10.3 Establish an AI Council

Establish an AI council — Microsoft's official skill name

Quote the skill the way the July 22, 2026 AB-731 study guide writes it: Establish an AI council to guide strategy, oversight, and cross-functional alignment. That sentence is the job description. If your "council" only shares Copilot tips, you built a community of practice. If it cannot halt a high-risk agent, set allowed uses, or force legal, HR, and IT into the same decision, you have not established the council the skill describes.

Microsoft Learn's Responsible AI at Microsoft unit is the worked example, not a requirement that every employer copy Microsoft's org chart. Microsoft uses a hub-and-spoke model so one person is not "the ethics department" while the rest of the company ships anyway.

What Microsoft's own council ecosystem actually does

Learn names three centralized bodies:

• Responsible AI Council. A forum for business leaders and representatives from research, policy, and engineering to grapple with the biggest AI challenges and drive progress in policies and processes. Learn states this group is the final decision-maker on the most sensitive, novel, and significant AI development and deployment matters. It sets the company's AI principles, values, and human rights commitments. Microsoft's Service Assurance overview adds that the council has been co-led at the senior-most technology and legal/policy level (Vice Chair and President together with the Chief Technology Officer) — the teaching point for AB-731 is joint business-and-technology leadership, not the personal biographies.
• Office of Responsible AI (ORA). Implements governance: framework, roles, reporting and decision process, company-wide training. Learn lists five functions: internal policy, governance structures, enablement, case management (sensitive-use review), and public policy.
• Aether Committee (AI, Ethics, and Effects in Engineering and Research). Advisory to senior leadership and ORA. Working groups deepen principle-specific guidance; learnings feed policy and limits on sensitive uses.

Decentralized spokes in the same unit: Responsible AI Champs (nominated advisors who inform decision-makers rather than police), engineering enablement teams, and every employee (understand principles, escalate sensitive uses, contact a Champ). Champions and adoption mechanics belong mainly to the next chapter. Preview only: the council sets the bar; champs and an adoption team carry it into daily work.

Microsoft's agent adoption maturity model restates the customer-facing version of the same idea: Establish an AI Council. Create a cross-functional, multidisciplinary council to oversee and guide AI adoption. Typical roles in that Microsoft article:

• Executive sponsor — strategic direction and prioritization
• IT and platform enablement — technical readiness and governance
• Change management — adoption, communications, feedback
• Risk, legal, and compliance — Responsible AI, privacy, regulation

The council, that article says, aligns AI use with organizational values, reviews high-impact use cases, mitigates risks, and builds trust across stakeholders. At higher maturity, a cross-functional AI Council actively reviews, advises, and monitors agent behavior; at mid-maturity you formalize the AI Council's role, decision rights, and escalation paths.

Membership a transformation leader should actually invite

AB-731's audience is not Microsoft's internal ORA. For a company standing up Copilot and Foundry, seat the functions that can block or bless the work in production:

• Business — process owners who feel the outcome (operations, sales, clinical-adjacent services).
• IT / platform — tenant, identity, connectors, Foundry environments.
• Security — identity, data leakage, agent tool permissions, incident halt.
• Legal — contracts, sector rules, product claims, discovery.
• Privacy — PII in prompts and logs, purpose limitation, individual rights.
• HR — workforce impact, hiring and performance tools, training expectations.
• Finance — cost, ROI, and whether an agent may commit spend.

That list is the exam-ready roster. Microsoft's four typical roles still fit inside it: the executive sponsor is usually a business or transformation leader; IT and platform sit in IT; change management often sits with adoption or HR; risk, legal, and compliance cover legal and privacy. Security and finance are the frequent misses. A hiring agent without HR is a lawsuit. A purchasing agent without finance is a blank check. A Copilot wave without security is an oversharing event.

CAF's AI Center of Excellence is a related but different body: experts who drive delivery, skills, pilots, standards, and intake. Some organizations combine CoE and council; many should not. The council guides strategy, oversight, and alignment. The CoE enables and standardizes build-out. If you only have a CoE of data scientists, you still need a council that includes legal, HR, and finance.

Charter, cadence, and escalation

Write a one-page charter before the first meeting. If the charter is missing, Microsoft's anti-pattern applies: No AI Council, or a council with no authority — exists on paper, lacks mandate, decision rights, or executive sponsorship; teams ignore guidance; risk, legal, IT, and change stay misaligned.

Charter contents that match the official skill:

1. Purpose — strategy (where AI may go), oversight (what must be reviewed), cross-functional alignment (one decision, not five conflicting ones).
2. Decision rights — which uses the council must approve; which the business may ship inside guardrails; who can halt production.
3. Intake — how a use case arrives (short form: people affected, data classes, autonomy, human review).
4. Cadence — standing meeting (many enterprises start monthly, with a rapid path for sensitive uses). Sensitive-use reviews should not wait for the next quarterly offsite.
5. Escalation — unresolved principle conflicts go to the named executive sponsor; safety or privacy incidents follow the incident protocol from section 10.2, then the council for policy change.
6. Records — decisions, dissent, and conditions of approval, so audit and the next chair are not reconstructing folklore.

Learn's hybrid-governance advice still applies: a system that reports with real authority, staffing, and funding is more likely to create change than an unpaid lunch forum. CAF says give the governance team executive sponsorship and authority to enforce when necessary, and resource it so it does not become a bottleneck. That is the same design problem as the council: consultative for low risk, decisive for high risk.

Council versus adoption team (preview only)

The next chapter covers Establish an adoption team, barriers, and champions. Preview the contrast so you do not merge the two skills:

Microsoft's Champs and change-management seat on the council are the bridge, not a reason to skip either body. The council still needs HR and legal even if the adoption team is excellent at lunch-and-learns.

Scenario. A general counsel wants every new Copilot Studio agent on a 45-day legal queue. An operations VP wants warehouse notifications this month. The council's job is alignment: classify the warehouse agent (internal, low autonomy, human approval on new templates), time-box legal review to that class, and refuse a second agent that would auto-negotiate rates. That is strategy and oversight in one meeting. Sending both people to "work it out in chat" is not an AI council.