AI for boards

A board does not need a member who can explain how a model works. It needs to know who inside the company is answerable when one gets something wrong in front of a customer. It also needs to know whether that answer would survive being read back in a dispute. Ask that question at every review, not just the first one.

Ask for three things, by name rather than by department. Who owns AI risk, specifically, not which team owns it. A register of every AI system in use, kept current rather than produced once for an audit. And the last time a customer or a regulator asked a question about this, with the answer that was actually given. Anything less than a name is not an answer.

Do not ask for a demo. A demo proves a model can perform once, in front of people who want it to succeed, which is the least useful thing a board can learn. Do not ask for a token count, a model name, or a list of pilots. Those measure activity, not risk, and a company can produce an impressive slide about all three without anyone being accountable for one of them.

The exposure that actually matters shows up after something goes wrong, not before. A regulator or an insurer will not ask whether the model was good. They will ask whether someone reviewed the system before it reached a customer. They will also ask whether that review is written down, and whether the questionnaire answer was still true afterwards. A board that has not asked those questions is the one that gets asked them first.

A company of 30 to 300 people needs one named owner, one page of decisions, and the discipline to update both when something changes. A board does this well by asking the same few questions until the answers stop moving.