AI Governance for the Board: What Directors Need to Know and Ask

The Board Meeting Where AI Risk Became Real

A director asks: "What's our AI exposure?" The CTO says: "We use ChatGPT for marketing copy." The CISO says: "We have a policy draft." The General Counsel says: "We're reviewing vendor contracts."

Nobody has the full picture. The board moves to the next agenda item.

This scene plays out in boardrooms across Australia, the US, and Europe. Directors know AI is a strategic risk — they read the headlines about hallucinated legal citations, biased hiring algorithms, and data exfiltration via chat interfaces. But most boards lack the framework to govern it.

This guide gives directors the 10 questions to ask, the dashboard to monitor, and the committee structure to own AI risk — without needing to become technical experts.

Why AI Governance Is a Board-Level Issue

The 10 Questions Every Board Should Ask Management

1. "What is our complete AI inventory — including shadow AI?"

Why it matters: You can't govern what you don't know. Shadow AI (unsanctioned employee use) typically 3-5x the official inventory. Good answer: "We ran a network traffic analysis + employee survey. Found 47 AI tools in use; 12 sanctioned, 35 shadow. Risk-ranked and remediation plan in progress." Red flag: "We use Microsoft Copilot and that's it."

2. "Which use cases are high-risk per EU AI Act / sector regulators?"

Why it matters: High-risk classification triggers conformity assessments, documentation, human oversight, and registration requirements. Good answer: "We classified 3 use cases as high-risk: AI-assisted loan underwriting, resume screening, and medical triage chatbot. Each has a conformity assessment underway." Red flag: "We haven't classified them."

3. "Do we have a single-approved-tool policy with vendor audits?"

Why it matters: Vendor sprawl = uncontrolled data flows, inconsistent protections, no accountability. Good answer: "One enterprise LLM platform (Azure OpenAI) with DPA/BAA. All other tools blocked by proxy. Vendor audited via BizThriveAI 24-hour ISO 42001-aligned audit." Red flag: "Teams choose their own tools."

4. "How deep does our vendor audit go — do we see sub-processors?"

Why it matters: Your AI vendor runs on GPU clouds, hyperscalers, observability platforms — none in your contract. Good answer: "Our vendor audit includes full sub-processor mapping (Tier 1/2/3), flow-down clause verification, and concentration risk analysis. We have veto rights over new Tier 1 sub-processors." Red flag: "We trust Microsoft/AWS."

5. "What's our AI incident response plan — and when did we last test it?"

Why it matters: AI incidents are not security incidents. They require decision quarantine, model rollback, regulatory notification clocks. Good answer: "We have a 4-phase AI Incident Response Playbook (Detect→Contain→Remediate→Learn). Ran tabletop exercise last quarter with hallucinated medical advice scenario. Identified 3 gaps; 2 closed, 1 in progress." Red flag: "We use our standard security IR plan."

6. "Are we ISO 42001-ready — what's our certification timeline?"

Why it matters: ISO 42001 is becoming the de facto governance standard. NSW procurement requires alignment. Insurers recognize it. Good answer:" "Gap analysis complete. 6-month roadmap to certification. Phase 1 (Foundation) 60% done. Budget approved. External auditor engaged for Stage 1 in Month 5." Red flag: "We're looking into it."