Module 7: Building a Responsible AI Framework
Lightweight governance: realistic for small teams
Description
Frameworks come from corporations. Startups have 5-50 people. Enterprise governance at a startup = a bottleneck, abandonment, frustration.
This capsule teaches you lightweight governance: the minimum viable version that actually works on a small team.
By the end you'll be able to:
- Design a governance structure proportional to your team size
- Avoid the enterprise overhead that kills startups
- Scale governance gradually as the company grows
The problem with enterprise governance
Standard governance models assume:
- 200+ employees
- Multiple roles (CISO, Chief AI Officer, a dedicated compliance team)
- Months-long approval cycles
- Multiple committees
For a startup: literally impossible. Even harmful:
- It slows down critical shipping
- It creates "compliance theater" (process, no substance)
- It demotivates the team
- It misses the point: governance should enable, not block
Three principles of lightweight governance
Principle 1: Concentration of responsibility
On a team of 5-15, one person takes on the "AI Steward" role. Usually the Tech Lead.
Their responsibilities:
- Owns the Responsible AI Framework
- Triggers the review processes
- Final sign-off on ethics decisions (with escalation if uncertain)
- The liaison with the DPO/legal counsel
Benefit: clarity about who decides. Risk: a bottleneck if they're overloaded. Mitigation: clear escalation paths.
Principle 2: Embed it in existing processes
Don't create new meetings. Add ethics to the existing processes:
- Sprint planning → reserve 1 hour quarterly for an ethics review
- Code review → include verification of the ethics checklist
- Release planning → the ethics review is a release gate
- Post-mortems → include a question about the ethical implications
Benefit: no extra calendar burden.
Principle 3: Documentation as code
Reviews, ADRs, and risk acceptances live in Git alongside the code. Changes via PR. Visible. Versioned.
Benefit: developers already know how to use Git. No new tool to learn.
Implementation: the 3-tier model
Tier 1: Just the Tech Lead (team < 10 people)
Tech Lead = AI Steward (everything)
├── Drives the framework
├── Reviews the checklists
├── Signs off
└── Escalates to the founder/CEO on material decisions
Pro: minimal overhead. Con: a single point of failure.
Tier 2: Tech Lead + a junior steward (team 10-30)
Tech Lead = AI Steward
├── Strategic ownership
└── Final sign-off
Senior Engineer = Co-steward
├── Day-to-day execution
├── Coordinates the reviews
└── Escalates to the Tech Lead
Pro: distributed work. Con: it still concentrates power.
Tier 3: A light committee (team 30-100)
AI Ethics Council (3-5 people, meets quarterly)
├── Tech Lead (chair)
├── Senior ML Engineer
├── DPO or Legal Counsel
├── Product Lead
└── An external advisor (optional, for a diverse perspective)
Day-to-day: the AI Steward (Tech Lead)
Strategic: the Council, quarterly
Pro: more perspectives, diverse input. Con: scheduling overhead (manage it with discipline).
Approval flows: keep them simple
Different decisions, different approval levels:
| Decision type | Approval needed | Time |
|---|---|---|
| A bug fix (no ethical implications) | None (PR review only) | minutes |
| A new AI feature | Tech Lead review | 1 day |
| A significant model change | Tech Lead + the checklist | 1 day |
| A new use case (existing AI) | Tech Lead + an ethics review | 1-3 days |
| A new AI system | Council review (or equivalent) | 1 week |
| A significant compliance change | DPO + Legal + Tech Lead | 1-2 weeks |
| Strategic ethics direction | CEO/founder | as needed |
The flow is proportional to the risk.
Escalation paths
When something is ambiguous:
Engineer
↓ (concern)
Tech Lead / AI Steward
↓ (if unresolved)
CTO or CEO
↓ (if there are external implications)
Board / legal counsel
The key: each level has 24-48 hours to respond. If it takes 2 weeks, it's broken.
Meeting cadence (realistic)
| Meeting | Frequency | Duration | Audience | Purpose |
|---|---|---|---|---|
| AI Steward office hours | Weekly | 30 min | Engineers | Ad hoc questions |
| Sprint review (ethics agenda item) | Sprint cadence | 5-10 min | The team | A quick ethics check on the sprint |
| Quarterly governance review | Quarterly | 2 hours | The Council or stakeholders | A comprehensive review |
| Annual deep audit | Annually | 1-2 days | Everyone | The full M8 audit |
For a 10-person startup: only the weekly + quarterly are needed.
Training and onboarding
For new hires:
Onboarding (week 1):
- A 1-hour intro: the ethics framework
- Read the AI Use Policy
- Awareness of the escalation paths
Quarterly refresher (30 min):
- Updates to the framework
- Discussion of recent decisions
- Q&A
Ad-hoc: on significant changes (new regulation, a new feature with implications)
Common traps
Trap 1 — Copying the enterprise structure. "Microsoft has a Chief AI Officer; we need one too." For a 10-person team, no. The Tech Lead suffices.
Trap 2 — Process for process's sake. "Let's have monthly ethics meetings." With no agenda, it becomes a ceremony nobody attends.
Trap 3 — Hiring a "Chief Ethics Officer" too early. Expensive, the role is unclear on a small team, and it often becomes a blocker rather than an enabler.
Trap 4 — Governance that slows everything down. Does every PR require an ethics review meeting? No. Code reviews check ethics during the normal PR flow.
Trap 5 — No clear escalation paths. An engineer encounters an issue and doesn't know who to ask. They report nothing.
Trap 6 — Owner overload. The AI Steward gets every question. They burn out. Distribute via co-stewards or training.
When to scale up governance
Signals that it's time to expand the governance structure:
- You hit 30+ engineers → consider a Tier 3 council
- A new regulated market (healthcare, finance) → a dedicated DPO is needed
- A major incident → strengthen IR + governance
- Multiple clients with audit requirements → consider ISO certification (M6)
- A public regulator inquiry → a formal structure is needed
Exercise
For your organization:
- Which tier (1, 2, or 3)?
- Define the AI Steward role + responsibilities
- Define the approval flows for 5 typical decisions
- Define the escalation path (3 levels)
- The meeting cadence (be realistic)
See the solution (example: a team of 15)
Tier: 2 (between solo and a committee)
AI Steward: the Tech Lead (Mike)
- Owns the framework
- Triggers the reviews
- Final sign-off on routine decisions
- Escalates significant decisions to the CTO
Co-steward: a Senior ML Engineer (TBD hire)
- Conducts the checklist reviews
- Tracks the risk register
- Escalates to the Tech Lead
Approval flows:
- Bug fix: PR review (no special process)
- A new AI feature: Tech Lead review + the checklist (item by item)
- A new use case: Tech Lead + an ethics review
- A new AI system: CTO + Tech Lead (treat it as significant)
- A compliance change: + Legal Counsel
Escalation path:
- Tech Lead (engineering)
- CTO (technical/strategic)
- CEO + Legal Counsel (external implications)
Meeting cadence:
- AI Steward office hours: weekly, 30 min
- Sprint planning ethics check-in: 5 min in the regular planning
- Quarterly review: 2 hours
- Annual ethics audit: 1 day
Summary
You learned:
- ✅ The 3 principles: concentration, embedding, documentation as code
- ✅ The 3-tier model based on team size
- ✅ Approval flows proportional to risk
- ✅ Escalation paths with 24-48h SLAs
- ✅ A realistic meeting cadence (weekly + quarterly is enough for a small team)
- ✅ The traps: copying the enterprise model, process theater, premature hires
Checkpoint: if your governance can be executed without killing your shipping speed, you're ready.
Next capsule
08 — Project: The complete Responsible AI Framework consolidates all of M7 into a Framework deliverable.
Resources
- Microsoft Responsible AI Council.
- SaaStr — startup operations — for scaling lessons.
- Holacracy — an alternative organizational model.
- GitLab handbook — an example of transparent governance.