Ask a board what it is doing about AI risk, and the most common answer is some version of the same sentence: we have formed a committee. The instinct is reasonable. The conclusion that follows from it, that the organization is therefore governing AI, is the Committee Fallacy, and it is one of the most expensive mistakes a board can make.
A committee is a venue. It is a place where people meet, review materials, and discuss. That is useful. But a venue is not a system, and AI oversight is a system question.
A committee can sit inside a governance program. It cannot substitute for one.
Activity is not accountability
The trouble with a committee, absent a program around it, is that it generates activity that looks like governance without producing the thing governance exists to produce: accountability. Meetings are held. Slides are presented. Minutes are filed. None of it answers the questions that matter. What, specifically, is the organization obligated to govern about its use of AI? Who is accountable when a model causes harm? What must be escalated to the board, and when? What evidence shows that the policies on paper are operating in practice?
A committee can discuss all of these. Without a programmatic framework behind it, a committee answers none of them. It produces the appearance of oversight while leaving the Governing Body exactly as exposed as it was before, now with a paper trail suggesting it knew the risk existed.
What a program adds
A governance program is the structure a committee lacks. It defines, in advance and in writing, what must be governed and who is accountable. It sets the tolerances that determine when a decision can be made locally and when it must rise. It builds the escalation paths that carry a critical risk to the board before it becomes a crisis. And it establishes the assurance that lets the board test whether the program is real rather than ceremonial.
Inside that structure, a committee has a clear and valuable role. It becomes the place where the program's decisions are made and recorded, with authority that traces back to a charter and forward to accountable owners. The committee stops being the answer and becomes part of one.
The question a court will ask
The distinction is not academic. When a regulator or a court examines an organization's AI oversight, it will not be satisfied by the existence of a committee. It will ask whether the board established a functioning system to identify, monitor, and escalate the risk, and whether that system actually operated. A calendar of meetings does not answer that question. A program does.
Forming a committee is often a sensible first step. The fallacy is mistaking the first step for the destination. The work that matters begins after the committee is formed: building the program that gives the committee something to govern.