All services Every engagement has a fixed, published price. Book a strategy call
The build guide for the function that makes AI governance real: the mandate, the staffing maths, the operating rhythm, the first sixty days, and the five signals that show it is working rather than performing.
At some point the theory runs out. The board has asked the seven questions, the operating model is on a slide, and somebody says the sentence that decides whether any of it becomes real: who is going to run this? The answer is the AI governance office, and most organisations get it wrong in one of two directions: they create nothing and hope the policy self-executes, or they create a fifteen person committee that meets quarterly and decides nothing.
This is the build guide for the third option: a small, named function that works. It is the design we install for clients, published in full, because the design was never the hard part. Running it is.
The short answer. An AI governance office is the small, named function that runs AI governance day to day: it keeps the AI register live, operates intake and approvals, owns the policy, watches monitoring, coordinates incidents and assembles evidence. In most organisations it is one accountable lead, often fractional, with specialists on call and authority delegated in writing from a single accountable executive. It is an operating function rather than a committee.
The office is a function, in the same sense that financial control is a function: continuous, named, and accountable for a register being right. It reports to the accountable executive who owns AI risk, and it holds delegated authority to approve, refuse and set conditions within the risk appetite the board has set.
It is not a committee. Committees have their place, as an advisory panel the office convenes when a hard case needs legal, security or domain judgement. But a committee cannot own a register, answer an intake ticket on Tuesday, or be named in an audit finding. The most reliable sign of governance theatre is an AI ethics board with a charter and no inventory.
| Duty | What it looks like in practice |
|---|---|
| The AI register | A live inventory of every system, built, bought or embedded, each with an owner, tier and review date. The office keeps it current. It does not wait to be told. |
| Intake and approvals | Running the gate: a thirty minute intake form, a fast lane for low risk tools, documented decisions, and refusals on record. |
| The policy | Two pages people can follow: what needs approval, what is banned, what may never enter a public tool. Owned, versioned, refreshed. |
| Monitoring oversight | Making sure every material system has thresholds and a named human override, and coordinating the incident route when one trips. |
| Evidence assembly | Per system evidence packs kept current, so a regulator, customer or insurer request is a retrieval job rather than a project. |
| Horizon watching | EU AI Act dates, vendor pushed AI features, new obligations. The estate changes weekly. Someone has to notice. |
Equally important is what the office does not own. It does not own the systems: named business owners do, and the office holding their risk for them is how ownership quietly dies. It does not run ethics theatre. And it must not become a bottleneck, which is why its service levels matter as much as its duties.
The consulting industry has an incentive to size this function generously. Our experience building them points the other way. In organisations below a few hundred staff, the office is typically a fractional role: a governance lead spending a fifth to half of their week on it, drawn from risk, security or architecture. Mid sized organisations usually justify the first dedicated role, part analyst, part gatekeeper. Only large or heavily regulated estates need a team, and even then rarely more than a handful, because the system owners rather than the office carry the day to day weight.
The lead needs an unusual but findable profile: governance or risk discipline, enough technical literacy to read a model card without flinching, and the standing to say no to a senior sponsor. They do not need to be a machine learning engineer. Around them sits a borrowed bench, data protection, security, legal, data science, engaged case by case rather than owned.
The anti pattern is hiring a Head of AI Ethics before a register exists. Titles do not govern estates. Registers do.
Weekly: intake triage and approvals. The fast lane clears low risk requests within five working days, standard requests within fifteen. Anything slower breeds shadow AI. Monthly: register review, monitoring exceptions, and a sweep of vendor releases for AI features that arrived uninvited. Quarterly: the board report, estate change, high risk status, incidents, refusals, obligations falling due, and a policy sanity check. Annually: independent assurance of the whole arrangement, because the office builds and assurance checks, and they must never be the same hands.
Then decide how it runs long term. Build it yourself using this design. It is published precisely because it is not secret. Have it stood up for you: our AI Governance Office engagement installs the working function, policy, intake, approvals and evidence, from £30,000 + VAT, and hands it over. Or run it retained through AI Risk-as-a-Service from £8,000 a month, which suits organisations that want the function without the hire. If a capable risk team has headroom, the honest advice is the first option.
Five signals, none of them vanity metrics. Decisions come back inside the service levels. Every system on the register has a named owner and a current review date. Refusals and conditional approvals exist on the record, because a gate that always says yes is not a gate. Incidents surface through monitoring rather than through customers. And when an evidence request arrives, the answer takes days rather than weeks. When those five hold, the office has earned the only reputation that matters: the route to yes that is faster than going around it.
It runs AI governance day to day: keeps the AI register live, operates intake and approvals with published service levels, owns the policy, oversees monitoring, coordinates incidents and assembles the evidence packs that regulators, customers and insurers ask for. System owners keep owning their systems. The office runs the framework around them.
Fewer than most designs claim. Smaller organisations typically run it as a fraction of one experienced role with specialists on call. Mid sized organisations justify one dedicated person. Only large or heavily regulated estates need a small team. The register and the delegated authority matter more than the headcount.
The single executive accountable for AI risk, commonly the CIO, CTO or chief risk officer, with a standing quarterly line to the board. Reporting into a committee dilutes the accountability the office exists to create.
Built internally, the cost is mostly the time of existing senior roles. Stood up by Intelance as a working function, policy, intake, approvals and evidence included, it is from £30,000 + VAT, or run as a retained service through AI Risk-as-a-Service from £8,000 a month. If no inventory exists yet, a two week QuickScan from £15,000 + VAT comes first.
They need the function rather than the headcount. A fractional lead with a live register, a fast intake path and delegated authority delivers everything this article describes at a scale a fifty person company can afford. What no organisation can safely skip is the register and a named route to yes.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with the adviser who wrote this guide. A clear view of your exposure, the sensible first step and its published fee.
Talk to a senior adviser
AI Governance
AI Governance