Boards do not need to approve prompts or choose models. They do need to know whether the organisation is using AI in ways that fit strategy, risk appetite and accountability.
The OECD’s 2026 Due Diligence Guidance for Responsible AI explicitly recognises oversight responsibilities that can involve senior management and boards as relevant. NIST’s AI Risk Management Framework similarly places governance around the complete lifecycle.
For directors, that translates into better questions.
1. Where is AI creating material value today?
Ask for actual use cases and measured outcomes, not a list of pilots. Separate time saved, revenue, risk reduction and service improvement.
2. Which AI uses could materially harm the organisation or people?
Request a ranked inventory covering safety, legal, privacy, cyber, financial, workforce and reputation consequences.
3. Who is accountable for each material use?
Every significant AI system needs a business owner. “IT” or “the vendor” is not an accountability model.
The Certificate in Corporate Governance Basics can help directors and governance professionals strengthen the foundations used to oversee new technology risks.
4. Which decisions are automated, and where must a human decide?
Ask management to distinguish drafting, recommendation and execution. High-impact automation should have explicit authority and escalation limits.
5. What data does the AI depend on?
Boards should know where data quality, rights, confidentiality or supplier dependencies create material exposure.
6. How do we know the systems work well enough?
Request the acceptance criteria for important use cases: accuracy, reliability, error tolerance, fairness, security and safe failure as relevant.
7. How are third-party AI risks managed?
Understand model providers, cloud dependencies, change terms, incident notification and exit. Supplier assurance should continue after contract award.
8. What changed this quarter?
AI risk can change because a model, data source, integration or use case changes. A mature report distinguishes new use, material change and stable operation.
9. What incidents and near misses occurred?
Ask not only about losses but about failures caught by controls. Near misses show whether governance is detecting problems early.
10. How are employees being prepared?
AI literacy should match role and risk. Management should be able to explain who needs which capability and how it is assessed in practice.
The Certified AI Business Steward is relevant for distributed business ownership, while the Certified Chief AI Officer addresses enterprise AI leadership.
11. Which AI projects should we stop?
A portfolio with no stopped pilots may be avoiding hard decisions. Ask which experiments failed their value or risk criteria and what was learned.
12. What evidence would cause the board to intervene?
Define triggers: control failure, regulatory change, serious incident, vendor concentration, weak value evidence or use beyond risk appetite.
Use a one-page board AI report
Keep the recurring board view concise: top value outcomes, top risks, material incidents, significant changes, overdue actions and decisions requiring board input. Detailed model metrics belong underneath, available when they explain a material issue.
Board culture matters as much as the template. The Certificate in Board Dynamics and Culture can support boards that need constructive challenge rather than passive acceptance of technical assurance.
Ask for trend and exceptions, not a compliance traffic light
A green rating can hide uncertainty. Directors should see whether material AI use, incidents, control failures and overdue actions are rising or falling. Where a risk is marked green, ask what evidence justified the rating and when it was last tested.
For high-impact uses, ask management to show the exception path. Who can pause the system? Which threshold forces escalation? Can the organisation operate without it if a model or vendor changes unexpectedly?
Test the board conversation with a scenario
Imagine a third-party AI model used in customer service is updated and complaint rates rise sharply. Management says the overall accuracy benchmark remains acceptable.
A board-level discussion should not tune the model. It should ask whether customer harm is material, whether the change breached an approved tolerance, who owns remediation, whether the vendor can roll back, what must be reported and what evidence is required before normal operation resumes.
That scenario reveals whether governance is genuinely decision-ready or exists only as policy.
Final takeaway
Strong board AI oversight is evidence-driven. Directors should understand where AI matters, who owns it, how management knows it works, what can go wrong and what would trigger intervention.
The aim is neither board-level micromanagement nor a blank cheque for innovation. It is disciplined oversight of a technology that increasingly shapes operational and strategic decisions.
Responses