RACI for AI Decisions

Escalation — If a Council member objects, the decision escalates to the Executive Sponsor.

Timing — Monthly intake; target 10 business days to decision.

Escalation — Denied requests can be appealed to the Council at the next scheduled review.

Timing — Target response: three business days.

Escalation — Escalates to Council if Counsel declines and function lead disputes.

Timing — Case-by-case; documented in the Exception Log.

Escalation — Board notification required if accepted exposure exceeds the materiality threshold.

Timing — At every Council review; ad hoc as risks emerge.

Escalation — Any employee may escalate directly to CISO; retaliation for good-faith reports is prohibited.

Timing — On detection; severity level assigned within 2 hours.

Escalation — Pre-launch checklist must clear every Consulted role before go-live.

Timing — Per launch; minimum two-week review window.

Escalation — Material changes require a board note before the next board meeting.

Timing — Quarterly review; annual full revision.

Escalation — Subprocessors that materially change data residency trigger Council review.

Timing — On vendor notification; 15 business days to respond.

Escalation — Exceptions expire at the next Council meeting unless re-ratified.

Timing — At every Council review.

Escalation — Formal discipline follows HR protocol; appeals go to Executive Sponsor.

Timing — On violation; standing review in the Exception Log.

Escalation — Non-standard clauses affecting model choice, data residency, or audit rights escalate to Council.

Timing — Per deal; target five business days on standard clauses.

Escalation — Incidents above the materiality threshold trigger an out-of-cycle note to the board.

Timing — Quarterly; aligned with board meeting cadence.