What You Can Do By The End

• Compare three operating models
• Define an AI council
• Describe a center of excellence
• Assign roles with one accountable owner
• Draft policies and a vendor checklist

Why A Pilot Needs An Operating Model

• Who may approve a new tool?
• Who pays for it?
• Who answers when an output causes harm?
• Without answers, every team invents rules

Three Ways To Organise

• Central: one team owns AI
• Federated: each unit builds its own
• Hub and spoke: shared standards, local ownership
• Most mid and large firms end at hub and spoke

The AI Council

• Seven to ten members with real authority
• Executive sponsor plus IT, security, legal, data protection
• HR, finance, business units and a user voice
• Monthly at first

What The Council Owns

• Approved use cases and risk tiers
• Policies
• Shared budget and priorities
• Review of incidents and results
• Record every decision and reason

Risk Tiers Keep The Council Fast

• Low: standard checklist, no meeting
• Medium: hub review
• High: AI council, for example decisions on people
• Tier decided at intake by the hub

Team proposes use case
  -> Hub assigns risk tier
     -> Low: checklist, proceed
     -> Medium: hub review
     -> High: AI council decision

The Center Of Excellence

• Runs the platform and approved tools
• Provides templates, evaluation, training
• Supports discovery and pilots
• Publishes patterns that worked

Measure The CoE By What Others Achieve

• Teams that run use cases on their own
• Reuse of templates
• Time from idea to pilot
• Satisfaction of business units

Case: Source Code In A Chat Window

• Employees pasted internal code into a public chatbot
• The company then restricted such tools
• The problem was real, so was the need
• Missing: an approved tool and a data rule

Roles For Every Use Case

• Business owner: accountable for outcome
• Product owner: runs day to day
• Technical owner: security and uptime
• Data owner: approves data use
• Risk and compliance contact

A RACI For One Use Case

• One accountable person per decision
• Responsible, Accountable, Consulted, Informed
• Fill it before launch, not after an incident

Policies People Can Follow

• Acceptable use and forbidden data
• Approved tools and how to request one
• Human review and disclosure rules
• Personal data under KVKK and GDPR
• Incident reporting

Vendor Management

• Where is data stored and processed?
• Does our data train their models?
• Which sub processors and certifications?
• How are incidents and model changes announced?
• What happens to our data on exit?

Contracts And The Vendor Register

• Data processing agreement and service levels
• Notice periods for model changes
• Exit and export terms
• Register: owner, data, risk tier, renewal date

Recap

• Hub and spoke fits most firms
• A small council with real authority
• Tiers keep approval fast
• One accountable owner per use case
• Short policies with a route, vendors on a register

Next Week: Scaling And Risk

• Monitoring and human oversight
• Incident response, lock in, model change

Questions And Exercise

• Draft a two page operating model
• Tier three use cases
• Test the vendor checklist on a real vendor