sympathetically, and dropped, because nobody would have owned the next step. Writing it down is what gets a real concern a documented investigation and a recorded decision rather than a shrug.

Communication and Transparency

Governance is only effective if people understand it and trust it, which makes communication part of the structure rather than an afterthought. Grace publishes five things: the structure itself, meaning who is on the committee and what decisions they make; major decisions with reasoning attached, so an approval reads as a judgment rather than a rubber stamp; fairness results; escalations and their outcomes, so people can see concerns being acted on; and trends and improvements.

The audiences differ. The recruiting team needs the process because they have to use it. Executive leadership needs to know governance exists and functions, particularly before a board or a regulator asks. In a large or heavily regulated company the board itself may need visibility, and a sanitized version can be shared with candidates so they understand the process they are entering is fair and well governed. The channels are ordinary: committee updates to the recruiting team, an annual governance report to leadership, a monthly fairness dashboard for the committee, and an annual all-hands discussion of recruiting ethics and fairness.

Transparency works because people trust systems they understand and decisions that get explained, but its second-order effect matters more. People escalate concerns only when they believe the system will take them seriously, and the evidence for that is a visible record of previous concerns being investigated and acted on. A governance structure nobody can see is one nobody will use.

Fitting Governance to Your Organization

The structure Grace built suits a 7,500-person retailer; it is not a template to copy at any scale. The best governance is fitted to the organization's size and maturity. A startup might run an informal committee of three that meets weekly and keeps decisions in a shared document, and that can be genuinely effective. A large enterprise might need formal governance with a standing committee, detailed written policies, and an internal audit function that tests compliance independently. Both work when they match the organization; neither works when borrowed from one of a different size.

What does scale reliably is the need itself. With one tool, you can supervise it manually and probably will. With five tools across multiple workflows, ad hoc supervision stops covering the surface area. When AI influences hiring decisions affecting thousands of people a year, as at Grace's company, you need rigorous oversight with documented accountability. Governance requirements track deployment scope, not company size alone.

Many organizations skip governance because it reads as overhead against no visible benefit. Then a problem emerges: a tool with disparate impact, a compliance violation, a complaint that reaches an executive. Governance suddenly becomes urgent and gets built under time pressure with a live problem to remediate. Grace's committee cost a charter document and a monthly meeting; the financial services company's remediation cost a manual re-review of thousands of candidate files.

Anti-Patterns in Governance Structures

Governance without teeth. The committee exists, the policy is published, and nothing is enforced. A tool gets deployed without approval; the committee objects; the tool stays. Quarterly fairness monitoring does not happen. The sequence is consistent: the policy says every new tool requires fairness testing, a team eager to move fast deploys without testing, you raise it, they promise to test later, later never comes, and other teams notice. Once people learn that policies do not matter, the committee's authority erodes past recovery. Grace's defense is one visible precedent: the first tool that goes live unapproved gets pulled, publicly and immediately.

Governance that is too rigid. The opposite failure is a process so strict that good ideas die in it. A recruiter has a sensible small pilot, testing a new interview format with one team. It goes to the committee, which meets next month, discusses, wants more data, needs legal review. Three months later the pilot might start, except that by then the recruiter has moved on and the idea is dead. Rigidity frustrates the people doing the work and teaches them to look for ways around governance, which is how underground practice develops. Grace's defense is the tiered matrix and the published SLA, which keep the committee out of low-risk work and make the high-risk path predictable enough that using it is not a sacrifice.

Siloed decision-making despite governance. The third failure is subtler because the committee exists and looks healthy while people route around it. A recruiter makes a significant tool decision with just their own network. A data team changes evaluation logic without telling recruiting. The consequence is what the committee was built to prevent: recruiting selects an AI assessment tool without data governance input, and only later does the data team discover it depends on historical hiring data that is incomplete and potentially biased. By then the contract is signed and renegotiating takes months. Grace's defense is to make the committee the default path, state plainly that decisions made outside it may be revisited, give each member responsibility for tracking decisions in their domain, and make committee decisions visible.

Practice

Each of these produces an artifact you could put in front of an executive sponsor. Governance that exists only as intention is the first anti-pattern in the making.

• Design your governance structure. Based on your organization's size and maturity, decide who sits on the committee, what the chair's role is and who holds it, and what the reporting line into the executive team looks like. Produce an org chart or written description, and be honest about whether the structure you drew matches the organization you have.
• Create your decision authority matrix. List ten to fifteen decisions your recruiting function actually makes. Sort each into high risk requiring full committee review, medium risk taking a fast track, or low risk requiring notification only, and write the justification. Then apply the real test: could a recruiter place a new decision in the right tier without asking anyone?
• Define roles and accountability. For each seat, recruiting, data, legal, HR, and IT, write one paragraph on the responsibilities and one on what that person is accountable for, specific enough to settle an argument about whose call something was.
• Design the escalation process. Define the criteria that move a concern from committee to executive leadership, then build a checklist covering who gets notified when and the timeline for a decision. Walk a real past concern through it and see whether the path would have caught it.
• Create a governance communication plan. Decide what you will share about the structure, on what cadence, through what channel, and how you will make the case to people who currently experience governance as overhead.

Reflection

These questions are worth answering before you write the charter, because they usually reveal where the real gap is.

• What is the most important decision your recruiting function makes, and what perspectives would you want represented that currently are not?
• Have you seen a decision made without adequate cross-functional input? What went wrong, and which seat would have caught it?
• How would you know if your governance was working? What would success look like in numbers rather than sentiment?
• What decision is your organization making right now where you would want committee input, and why has it not gone to one?
• If someone on your team had a fairness concern today, could they name the escalation path without looking it up?

Glossary

• AI steering committee. A standing cross-functional committee responsible for approving AI tools, monitoring fairness and compliance, investigating concerns, and escalating issues. Membership spans recruiting, data, legal, HR, and IT leadership.
• Decision authority. The explicit right to make a particular decision. Its absence is the most common cause of unowned deployments.
• Escalation. Moving a concern or decision up the hierarchy when it meets defined criteria: legal risk, fairness risk, reputational risk, or operational impact.
• Cross-functional. Involving multiple functions, typically recruiting, data, legal, HR, and IT, so that multiple perspectives inform a decision rather than one deciding for all.
• Disparate impact. Hiring outcomes that disproportionately exclude members of protected groups. Governance should monitor for it continuously and act when it appears.
• RACI. A decision-mapping convention naming who is Responsible for the work, Accountable as single owner of the outcome, Consulted before the decision, and Informed after it.

Related Lessons

Governance structure is the frame; several other lessons supply what hangs on it.

• Policies for AI Use: What Should Be Required, Prohibited, or Encouraged? goes deeper on drafting the policy the committee enforces, turning a membership list into enforceable obligations.
• Escalation Processes: How Concerns Flow Up and Decisions Get Made expands the escalation path here into a full workflow, including how concerns get triaged before reaching the committee.
• Legal and Compliance Partnerships: Ensuring AI Use Is Defensible covers the relationship that makes the legal seat productive rather than adversarial.
• Metrics and Monitoring: Tracking Efficiency, Quality, and Fairness supplies the fairness dashboard the committee reviews, without which monitoring is a promise rather than a practice.
• Third-Party Tools and Vendors: Due Diligence and Contracts addresses the vendor half of tool approval, including what to ask before procurement gets attached to a decision.
• Hands-On Project: Draft Governance Framework and Policies turns the exercises above into a complete written framework for an executive sponsor.

Closing

Governance structures are the infrastructure that lets AI scale responsibly. Without structure you are deciding ad hoc and hoping you missed nothing important, which works right up until it does not. With structure you have systematic oversight, named people who are accountable, and processes that catch problems before candidates feel them. Leading responsible AI in recruiting means shaping how people are evaluated for opportunity, which is a real form of power, and governance is how that power gets exercised accountably rather than casually.

Grace measures her committee by a simple operating tempo: a monthly meeting, roughly eight to twelve formal decisions a quarter, a fifteen-day approval SLA, and a count of zero high-risk tools live without a signed approval. When those numbers hold, the next screening tool that shows up at procurement does not become a near-miss. It becomes a Tuesday.

Key Takeaways

• Charter a standing committee, not a task force. Seven cross-functional members spanning recruiting, data, legal, HR, security, and operations under a chair with authority across functions, typically the CHRO or general counsel, on a monthly cadence with a five-day urgent path. The near-miss happened because a high-stakes tool reached procurement without ever reaching legal, data, or HR.
• One Accountable owner per decision. A RACI covering tool approval, bias-audit sign-off, policy exceptions, and incident response works only if exactly one person is Accountable for each. Responsible can be shared; accountability cannot.
• Tier decisions so the committee guards what matters. High risk means trait assessment, offer influence, training on historical hiring data, and any use of protected characteristics or their proxies. Medium risk means efficiency tools, rubrics, interview changes, and new sourcing channels. Low risk means staffing and procedural updates. A published fifteen-day SLA is the best defense against route-arounds.
• Write down what each seat is accountable for. Chair owns governance health, recruiting owns team compliance, data owns quality and fairness measurement, legal owns defensibility under FCRA, EEO, and GDPR, HR owns change management, IT owns data security. Written accountability is what stops "I assumed that was someone else's call."
• The committee owns five policy obligations. Independent bias audits with quarterly four-fifths adverse-impact review under Title VII, Local Law 144 audit plus published summary plus candidate notice for NYC applicants, an ADA accommodation alternative owned by HR, GDPR data handling owned by security, and a human-in-the-loop rule where AI recommends and a named human decides.
• Write the escalation path down. Four triggers, legal exposure, a fairness violation, operational disruption, and reputational risk, move a concern from committee to executive team. A named channel, a documented investigation, and a recorded decision keep a real concern from dissolving into a hallway conversation.
• Communicate the structure and fit it to your organization. Publish who decides what, explain major approvals, share fairness metrics, and report escalation outcomes, because people escalate only when they believe the system will act. A startup can run an informal weekly committee; a regulated enterprise needs formal policy and an audit function, and building either proactively is cheaper than building it during an incident.

Frequently Asked Questions

Who should chair the committee if we do not have a CHRO? The requirement is authority and credibility across every function represented, not a specific title, which usually points to the general counsel, the head of people, or a chief operating officer. What does not work is a recruiting leader who can be overruled by a peer, because the chair's two real powers are deciding when consensus fails and escalating when the committee's remit is exceeded. A chair who can do neither turns the committee back into a discussion group.

How do we keep the committee from becoming a bottleneck? The tiered matrix keeps the committee out of medium and low-risk decisions so its agenda stays short enough to clear, and the published SLA converts governance from an open-ended wait into a known cost. Recruiters route around governance mainly when they cannot predict how long it takes. If the SLA starts slipping, that signals the tiering is wrong, not that the committee needs more meetings.

What happens when a tool goes live without approval? It gets pulled, immediately and visibly. This is the only reliable defense against the governance-without-teeth failure, because a single enforced precedent propagates faster than any policy memo. The alternative, raising it, accepting a promise to fix it later, and watching later never arrive, teaches everyone the policy is optional, and once that lesson lands the committee's authority does not come back.

Is a bias audit the same thing as our internal fairness testing? No, and conflating them creates real exposure. Internal fairness testing is the quarterly adverse-impact review the data lead runs using the four-fifths rule, a monitoring practice you own. A bias audit under NYC Local Law 144 must be independent, must have been conducted within the prior year before the automated employment decision tool is used, and its summary must be published, with candidates notified at least ten business days before the tool is used on them. Independent means not the vendor and not your own team. You need both.

We are too small for a seven-person committee. What is the minimum viable version? A named person who decides, a named person who can veto on legal grounds, a named person who can read the fairness numbers, and a written record of what was decided and why. What does not scale down is the substance: the bias audit obligation, the candidate notice obligation, the accommodation path, and single-owner accountability apply regardless of headcount, because the law does not size its requirements to your org chart.