How to choose an AI operating model for a mid-size company

This page starts from what is required, then asks what the evidence supports. The AI operating model here is the one the glossary defines. What the law requires about structure is narrow, and the dates are still moving. What the evidence supports is long and weak.

Does any law require an AI committee or a Chief AI Officer?

For a private company, no source reviewed for this page requires any of four things. They are a committee, a centre of excellence, a hub-and-spoke model and a Chief AI Officer.

The European Commission’s AI literacy Q&A asks whether an AI officer is necessary, as under the GDPR. It also asks whether an organisation must set up an AI governance board. The answer is “No, no specific governance structure is mandated to comply with article 4 of the AI Act.” That answer covers Article 4 only.

The one binding rule found for this page that does require such structures is American. OMB’s memo on federal AI use, dated 3 April 2025, tells each federal agency to name a Chief AI Officer. Each agency covered by the CFO Act must also convene an AI governance board. Even there, agencies “are permitted to rely on existing governance bodies.” The memo binds US federal agencies and nobody else.

The standards read the same way. The NIST AI RMF is voluntary. Its published text calls it “use-case agnostic, providing flexibility to organizations of all sizes.” It prescribes no committee or team shape. ISO/IEC 42001 applies to “any organization, regardless of size.” Its contents list roles, responsibilities and authorities. The standard is sold, not published, so its clause text was not read for this page.

What does the law require instead?

In the Articles reviewed here, the EU AI Act asks for duties, not structures. Which duties apply depends on what a company does with AI. It also depends on whether the company is the provider or the deployer of each system.

The table lists the duties of the Articles reviewed, by trigger, using the consolidated text. The Digital Omnibus, Regulation (EU) 2026/1744, rewrote some of the wording and moved the dates in July 2026. The last column is a reading of what each duty needs in practice. It is not law text.

Look at what these duties name. They name an accountability framework (Article 17) and people with the competence, training and authority for human oversight (Article 26). None names a committee, a centre of excellence or a Chief AI Officer.

In practice, Article 4 needs someone to run the literacy measures and Article 50 needs an owner for disclosure wording; that is a reading, not law text. The Commission adds that, for deployers of high-risk systems, the duty to train staff for human oversight “remains in place” alongside Article 4.

I deliver the Article 4 literacy measures for clients. Each role gets a short session built for that role and a one-page list of dos and don’ts. The client signs the internal record.

How firm are the EU dates?

The omnibus was signed on 8 July 2026 and is in force from 27 July. It moved the high-risk dates to 2 December 2027 (Annex III systems) and 2 August 2028 (Annex I systems). Its preamble gives the reason: “the delayed availability of standards, common specifications, and alternative guidance and the delayed establishment of national competent authorities.” It also rewrote Article 4 and Article 17(2).

Treat the new dates with care. The omnibus dates from July 2026, and several Commission guidelines are still pending, so the practical detail is still to come.

I plan client work against the dates recorded on this page: Annex III from 2 December 2027 and Annex I from 2 August 2028. I do not put dates in contracts.

Company size also changes the exposure to fines. Small and medium-sized companies pay the lower of the two fine limits. The omnibus extends that rule to small mid-cap companies, a new size class just above them, for all but the highest tier.

Who decides, and who answers?

This page treats five decisions as ones that need a named owner; that is the writer’s reading, not a finding of any source. The table sets what law and standards say about each against what surveys report. The last table in the next section gives the sample behind each survey.

In the table, NIST speaks to four of these decisions and AI Act Article 26 to the fifth. Of the texts reviewed, no NIST subcategory names an approver, NIST names no risk-acceptance signer and the AI Act articles reviewed name none. Practice varies too. The IAPP and Credo AI report says: “There is no clear best practice for how to build and organize an AI governance team.”

ASIC describes better and poorer practice for a committee where one exists. It describes better practice as a cross-functional, executive-level committee with clear responsibility and decision-making authority. Poorer practice was a committee that met infrequently and had a poorly defined mandate. Fewer than a third of the licensees it reviewed had a committee, or were setting one up.

The AI register is where the owner and risk tier of each system live, and a short review checklist can be attached to each entry. The register post shows how to keep one.

Which structures do companies use, and how good is the evidence?

Each structure in this table carries a grade in plain words. Required means a law or binding rule says it. Observed means a regulator or a survey reports what organisations do, with the sample named. Recommended means a research centre, a consultancy or a vendor says organisations should. Popular means many vendors repeat it and no data was found behind it. Described, not evaluated means an arrangement is described and no effect is reported.

The next table gives the sample behind eight of these sources and the main limit of each. None of the large studies reports results for companies of 30 to 300 people.

Most surveys are self-reported and lean toward large companies. ASIC’s data is from December 2023. The sources also disagree about where authority should sit. IBM and Gartner lean central. MIT NANDA leans local for implementation. They may describe different layers: central for policy and risk, local for finding use cases. No source tests that reading.

I take no public side on centralised versus decentralised.

Where do the switch-point numbers come from?

Vendor pages tell readers to change structure at a set number of AI projects or business units. The numbers differ from page to page. No data was found behind any of them: the one vendor page read in full cites no data for its numbers, and the other two were seen only as search snippets. One page also puts a figure on rework. That figure has no data behind it either.

This page does not repeat those numbers. Printing a number gives it weight the evidence does not give it. The three vendor thresholds found have no data behind them. No source reviewed reports a cost for any structure in headcount, budget or time.

My own switch point has no number. The structure grows when the queue of decisions outruns what one named owner can review.

One ASIC finding is about the order of events. Among the licensees ASIC reviewed that planned to use more AI, nearly all were only planning or starting a governance uplift. Only one appeared to have done it before the rise in use it expected. In that sample, most governance uplifts were still being planned or started when the licensees expected their use of AI to rise.

What fits a company of 30 to 300 people?

The sources say little about a company this size. Gradient Flow ran the only size-split governance survey found. Small companies were far less likely than larger ones to have a role or office for AI governance. Pacific AI sponsored it. Small there includes companies under 30 people.

The UTS Human Technology Institute describes a lean design: “a single accountable executive supported by a small cross-functional working group.” It says the CEO may take that role in a smaller organisation. It also says “There is not a single correct answer to these questions.” Its papers show what advisers agree on, not what has been shown to work.

Parts of the law scale with size too. Article 17(2) ties a provider’s quality management system to the size of its organisation. The Australian government’s AI adoption guidance tells organisations to adapt each practice to their size. It also asks for a senior leader as the overall owner and a specific person accountable for every system.

How do you choose?

The evidence cannot pick a structure for you. It can narrow the choice. What follows is a reading of the sources, not a finding from any of them.

1. Start from the duties you have. Decide for each AI system whether your company is the provider or the deployer, and whether the system is high-risk. That decides which dates apply.
2. Name an owner for each of the five decisions. The law and the standards reviewed ask for named people with clear roles. None requires a committee.
3. Choose the smallest structure that covers them. The lean design above is one accountable executive and a small working group. Add a standing group only when a decision needs more than one function. Give any group a clear mandate and regular meetings, because ASIC’s poorer practice was a committee that met infrequently and had a poorly defined mandate.
4. Pick triggers from your own events, not from a vendor number. Review the structure when a duty date arrives, when you add a high-risk system, after an incident, or when use grows faster than the controls.
5. Test the structure on your own records at a fixed date. None of the large studies reports results for a company your size. Your register does.

The post on why pilots stall shows what happens when step two is skipped. Write the five names down first. Then see whether any duty above needs more than that.

What do these sources leave out?

They cannot say which structure produces better results at a company this size. None of the large studies reports results for companies of 30 to 300 people. They give no cost for any structure. Most are dated 2023 to 2026; Microsoft’s account of its own programme is from 2021, and two pages carry no date. Some of the data is older than the omnibus.

Agentic systems are a gap. No regulator text or standard reviewed assigns decision rights to an AI agent. The Australian guidance still says to name a person accountable for every system.

Standards are moving too. NIST says its framework “is being updated”, so every subcategory cited here comes from the January 2023 text.