The board’s AI governance agenda

Board oversight starts with visibility. Ask management for an inventory of AI systems, including employee-facing copilots, externally purchased tools and agents that take actions. Each entry should name its business owner, intended purpose, affected stakeholders, data dependencies and deployment status. An inventory is not evidence of safety, but it makes accountability possible.

Set a risk appetite that translates into decisions. Identify the activities AI must not perform, the decisions that require human approval and the conditions under which a pilot may enter production. A useful boundary is specific: an agent may draft a supplier recommendation, for example, but cannot commit spend without an authorized approver. Management should document exceptions and their expiry dates.

Assign decision rights across the business, technology, security, legal and risk functions. The business owner remains responsible for the outcome; technical teams supply evaluations and monitoring; legal and compliance assess applicable obligations. A governance committee coordinates these functions without substituting for ownership. Escalate material risks and unresolved exceptions to the appropriate board committee.

Require evidence proportionate to risk. Before launch, review evaluations, data-access controls, human hand-offs and rollback arrangements. After launch, track material errors, overrides, incidents, changes in model behavior and overdue remediation. Review outcomes alongside value measures so a productivity gain never hides an unacceptable risk.

Agree on a recurring board reporting pack: portfolio and ownership changes, high-risk deployments, incidents, control exceptions, remediation progress and realized business value. Ask which controls were tested, what failed and who will close the gap. The board’s role is to challenge the assurance, not to approve every model configuration.

Start the conversation with three questions: Where can AI make a consequential decision today? Who can stop it? What evidence would demonstrate that our safeguards work? Use a governance self-assessment to structure the discussion, then validate findings with the people responsible for the controls. This perspective is general guidance, not legal, regulatory or audit advice.

General executive guidance, not legal, regulatory or audit advice. Diagnostics are self-assessments, not certifications or independent assurance.