AI governance for boards means overseeing how management uses AI to create value, which risks it is taking, and what evidence proves those risks are controlled. Directors do not need to understand how models work, but they do need to ask sharp questions and recognise a weak answer. The 12 questions below, grouped into strategy, risk, people, regulation and evidence, give a board a practical way to test management, each with what a good answer sounds like and the red flag to listen for.
This guide is for non-executive directors, board chairs, audit and risk committee members and company secretaries preparing for an AI discussion with management.
Why boards need their own AI questions
Director bodies around the world now treat AI as a board matter. The NACD’s 2024 Blue Ribbon Commission report, “Technology Leadership in the Boardroom”, sets out ten recommendations, including defining decision-making authority for technology and ensuring clear metrics for technology oversight. The AICD and the Human Technology Institute at UTS released a second edition of “A Director’s Guide to AI Governance” in June 2026, updated for agentic AI. In the UK, the IoD’s business paper “AI Governance in the Boardroom” frames its guidance as the essential governance questions for the next board meeting.
The international reference points are consistent. The OECD AI Principles, updated in May 2024, include accountability as a core principle. The NIST AI Risk Management Framework, a voluntary framework released in January 2023, puts “Govern” alongside Map, Measure and Manage. And the EU AI Act creates binding obligations, with fines for prohibited practices of up to EUR 35 million or 7% of worldwide annual turnover, whichever is higher. The questions below draw on all of these.
The 12 questions at a glance
| Theme | Questions | What the board is testing |
|---|---|---|
| Strategy | 1 to 3 | Is AI tied to strategy, with clear bets and a defined risk appetite? |
| Risk | 4 to 6 | Does management know where AI is used, how risky each use is and what happens when it fails? |
| People | 7 to 8 | Is someone accountable, and are staff and directors capable? |
| Regulation | 9 to 10 | Are legal obligations mapped by market, and are AI claims honest? |
| Evidence | 11 to 12 | Could the company prove its controls work, and does the board see the right data? |
Strategy
1. Where are we using AI today, and how does that link to our strategy?
Good answer: a short map of current and planned AI uses, each tied to a strategic objective, with an executive owner.
Red flag: a list of pilots and vendor demos with no link to strategy, or “every team is experimenting”.
2. Which few AI initiatives matter most, and how will we know they are working?
Good answer: two to five priority initiatives, each with a business metric agreed before launch (cost, cycle time, revenue, quality) and a date to decide whether to scale or stop.
Red flag: success measured only in licences bought or “hours saved” estimates nobody has checked.
3. What is our AI risk appetite, and who approved it?
Good answer: a written statement, approved by the board or a committee, of which AI uses are encouraged, which need extra approval and which are off limits.
Red flag: “we take a cautious approach” with nothing written down, or a blanket ban that staff quietly work around.
Risk
4. Do we have a complete inventory of the AI we use, including vendor AI and shadow AI?
Good answer: a maintained register covering in-house models, AI features inside purchased software, employee use of public AI tools and AI agents, with a method for discovering what is not yet registered.
Red flag: an inventory that only lists projects the data science team built.
5. How do we classify AI use cases by risk, and what extra controls apply to the high-risk ones?
Good answer: a tiering method, for example mapped to the NIST AI RMF or ISO/IEC 42001, with stronger testing, human oversight and sign-off for uses that affect customers, employees, safety or financial reporting.
Red flag: every use case is treated the same, or risk is assessed only once at launch.
6. What happens when an AI system gets something badly wrong?
Good answer: AI incidents are part of the incident response plan, with named owners, the ability to switch a system off or fall back to a manual process, and a route to escalate to the board. Contracts with AI vendors cover notification and liability.
Red flag: “the vendor handles that”, or no one can say who has authority to turn a system off.
People
7. Are our people trained to use AI safely, and can we prove it?
Good answer: an AI acceptable use policy, baseline training for everyone, deeper role-based training for high-risk roles, and completion records. Where the EU AI Act applies, the AI literacy duty in Article 4 has applied since 2 February 2025, and the European Commission says an internal record of training can serve as evidence.
Red flag: a single e-learning module from two years ago, or no records at all. Our AI-Ready Organisation Program is designed to close exactly this gap at scale.
8. Who in management is accountable for AI, and does this board have the expertise it needs?
Good answer: one named executive owns AI governance across functions, reporting to a defined board committee; the board has assessed its own AI knowledge and has a plan to build it. The NACD report explicitly recommends that boards establish, maintain and evaluate their technology proficiency.
Red flag: AI sits with IT by default, or ownership is “shared” between five executives. For directors who want structured preparation, see our AI Risk & Strategy for Leaders programme.
Regulation
9. Which AI rules apply to us in each market, and what are the deadlines?
Good answer: a regulatory map by jurisdiction and sector. For the EU AI Act, that includes the prohibitions and AI literacy duty in force since February 2025, obligations for general-purpose AI models since August 2025, and the high-risk rules that, according to the European Commission, now apply from 2 December 2027 for Annex III areas such as employment and from 2 August 2028 for AI in regulated products. The Act reaches organisations outside the EU in some cases, so non-EU groups should check, too.
Red flag: “the AI Act doesn’t apply to us” without analysis, or a plan built on dates that have since changed.
10. Are the claims we make about AI to customers, investors and regulators accurate?
Good answer: AI statements in marketing, annual reports and investor materials go through the same review as other material claims. In March 2024 the US SEC settled charges against two investment advisers for false and misleading statements about their use of AI, a reminder that “AI washing” is an enforcement issue.
Red flag: the marketing team describes products as “AI-powered” with no technical sign-off.
Evidence
11. If a regulator, auditor or court asked, what evidence could we produce?
Good answer: documented risk assessments, testing results, human oversight procedures, logs, training records and vendor due diligence for each high-risk system, held in one place. Internal audit has AI in its plan.
Red flag: evidence exists “somewhere in the project folders”, or nobody has tried to assemble it.
12. What AI reporting does the board receive, and how often?
Good answer: a regular dashboard with the AI inventory and risk tiers, value delivered against the priority initiatives, incidents and near misses, regulatory changes, training coverage and open audit findings.
Red flag: AI appears on the agenda only when there is a launch to celebrate or a problem to explain.
How to use these questions in the boardroom
- Send them in advance. Ask management for written answers before the meeting so discussion time goes on the gaps.
- Do not ask all twelve at once. Cover strategy and risk in one session, people, regulation and evidence in the next.
- Agree an owner and a date for every red flag. Track them like audit findings.
- Repeat annually. AI use changes quickly, so the answers will too.
Some boards also want tooling behind the answers, such as an inventory of the AI apps employees actually use and audit evidence mapped to frameworks. AccuroAI, our partner for AI security and governance, outlines that view for executive leadership teams.
Prepare your board and leadership team
Product Innovation Academy runs AI governance and risk sessions for boards and executive teams, from a single briefing to a full programme alongside our AI governance and compliance training for risk and compliance teams, with AI Security and Governance content delivered in partnership with AccuroAI. Request a proposal and we will tailor the session to your sector, markets and AI maturity.
Frequently asked questions
Is AI governance the board’s job or management’s job?
Both, at different levels. Management designs and runs AI governance day to day. The board sets direction and risk appetite, makes sure accountability is clear and holds management to account through questions, reporting and assurance.
Which board committee should oversee AI?
There is no single right answer. Many boards start with the audit or risk committee, some use a technology committee, and some keep AI with the full board because it touches strategy. What matters is that the charter says who owns it.
Do directors need technical AI expertise?
Not deep technical expertise, but enough literacy to understand where AI is used, the main risk types and what good controls look like. The NACD recommends that boards build and regularly evaluate their technology proficiency, and the AICD and HTI guide aims to give every board the insight to navigate AI with confidence.
Which framework should we use for AI governance?
Many organisations use the NIST AI Risk Management Framework as a practical structure and ISO/IEC 42001 if they want a certifiable management system, then map legal duties such as the EU AI Act on top. Pick one primary framework so evidence is collected once.
How often should the board discuss AI?
At least a few times a year as a standing item with a regular dashboard, plus a deeper annual review of strategy, risk appetite and the questions in this guide.
Sources
- NACD, “NACD Blue Ribbon Commission Report to Help Boards Lead in an Era of Profound Digital and Data-Driven Transformation”, 7 October 2024. nacdonline.org
- AICD and Human Technology Institute (UTS), “A Director’s Guide to AI Governance”, Version 2, June 2026. aicd.com.au
- Institute of Directors, “AI Governance in the Boardroom”. iod.com
- OECD, “OECD AI Principles overview”. oecd.ai
- NIST, “AI Risk Management Framework”. nist.gov
- European Commission, “AI Act: regulatory framework on AI” (application timeline). digital-strategy.ec.europa.eu
- European Commission, “AI Literacy: Questions & Answers”. digital-strategy.ec.europa.eu
- EU AI Act, Article 99 (penalties). artificialintelligenceact.eu
- US Securities and Exchange Commission, “SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence”, 18 March 2024. sec.gov
- ISO, “ISO/IEC 42001:2023 Information technology: Artificial intelligence: Management system”. iso.org