Exposure register
Material AI systems, owners, autonomy limits, dependencies, controls, and current exceptions.
Risk Committee playbook
Model risk, autonomy, and third-party exposure.
A reference agenda for the signals, instruments, and reporting cadence a Risk Committee needs as AI deployment expands.
Question one
What this committee oversees.
The Risk Committee oversees enterprise exposure created by AI systems, including autonomy, model behavior, resilience, concentration, third-party dependence, and incident readiness.
Risk owns exposure and response. Audit owns the assurance process and disclosure controls. Technology owns the technical architecture unless the board charter assigns those duties differently.
Reference boundary reviewed 28 July 2026. Committee authority remains subject to each company's governing documents.
Question two
What it should review.
| Signal | Alpha surface | Cadence | Workflow state |
|---|---|---|---|
| Agentic autonomy exceeding approved limits | Terminal · System register | Weekly | Review |
| Model inventory drift against the approved register | Terminal · Model inventory | Weekly | Monitor |
| Third-party AI exposure in the vendor base | Ratings · Supplier view | Monthly | Review |
| Incident and near-miss volume with time to containment | Terminal · Incident log | Weekly | Monitor |
| Conformity gaps against NIST AI RMF and ISO/IEC 42001 | Standard · Criteria mapping | Quarterly | Review |
| Concentration across model providers | Terminal · Provider mix | Quarterly | Escalate |
Workflow states indicate reference review priority. They are not live client data or a statement about any company.
Question three
What Alpha surfaces for it.
Incident record
Events and near misses connected to containment time, decision owners, and corrective action.
Provider concentration view
Operational and contractual dependence across model, infrastructure, and data providers.
Question four
What it receives.
| Deliverable | Cadence | Format | Channel |
|---|---|---|---|
| Risk exception pack | Quarterly | Board brief | Board package |
| Threshold breach alert | Continuous | Alert | Terminal |
| Incident review | On event | Decision record | Committee portal |
| Provider position | Quarterly | Benchmark | Committee portal |