The board's role in AI
AI raises two kinds of questions for a board. The first is strategic: will AI change how our industry competes, and are we moving fast enough? The second is fiduciary: are we using AI safely, legally and with value we can measure?
Most boards spend their limited time on the second, because risk is easier to frame. The best boards hold both. The twelve questions below are grouped to help you do that in a single agenda item.
Strategy and value
1. What is our AI ambition, in business terms?
A good answer names two or three business domains where AI should create value, with targets in the business plan. A weak answer lists tools or pilots.
2. How much are we spending on AI, and what are we getting for it?
AI spending is often spread across team budgets and software subscriptions. A good answer gives one number, a portfolio view, and the value measured for use cases in production.
3. Which AI use cases are in production today, and which pilots have we stopped?
A healthy portfolio stops pilots that do not deliver. If nothing has ever been stopped, nothing is being measured.
4. How could AI change our competitive position in the next three years?
Ask management to describe one scenario where a competitor or a new entrant uses AI to change cost, speed or customer experience in your market, and what the company would do about it.
Risk and control
5. Do we know where AI is used across the company?
Employees use AI tools whether or not they are approved. A good answer includes an inventory of AI systems, including those embedded in vendor software, and a list of approved tools.
6. What may AI decide or do on its own?
As AI agents start to take actions, such as sending messages, changing records or approving transactions, the company needs explicit rules on what requires human review. Ask to see them.
7. How are AI risks reviewed before a system goes live?
Look for a proportionate review covering accuracy, bias, intellectual property, privacy and security, with a named owner who can say no.
8. Which AI regulations apply to us, and are we ready?
Depending on where you operate, this can include the EU AI Act, data protection laws such as GDPR or national personal data protection acts, and sector rules in finance, health or critical infrastructure. A good answer maps obligations to systems and dates, and names who is accountable.
Capability
9. Is our data ready for AI?
AI depends on accessible, trusted data with named owners. Ask how long it takes to bring together the data for a new use case, and whether the numbers in management reports are trusted.
10. Who owns AI in the business, not just in IT?
Programmes stall when AI is owned only by technology. A good answer names business owners for each priority domain, accountable for the value.
11. How are we building skills, from the leadership team down?
Ask what share of employees use AI in their daily work, what training exists, and how the leadership team itself is learning.
12. How does the board stay informed?
Agree what the board will see, and how often: a short dashboard of adoption, value, incidents and regulatory readiness, and an annual deep-dive.
Putting AI on the board agenda
- Start with a baseline. A shared assessment of where the company stands gives the board and management one language. The AI readiness checklist is a good starting point.
- Make it a standing item, with a short dashboard, rather than an annual presentation.
- Decide where oversight sits: the full board for strategy, the audit or risk committee for controls.
- Invest in director education. A two-hour session on what AI can and cannot do pays back quickly.
- Bring in an outside view when management's assessment and the board's intuition diverge.
Useful frameworks
Several public frameworks can structure the conversation without reinventing it:
- NIST AI Risk Management Framework (United States): a voluntary framework organised around govern, map, measure and manage.
- ISO/IEC 42001: an international standard for an AI management system, which organisations can certify against.
- EU AI Act: a risk-based regulation with obligations that depend on how AI is used, phased in over several years.
- Singapore's Model AI Governance Framework: practical guidance widely referenced across Asia.
None of these replaces the board's judgement on strategy. They help make sure the risk side is covered systematically.
Where to start
Start the assessment See a sample board deck