A board does not need to understand how AI works. It needs to know where the business is using it, what could go wrong, who is accountable, and how it would find out if something did. Good AI governance at board level is four questions asked regularly and answered honestly. Everything else is detail the executive should own.
Here is what that looks like in a business without a risk committee, what the executive should be doing underneath it, and the one-page report that makes it work.
Why this sits with the board
The instinct is to treat AI as a technology matter and send it to whoever runs IT. The risks say otherwise. A wrong automated decision about a customer is a commercial and legal risk. A data leak through an unapproved tool is a regulatory and reputational risk. A supplier the business has quietly become dependent on is a continuity risk. None of those are technology risks in any useful sense. They are the kind of risk a board exists to oversee, and they sit alongside financial control and people in the board’s remit.
The second reason is pace. AI use in most businesses is growing faster than the governance around it, usually because staff adopt tools before anyone senior knows. A board that does not ask will not be told, and will find out from a customer, a regulator or a journalist.
The board owns four questions
Where are we using it. A board should be able to see a short register of AI uses in the business, including the informal ones. Most boards are surprised by this list the first time they see it, because staff adopt tools long before anyone writes them down. The register is the foundation. Without it the other three questions have nothing to attach to.
What could go wrong. For each use, the plain-English risk. A wrong decision about a customer, a data leak, a regulatory breach, reputational damage, a dependency on a supplier that could fail. Rated simply, high, medium, low, with the reasoning. The AI risk assessment approach we use is deliberately lightweight for this reason. A board needs the top handful of risks and what is being done, not a matrix.
Who is accountable. One named executive for AI as a whole, and a named owner for each significant use. Shared accountability is no accountability, and it is the single most common gap I see. When the board asks ‘who owns this’ and three people look at each other, the governance has already failed.
How would we know. What gets reported, how often, and what would trigger an escalation to the board between meetings. Without this, the board finds out about problems from a customer or a regulator. The trigger list is short. A data incident involving AI. An automated decision that affected customers and went wrong. A regulator or major client asking formal questions. A new high-risk use being proposed.
What the executive owns
The policy on what staff may and may not do with AI, written on a page and actually taught. The data protection work, including impact assessments where the use is high risk, which the ICO expects before any such system goes live. Supplier due diligence on the tools themselves, what they do with the data, whether they train on it, what happens if they fail. The measurement of whether the spend is paying off. The training of staff and leaders.
The board should see summaries of all of this, and should not be running any of it. A board that drafts the AI policy has confused oversight with management.
The reporting that works
One page, quarterly. The register of uses, any changes since last time. The top three risks and what is being done about each. Incidents and near misses, including the ones that were caught. The measured value, in hours or money, against the cost. And any decision the board is being asked to make.
If it runs to more than a page, the executive is reporting activity rather than oversight. Boards get lost in the detail and miss the one line that matters. The discipline of a single page forces the executive to decide what matters, which is itself most of the governance.
What this looks like in practice
A board of a 120-person firm asks the four questions for the first time. The register comes back with 14 AI uses, of which the leadership team knew about 5. Two of the unknown ones involve customer data going into a free tool. One involves an automated scoring of enquiries that nobody had thought of as a decision.
Nothing has gone wrong yet. The board asks for the two free-tool uses to be stopped or moved to an approved tool within a month, for a DPIA on the scoring, and for a named owner on each of the 14. The next quarter’s page shows 11 uses, all owned, two risks rated high with mitigation underway, no incidents, and a measured saving on the two uses that were actually designed rather than adopted by accident.
That is a board doing its job. It took one meeting to ask, one quarter to answer, and no new technology at all.
The two mistakes boards make
Treating AI as an IT matter and delegating it entirely. The risks are commercial, legal and reputational, which puts them firmly in the board’s remit.
Treating it as so novel that the usual rules do not apply. They do. Lawful basis, accountability, oversight and honest reporting are the same disciplines a board applies to money and people. AI is one more thing to govern with them. Our piece on AI and data privacy covers the legal side in plain English.
A third, less common but more damaging. Commissioning a large governance framework, approving it, and never asking the four questions again. The framework becomes the governance, and the governance becomes a document.
The honest trade-off
Light governance done consistently beats heavy governance done once. A board that asks the four questions every quarter will catch most problems early. A board that commissions a 60-page framework and files it will catch nothing. The cost of the light version is an hour of board time a quarter and a day of executive time to prepare the page. The cost of the heavy version is a lot of money and a false sense of security.
Our AI governance work is built to fit the first model, and a technology review is often where the first register of uses comes from.
Frequently asked questions
What should a board ask about AI?
Four things, regularly. Where the business uses AI, what could go wrong, who is accountable, and how the board would find out if something went wrong.
Does a small company board need AI governance?
Yes, in proportion to its use. A register of uses, a named accountable executive and a quarterly one-page report is enough for most SMEs and is far better than nothing.
Who should be accountable for AI in a business?
One named executive for AI overall, with a named owner for each significant use. Shared accountability leaves gaps that only show up when something fails.
What should trigger an escalation to the board between meetings?
A data incident involving AI, an automated decision affecting customers that went wrong, a regulator or major client asking formal questions, or a proposal for a new high-risk use.
Should the board approve the AI policy?
The board should see it and be satisfied it exists and is enforced. Writing it is the executive’s job. A board that drafts policy has stopped overseeing and started managing.
How often should the board review AI?
Quarterly as standard, with a clear trigger for escalation between meetings, such as a data incident or a decision affecting customers going wrong.