Key facts

  • An operating model covers decision rights, committees, workflows and escalation paths.
  • It sits below your governance principles and above day-to-day tooling.
  • Should be proportionate — a lightweight model works for most SMEs.
  • Use the free operating model canvas to design yours.
  • Review the model itself periodically, not just the AI systems it governs.

The core components

An operating model answers four practical questions: who has authority to approve a new AI use case; which group (a committee, a working group, or a single accountable owner) reviews risk and exceptions; what workflow a new AI system goes through from request to deployment; and where an issue escalates if oversight reveals a problem.

Sizing it to your organisation

A large enterprise might need a formal AI governance committee meeting monthly, with sub-groups for legal, security and risk. A small business might need nothing more than a single accountable owner who reviews new AI requests against a short checklist. Both are legitimate operating models — what matters is that decision rights and escalation paths are actually clear and followed, not that the structure looks impressive.

Common failure modes

The most common failure is having governance principles and policies but no actual operating model behind them — so decisions get made ad hoc, inconsistently, by whoever happens to be asked. The second most common failure is building an operating model too heavy for the organisation's size, which people route around rather than follow.

Getting started

Use the free operating model canvas to sketch decision rights, review cadence and escalation paths in a single working session, then refine it as real cases test the design.

Frequently asked questions

What is an AI governance operating model?

How governance is structured and runs day to day — decision rights, committees, workflows and escalation paths.

Does a small business need a formal governance committee?

Not necessarily — a single accountable owner with a clear review process can be a legitimate, proportionate operating model.

What is the most common governance operating model mistake?

Having policies and principles with no actual operating model behind them, so decisions get made ad hoc.

How do you design an AI governance operating model?

Start with the free operating model canvas to sketch decision rights, review cadence and escalation paths.

How often should the operating model itself be reviewed?

Periodically, alongside your wider governance review — not just the AI systems it governs.

Related pages

Sources

Last updated 19 June 2026.