AI Centre of Excellence: Central, Federated or Hub-and-Spoke?
Three ways to run an AI centre of excellence compared on decision rights, speed, cost, skills and risk, with the model we recommend for a ministry, a bank and a family group.
You have three ways to run an AI centre of excellence. A central team can own all AI work, or each business unit can run its own in a federated model. In hub-and-spoke, a small central hub sets standards and runs the shared platform, while named leads inside each unit deliver the use cases. We recommend that a ministry starts central and moves to hub-and-spoke once its directorates have trained people. A bank should run hub-and-spoke from the first day, and a diversified family group should use a federated model with a thin group hub.
Central, federated or hub-and-spoke: three AI centre of excellence models compared
An AI centre of excellence (spelled "AI center of excellence" in US English) is the team and rules that decide how AI is chosen, built, approved and run. The three models differ above all in who holds the decision rights.
| Criterion | Central | Federated | Hub-and-spoke |
|---|---|---|---|
| Decision rights | One team decides which use cases go ahead, which tools are approved and who builds | Each business unit decides for itself within a short group policy | The hub decides standards, platforms and risk rules; units decide which use cases matter to them and own the results |
| Speed | Fast for the first use cases; slows as requests queue at one team | Fast inside each unit; slow to share anything across units | Slower to set up; steadier once spoke leads are trained |
| Cost | Least duplication, but the central budget becomes the target of every request | Duplicate licences, vendors and builds across units | Shared platform and contracts in the hub; spoke time paid by the units |
| Skills | Deep skills in one place, little AI skill in the business | Skills spread unevenly; strong units pull ahead | Specialists in the hub, trained practitioners in each unit |
| Risk | Consistent controls, applied by a team that may not know each unit's data and processes | Uneven controls; hard to know which AI is in use | One set of controls, applied by people who know the unit's work |
Central: one team owns AI
A central team reporting to a senior executive takes requests, builds or buys, approves and runs. It suits an organisation with little AI in daily use, few specialists and strict data rules, because it keeps standards in one place while they are still being written. The cost is distance from the work, and as demand grows the queue becomes the main complaint.
Federated: each unit owns its AI
Each business unit or operating company has its own budget, people and vendors, and follows a short shared policy. It suits groups whose units have little in common, because a central team would struggle to know each of their businesses well. The cost is duplication and blind spots: three units can buy three similar tools, and nobody holds one list of the AI in use.
Hub-and-spoke: shared standards, local delivery
A small hub owns the AI policy, approved platforms, vendor contracts and training. It also runs the first risk check on each use case (risk and compliance approve high-risk ones) and holds shared components (connectors, evaluation sets, prompt libraries). Each unit names a spoke lead: a business person with time set aside who picks use cases, drives adoption and reports results. It needs more coordination than the other two and fails if spoke leads get no time. Where it works, it puts decisions about value close to the work and decisions about risk in one place.
Which model we recommend for a ministry, a bank and a family group
| Organisation | Start with | Move to | Why |
|---|---|---|---|
| Ministry or government entity | Central, in the office of the senior AI executive or the digital transformation unit | Hub-and-spoke, once directorates have trained leads | Standards, procurement and data classification are set once; directorates need time to build skills |
| Bank or other regulated financial institution | Hub-and-spoke | Stays hub-and-spoke; the hub takes on more platform work | Many business lines want AI at once, and risk and compliance need one view of every model and use case |
| Diversified family group | Federated, with a thin group hub | Hub-and-spoke for shared services (finance, HR, procurement) | Operating companies differ; shared services and group-level risk do not |
A ministry (illustrative)
Take an illustrative ministry in Amman with a small digital transformation unit, several directorates and citizens' personal data. Starting central lets the unit write the AI policy, approve tools and set rules for each class of data before any directorate builds.
Skills change the model later. Jordan's Ministry of Digital Economy and Entrepreneurship says the national AI strategy, launched in October 2022, aims to train 15,000 government employees in AI by the end of 2027. Awareness training alone does not make a spoke lead. As trained staff reach the directorates, name one in each as spoke lead once they have taken a use case to a result, then hand them the choice of use cases. In the UAE, the Cabinet approved a new role of Chief Executive Officer for Artificial Intelligence in ministries and federal entities, as the Dubai Government Media Office reported on 5 September 2024. Where that role exists, we would place the hub under it.
A bank (illustrative)
Take an illustrative mid-sized GCC bank with retail, corporate, treasury and operations teams, each with its own ideas for AI. A central team would become a queue; a federated model would leave risk management chasing models it never saw. Hub-and-spoke fits. The hub, under the chief operating officer or chief data officer, runs the platform, vendor contracts and AI register, and each business line has a spoke lead. Keep the risk function outside the hub, reviewing high-risk uses on its own, so the team that builds is not the team that approves.
Banking rules on outsourcing, model risk and data differ by regulator. This is general information, not legal advice; obligations depend on your sector and data, so confirm them with counsel.
A family group (illustrative)
Take an illustrative Gulf family group with retail, real estate and industrial companies. Give each company its own AI budget and lead. Keep a thin group hub that owns three things: the group AI policy, one approved-tools list with group contracts, and a register of AI in use across the companies.
Who decides what in a hub-and-spoke model?
Decision rights are where operating models can fail in practice: the chart says the hub "supports", and nobody knows who can say no. Write the split down. The voluntary NIST AI Risk Management Framework (AI RMF 1.0, 2023) asks for this in its Govern function. GOVERN 2.1 calls for roles, responsibilities and lines of communication for AI risk to be documented. GOVERN 2.3 places responsibility for decisions about AI risk with executive leadership.
| Decision | Hub | Spoke lead | Risk and compliance | Executive sponsor |
|---|---|---|---|---|
| Which use cases the unit pursues | Advises | Decides | Consulted on high-risk ones | Settles budget disputes |
| Which platforms and vendors are approved | Decides | Consulted | Consulted | Approves contracts above a set limit |
| Whether a high-risk use goes live | Prepares the review | Presents the case | Decides | Accountable: settles disputes and accepts remaining risk |
| Whether a use case is stopped | Recommends | Decides on value | Decides on risk | Informed |
Our guide to an AI governance framework for Saudi Arabia, the UAE and Jordan covers the policy and registers that sit behind these decisions.
How should the operating model change over time?
Treat the model as a stage, not a permanent structure. For an organisation with little AI in daily use, we recommend three stages, moving on when the signals below appear, not on a fixed date. A bank that starts hub-and-spoke begins at stage 2.
- Stage 1, central: set the rules. The hub team writes the policy, approves the first platforms, builds two or three use cases end to end and keeps the AI register. Move on when the standards are written down and at least two units have a trained person ready to lead.
- Stage 2, hub-and-spoke: hand over delivery. Spoke leads take over the choice of use cases and adoption; the hub keeps the platform, risk review and shared components. A unit is ready for the next stage when it runs its own use cases safely and reports results without help.
- Stage 3, selective federation: let mature units run. Mature units get their own budget and builders; the hub narrows to standards, register, platform and audit. Other units stay at stage 2.
Signals that it is time to change the model
- Requests wait weeks in the central queue and units start buying their own tools: move toward hub-and-spoke.
- Spoke leads are trained and have each taken one use case to a measured result: give them the choice of use cases.
- Two units have built the same thing, or nobody can produce the full list of AI in use: pull standards and the register back to the hub.
- An incident or audit finding traces back to a unit acting alone: tighten hub approval for that kind of use before loosening anything else.
Moving back is allowed. An AI readiness assessment scored per use case shows where skills and data are thin before you assign spokes.
How to start
Begin with one question, not an organisation chart: who can say no to an AI use case today? If the honest answer is "nobody" or "everyone", start central or with a thin hub, adapt the decision-rights table above and name the first spoke leads. Our TRANSFORM Program & AI Operating Model service in the Transformation Lab designs your AI operating model and AI centre of excellence. Our page on operating strain covers the case where growth has outpaced clear ownership. To talk it through first, the AI Exposure Scan is a free 45-minute conversation that ends in a written next step.
Frequently asked questions
What does an AI centre of excellence do?
An AI centre of excellence decides how AI is chosen, built, approved and run across an organisation. Depending on the operating model, it sets the AI policy, approves platforms and vendors, keeps a register of AI in use, reviews risk, builds shared components and trains staff. In a hub-and-spoke model it does this alongside named leads in each business unit, who choose use cases and report results.
What is the difference between a federated and a hub-and-spoke AI operating model?
In a federated model each business unit owns its AI budget, people and vendors and follows only a short shared policy. In a hub-and-spoke model a central hub keeps the platform, vendor contracts, first risk checks and the AI register, while spoke leads in each unit choose and run use cases. Hub-and-spoke shares more and duplicates less; federated gives units more freedom.
Where should an AI centre of excellence report?
It should report to an executive who can settle disputes between units and fund shared work, such as the chief operating officer, the chief data or digital officer, or a dedicated AI executive where one exists. Keep risk and compliance outside the centre so that high-risk uses are approved by people who did not build them. The right line depends on who already owns data and technology.
When should a central AI team move to hub-and-spoke?
Move when the signals appear, not on a fixed date. Signals include requests waiting weeks in the central queue, units starting to buy their own tools, and at least two units having a trained person who has taken one use case to a measured result. Before moving, make sure spoke leads have AI work written into their objectives and time set aside.
Get new insights by email
One email when we publish something useful. No spam; leave any time.
Services in this article
Related lab: Transformation Lab ↗
