The AI governance council meets in the spring. Then there's a reorganization. Then the holidays. Then a new chair who hasn't been told the council exists.
The next meeting is the following August. In between, new AI uses keep arriving, and nobody is convened to look at them.
What GAO found
On October 14, 2026, the Government Accountability Office reported on how the Department of Defense is putting responsible AI into practice. According to officials in its Chief Digital and AI Office, the Responsible AI Working Council, the department's working-level group for coordinating that effort, did not meet from late 2024 until August 2025. Officials from four DOD components said they faced implementation challenges during that gap that collaboration would have helped address.
The council has resumed. GAO found it still lacks a charter defining roles, responsibilities and meeting frequency, so it could lapse again. As of February 2026, three of the ten authorized positions in the division that supports it were filled. GAO recommended a charter and action on staffing. DOD agreed.1
Your firm isn't the Defense Department. The mechanism isn't specific to defense.
Governance that runs on goodwill
A governance body without a charter runs on the energy of whoever convened it. When that person moves on, or gets busy, the meetings stop. Nobody decides to end oversight. It just stops happening.
Meanwhile, the work it was meant to oversee doesn't stop. New use cases launch. Approved ones change. The inventory grows without anyone looking at it.
Architecture review boards could fade the same way during cloud migrations: busiest at the start, quietest when the risky changes arrived.
Make it hard to lapse
Charter: purpose, decision rights, members by role (not by name), quorum, minimum meeting frequency
Standing agenda: new AI uses, changes to approved ones, incidents, open actions
Missed-meeting rule: if [number] weeks pass without a meeting, [named executive or board committee] is told
Staffing: who does the work between meetings, and whether those roles are actually filled
The missed-meeting rule is the alarm. Decide in advance what would tell you governance has stopped, and who hears about it. Otherwise the first sign will be an incident that nobody reviewed. Track it like any other control: put the last meeting date on the risk dashboard, with a threshold that turns it red.
Members by role matters more than it looks. Named members leave. Roles get refilled.
None of this requires a committee. A startup might run AI governance through one accountable person and a monthly calendar slot. The same test applies: if it stopped, who would notice, and how soon?
Governance that nobody would miss isn't governance yet.
Related Reading
Read Beyond Approval: Where Operational Resilience and AI Governance Converge for what happens after approval, when an approved AI system starts getting things wrong.
