Escalation Paths

Why Escalation Paths Matter

A council without escalation paths will either deadlock on hard decisions or overstep its authority. Clear escalation rules protect the council's legitimacy and ensure that the right decisions are made at the right level.

Escalation Triggers

A case should be escalated when:

• The council cannot reach consensus after reasonable discussion
• The case exceeds the council's defined risk appetite or authority
• The case involves a novel technology, use case, or context not covered by existing policy
• There is a material conflict of interest among council members
• An incident has occurred that requires immediate executive attention
• External stakeholders (regulators, media, public) are involved

Escalation Destinations

Escalation in Practice

Consider a council reviewing a proposal to deploy facial recognition in office buildings for access control. After two meetings, the council is split: security members see clear benefits, while privacy and legal members flag disproportionate surveillance risk. The chair determines this is a consensus failure on a high-risk use case and escalates to the executive sponsor. The sponsor convenes a session with an external privacy advisor, who recommends piloting a less intrusive alternative (badge-tap with optional facial recognition). The council documents the decision, updates its risk appetite guidance to clarify biometric use cases, and publishes the outcome as a precedent for future reviews.

This pattern (deadlock, escalation, external input, decision, policy update) is the norm for hard cases. The goal is not to avoid escalation but to make it predictable.

Incident Escalation

For AI incidents (system failure, bias discovered in production, data breach involving AI, public complaint), the council should have a dedicated rapid-response path:

1. Champion or team reports the incident to the council chair
2. Chair assesses severity and notifies the executive sponsor if warranted
3. Incident response follows the organization's existing incident management process, with AI-specific considerations added
4. Post-incident review is scheduled at the next council meeting
5. Lessons learned are documented and used to update policy and training

Copy This Template

# Escalation Matrix

| Trigger | Escalated To | Expected Response | Response Time |
|---------|-------------|-------------------|---------------|
| Consensus failure | Executive sponsor | Decision | 5 business days |
| Exceeds authority | Executive sponsor or board committee | Decision + policy clarification | |
| Novel / unprecedented | Executive sponsor + external advisor | Decision + policy update | |
| Conflict of interest | Executive sponsor (conflicted members recused) | Decision with independent review | |
| Incident / crisis | Executive sponsor + incident response team | Immediate triage + post-incident review | Immediate |
| Regulatory inquiry | Legal + executive sponsor | Coordinated response | |