AI Governance for Boards: The Questions Directors Should Ask

AI has moved from pilot projects into core operations: customer service, credit decisions, fraud detection, recruitment and reporting. Boards are accountable for the risks that come with it, yet many directors are unsure what to ask. Oversight does not require technical expertise. It requires the same discipline boards apply to any material risk.

Strategy

• Where is AI being used today, and which uses are material to customers, revenue or compliance?
• What value are we getting, and how is it measured?
• Where are competitors ahead, and is that a risk to our position?

Risk

• Which AI uses could harm customers, employees or the company if they fail?
• How do we prevent bias, errors and misuse in automated decisions?
• What data do these systems use, and do we have the right to use it?
• How exposed are we to AI-enabled fraud and cyber attacks?

Controls

• Is there an inventory of AI systems with a named owner for each?
• Are models tested before release and monitored afterwards?
• Where must a human approve an AI-driven decision?
• Can we explain a decision to a regulator or a customer who challenges it?

Accountability

• Which executive owns AI risk, and how often does the board hear from them?
• Does internal audit have the skills to review AI controls?
• How are we tracking emerging regulation in the markets where we operate?

What a board AI report should contain

• An inventory of AI systems in use, including third-party tools, with a risk rating for each.
• The business value delivered: time saved, revenue, risk reduction.
• Incidents and near misses, and what was learned.
• Regulatory developments in each market where the company operates.
• Status of policies, training and model testing.
• Planned investments and the skills the organisation still needs.

A short, consistent report each quarter allows directors to see trends rather than isolated updates.

Building board capability

Boards do not need data scientists, but they need enough understanding to challenge management. Practical steps include an annual education session, a director with technology or risk experience, access to independent advisers and site visits to see how AI is actually used in operations. Some boards assign AI oversight to the audit or risk committee; others create a technology committee. Either works if responsibilities are clear.

Red flags directors should notice

• Management cannot say where AI is being used across the business.
• No one owns AI risk at an executive level.
• Staff use public AI tools with confidential data and no policy exists.
• AI decisions affecting customers cannot be explained.
• Vendors' AI features are switched on without review.

A leader's view: start with an honest inventory

When I speak with leadership teams about AI governance, the first exercise is always the same: list every place AI is used in the organisation. The results usually surprise them. Beyond the official projects, they find AI features switched on in software they already license, staff using public chatbots to draft documents, and vendors using AI to process their data. Governance cannot start until leaders know what exists.

Once the inventory is complete, classify each use by impact. A tool that drafts internal meeting notes is low risk. A model that decides credit limits, flags transactions for investigation or screens job applicants is high risk and deserves testing, documentation and human oversight. This proportionate approach lets organisations move quickly on low-risk uses while applying care where it matters.

Boards should then set expectations: an acceptable use policy for staff, a review process for new high-impact systems, regular reporting and clear accountability. None of this requires directors to become technologists. It requires the same disciplines boards already apply to financial reporting and risk: know what exists, understand what could go wrong, insist on controls and evidence, and hold management accountable. Good AI governance is good governance applied to a new kind of system.

Set the tone

Boards that ask these questions regularly send a clear message: AI is welcome, but it will be governed. That balance lets management move quickly without creating risks that surface later as losses, lawsuits or regulatory action.

Common questions

What is the board's role in AI governance?

The board sets the strategic direction and risk appetite for AI, ensures management has clear ownership and controls, and monitors performance, incidents and compliance.

What questions should directors ask about AI?

Where are we using AI, what value does it deliver, what could go wrong, who is accountable, how are decisions explained and how do we comply with regulation in each market?