Most Australian boards have added artificial intelligence to the risk register without deciding who actually owns it. The result is a familiar pattern: a slide in the quarterly pack, a nod from the audit committee, and no one accountable for the decisions being made week to week. A dedicated AI committee, backed by a short and enforceable terms of reference, closes that gap. This is the template we give directors who want oversight that holds up under scrutiny from ASIC, APRA, and their own shareholders.
Why a committee, not another agenda item
AI risk sits across legal, operational, privacy, and reputational lines at once, which is exactly why it falls through the cracks of existing structures. The audit committee is built for financial controls. The risk committee often lacks the technical grounding to challenge how a model actually behaves. When a customer-facing agent gives wrong advice, or a system quietly trains on personal data, the board question is always the same: who was watching this? A standing committee gives that question a name and a paper trail.
The cost of getting it wrong is no longer theoretical. Under the reformed Privacy Act, serious or repeated interference with privacy now carries penalties into the tens of millions, and a single mishandled dataset can trigger an OAIC investigation that runs well past $45,000 in external legal and remediation costs before the first finding lands. Directors carry personal duties under the Corporations Act to exercise care and diligence, and "the vendor set it up" is not a defence.
What the terms of reference must cover
A good terms of reference is short enough that every director reads it and specific enough that it settles arguments. Seven sections do the work:
Purpose: why the committee exists and the outcomes it is accountable for.
Authority: what it can approve, pause, or escalate without returning to the full board.
Membership: who sits on it, who chairs, and the minimum quorum.
Meeting cadence: how often it meets and what triggers an out-of-cycle session.
Responsibilities: the standing list of what it reviews and signs off.
Reporting: how and when it reports back to the board.
Review: when the terms of reference themselves are reassessed.
Purpose and authority
Write the purpose as a single sentence the chair can recite from memory. Something close to: the committee provides board-level oversight of the organisation's development, procurement, and use of AI systems, and ensures those systems are safe, lawful, and aligned with strategy. Then make the authority section unambiguous. The committee should be able to pause a deployment it judges unsafe, approve AI systems below an agreed risk threshold, and require management to bring higher-risk systems to it before they go live. Vague authority is worse than none, because it invites the committee to be overruled at the worst possible moment.
Membership and cadence
Keep the committee small. Three to five members works well. You want at least one director with genuine technical fluency, one with legal or privacy depth, and a chair who will hold the line. Management attends but does not vote. If the board has no member who can read a model evaluation or ask a sharp question about training data, that is itself a finding, and the fix is either director education through the AICD or an independent adviser with observer status.
On cadence, quarterly is the floor for a mid-sized Sydney or Melbourne business, moving to monthly while any high-risk system is in build. Build in a trigger for an out-of-cycle meeting: a serious incident, a regulatory change, or a proposed deployment above the risk threshold. A committee that only ever meets on schedule tends to learn about its problems from the newspaper.
What the committee reviews each quarter
The responsibilities section is where a terms of reference earns its keep. A workable standing agenda covers:
The current inventory of AI systems in use, and anything added or retired since the last meeting.
Incidents and near-misses, each with a root cause and the fix applied.
Data handling: what personal information each system touches, and how consent and retention are managed under the Privacy Act.
Model performance and drift for anything making or shaping decisions about people.
Third-party and vendor risk, including where models are hosted and who can see the data.
Alignment with APRA CPS 230 operational risk obligations where the organisation is a regulated entity.
The human-in-the-loop position: which decisions a person must still make and sign.
Keeping it proportionate
A five-person accounting firm does not need the same governance as a listed insurer, and a terms of reference that reads like a compliance manual will be ignored. Match the weight of the committee to the risk the organisation actually carries. For many Australian businesses that means a two-page document, a quarterly meeting, and one director who owns the topic. The point is not paperwork. It is that when something goes wrong, and eventually something will, the board can show it asked the right questions in advance and acted on the answers.
If you want help drafting a terms of reference that fits your business and the way you actually use Claude, we build practical AI governance for Australian companies. Book a brainstorm and we will start from your risk profile, not a template someone else wrote.
