AI Briefing for Boards: What Directors Need to Decide
An AI briefing for boards should end in decisions. Six decisions for directors, a table of evidence to request and a 90-minute agenda you can use at your next meeting.
An AI briefing for boards should end in decisions, not in a tour of the technology. Directors need to settle six things: where AI may be used, how much risk the organisation accepts and who is accountable. They also decide what the board sees and how often, what the organisation will invest, and what happens when something goes wrong.
Directors do not need to understand how models work. They need enough to ask good questions and to record decisions that management can act on. This article sets out what the main frameworks say, the six decisions, a 90-minute agenda and the papers to send beforehand.
What do the main frameworks expect from boards?
Three primary sources are useful reference points. They are voluntary guidance and standards, not laws, and none of them tells a board exactly what to do.
The OECD AI Principles, adopted in May 2019 and updated in May 2024, list five values-based principles: inclusive growth, sustainable development and well-being; respect for the rule of law, human rights and democratic values, including fairness and privacy; transparency and explainability; robustness, security and safety; and accountability. They give a board a shared vocabulary for what responsible AI looks like.
The NIST AI Risk Management Framework 1.0, released on 26 January 2023, is intended for voluntary use. Its core has four functions: govern, map, measure and manage. NIST describes govern as a cross-cutting function, and its playbook says under GOVERN 2.3 that executive leadership takes responsibility for decisions about the risks of AI system development and deployment. In plain words, executives own the risk decision and the board checks that they do. Staff can advise, but they cannot carry the decision for leadership.
ISO/IEC 42001, edition 1, published in December 2023, specifies requirements for an AI management system inside an organisation. For a board, the practical value is that a management system produces things you can review: a policy, objectives and records. Ask management which parts they run today and who checks them. Sector regulators may set their own expectations for boards, so confirm these with counsel. This is general information, not legal advice; obligations depend on your sector and the data you handle.
Which six decisions should the board take?
- Purpose and boundaries. Decide which kinds of use are allowed, which need approval and which are off limits. For example, AI that informs decisions about customers or staff, or that uses regulated data, might need board-level approval. The board approves the boundaries, not each tool.
- Risk appetite. Decide how much risk the organisation will accept for each kind of use. NIST GOVERN 1.3 asks organisations to set the level of risk management according to their risk tolerance. In practice, higher-risk uses get closer oversight.
- Accountability. Name one executive who answers to the board for AI, and make sure roles are written down. NIST GOVERN 2.1 asks that roles and lines of communication for AI risk are documented and understandable.
- Oversight and reporting. Decide which committee owns AI, how often it meets and what a standard report contains.
- Investment and capability. Decide the budget, the skills to build or buy, and whether leadership comes from a hire or a part-time role such as a Fractional Chief AI Officer.
- Escalation and stop rules. Decide what the board must be told, how quickly, and which events pause a use of AI until the board has reviewed it.
What should the board ask for on each decision?
Use this table to turn each decision into a question for management and a piece of evidence you can read.
| Decision | Question for management | Evidence to request |
|---|---|---|
| Purpose and boundaries | Where is AI used today, including tools staff chose themselves? | A one-page inventory with owners |
| Risk appetite | Which uses are high risk and why? | A short risk rating with the reasons |
| Accountability | Who answers to us, and who stands in for them? | A written role description |
| Oversight and reporting | What will we see each quarter? | A report template with agreed measures |
| Investment and capability | What do we lack: people, data or controls? | A costed plan with options |
| Escalation and stop rules | What would make you stop a system? | An incident process with named contacts |
What does a 90-minute board agenda on AI look like?
This agenda works for a standing board or a dedicated session. Send the papers at least a week ahead so the time goes to decisions.
- Minutes 0 to 10: the purpose of the session and the decisions the board is asked to take.
- Minutes 10 to 30: where AI is used now, including unapproved tools, shown from the inventory.
- Minutes 30 to 50: the main risks and any incidents or near misses, in plain words and without jargon.
- Minutes 50 to 70: risk appetite: which uses the board approves, restricts or rules out.
- Minutes 70 to 85: accountability, committee ownership and the reporting template.
- Minutes 85 to 90: read back the decisions, each with an owner and a date.
Two habits make the session work. First, ask management to bring one real example of an AI use, from request to approval, so the board sees the process rather than a diagram. Second, agree before the meeting which decisions need a vote and which are for discussion only, so the minutes record a clear outcome and the next steps have names against them. Review the decisions again after one quarter and note what changed.
What should directors read beforehand?
Keep the pre-read short. Five items are enough for a first session:
- A one-page inventory of AI use, with an owner for each item
- The current AI policy, or a note saying there is none
- A list of AI vendors and the kind of data each one receives
- A summary of incidents and near misses, even if the answer is "none known"
- A draft of the six decisions for the board to amend
If management cannot produce the inventory, that is itself a finding. Make producing it the first action from the meeting.
When is an outside AI briefing for boards useful?
An outside facilitator can give the board a neutral view and keep the session on decisions. Our Executive and Board AI Briefings are half-day sessions for executives and boards that end in an application plan. Boards that want ongoing support can read about AI leadership, which our Fractional Chief AI Officer service covers, including board reporting. More on the Academy Lab is on its page.
How to start
Start with the inventory, because every other decision depends on it. If you want a second pair of eyes, book the free AI Exposure Scan: a free 45-minute conversation that ends in a written next step. You can bring that note to your next board meeting.
Frequently asked questions
What should a board decide about AI?
A board should decide where AI may be used, how much risk it accepts, which executive is accountable, what reports it receives, what the organisation will invest, and when a system must be paused. These decisions set direction. Management then handles tools, projects and day-to-day controls inside those limits.
How long should a board AI briefing be?
A 90-minute session can work for a first briefing when the papers go out a week earlier. At least half of the time should go to discussion and decisions. A longer half-day format suits boards that want to work through their own use cases and leave with an application plan.
Do directors need technical knowledge of AI?
No. Directors need enough understanding to ask clear questions about purpose, risk, data, people and accountability. Management should explain technical points in plain words. If an answer cannot be explained simply, the board can ask for the evidence behind it in writing.
Is the NIST AI Risk Management Framework mandatory?
No. NIST says the framework is intended for voluntary use. Organisations can still use it as a reference for how to organise AI risk work, and boards can use its govern function to check that leadership owns the decisions. Legal duties depend on your sector and country, so confirm them with counsel.
Get new insights by email
One email when we publish something useful. No spam; leave any time.
Services in this article
Related lab: Academy Lab ↗
