Operating model, governance and risk
How you organise determines how fast you scale — and how safely. This module covers operating models, governance and leadership risks.
Learning objectives
- Compare AI operating models
- Describe a centre of excellence's responsibilities
- Design risk-tiered governance
- Identify strategic AI risks and responses
5.1 Organising for AI
| Model | How it works | Trade-off |
|---|---|---|
| Centralised | One central AI team builds for everyone | Consistent and expert, but a bottleneck far from the business |
| Decentralised | Each business unit does its own AI | Fast and close to need, but duplicated effort and uneven risk control |
| Hub and spoke | A central hub (centre of excellence) sets standards, platforms and guardrails; spokes in business units deliver use cases | Balances speed and control — the most common choice at scale |
5.2 What the hub does
- Owns shared platforms, approved tools and reusable components
- Sets standards for evaluation, security, data and documentation
- Runs the use-case pipeline and portfolio reporting
- Provides expertise and coaching to spoke teams
- Coordinates AI literacy and training
5.3 Governance that enables
Good governance makes it easier to do the right thing quickly. Tier oversight by risk: a light-touch checklist for low-risk internal productivity uses, deeper review for customer-facing or high-impact systems. Core elements:
- An AI policy and acceptable-use rules for staff
- An inventory of AI systems with owners and risk ratings
- Risk assessment and approval before deployment
- Monitoring, incident reporting and periodic review
- Clear accountability — a named owner for every system
The full approach is in AI Governance and Responsible AI.
5.4 Strategic risks for leaders
| Risk | Leadership response |
|---|---|
| Doing nothing — competitors move faster | A funded portfolio with clear priorities |
| Shadow AI — staff use unapproved tools with company data | Provide approved tools, clear rules and training |
| Reputational harm from errors or bias | Risk-tiered review, testing, human oversight |
| Regulatory breach | Inventory, risk classification, legal involvement early |
| Vendor dependency | Multi-model design, exit terms, data portability |
| Workforce anxiety | Honest communication, reskilling, involving staff in redesign |
5.5 The board's role
Boards should understand the AI strategy, risk appetite and major systems; receive regular reporting on value delivered and incidents; and make sure accountability is clear. Directors don't need to be technical, but they do need to be AI-literate enough to ask good questions.
Sketch an operating model for AI in your organisation: hub or no hub, which teams are spokes, what the hub owns, and the three governance controls you'd introduce first.
See a worked example
Example — 800-person company: A small hub (4 people) inside the digital team owns the approved assistant, the model platform and standards. Spokes: customer service, finance, marketing, each with an AI champion. First controls: acceptable-use policy, AI system inventory, risk checklist before any customer-facing launch.
Key takeaways
- Hub and spoke balances speed and control.
- The hub owns platforms, standards, pipeline and coaching.
- Tier governance by risk so low-risk uses move fast.
- Shadow AI is best tackled with approved tools and training.
- Boards need AI literacy, reporting and clear accountability.