What Boards Actually Need to Ask About AI

A board that asks whether the organisation has an AI policy will almost always get a satisfying answer, since most now have one. It is a weaker question than it appears: a policy document confirms intent, not execution.

A more useful question starts with ownership: for AI use cases in production, who is accountable for the risk decision on each, and can that person be named? Boards that ask this often find accountability was assumed to sit somewhere without ever being formally assigned.

The second question is about evidence: when was the risk assessment last reviewed, and by whom? One performed once, at launch, and never revisited is a snapshot, not governance. Asking for the review cadence, beyond the assessment's existence, surfaces whether oversight is live or historical.