Free Board Briefing · Nine pages
What should your board ask about AI?
Eight questions, a worked example, and practical preparation for your next board meeting. Read the briefing below or download a copy to keep.
A practical briefing for directors and executives
What should your board ask about AI?
Eight questions. Evidence behind the answers.
A clearer conversation at your next board meeting.
AI governance for boards and executives
An independent publication
The oversight problem
AI can change without appearing on the agenda.
The systems management knows about may be only part of the picture.
It can arrive through existing tools.
An AI feature can be activated in software the organization already uses. A procurement list may never record it.
It can change through a supplier.
A provider can update its model or terms. The organization’s own software may stay the same while the business process changes.
It can act as well as advise.
An assistant that sends messages or updates records needs clear limits on its authority, and someone who can intervene.
The first question is what is actually in use, and how management knows.
Confidence and evidence
A policy explains intent. Evidence shows what happens.
An assurance statement should open a conversation about the work behind it.
Illustrative boardroom exchange
“We have an AI policy.”
That tells you expectations have been written down.
A useful follow-up
“Can you show us how that policy is applied to a material AI system, and what the last review found?”
Ask how an answer is known, as well as what the answer is.
Questions one to four
Establish what you are overseeing.
Start here. Each answer gives the next question its context.
- 01
Visibility
What AI are we actually running?
Start with the systems in use, including AI inside existing products and tools used by staff.
- 02
Accountability
Who is answerable for it?
Establish who has the authority and responsibility to act when a system needs attention.
- 03
Value
Why are we running it?
Understand the business purpose and how management knows the system is delivering it.
- 04
Exposure
What could go wrong, and who could be affected?
Identify who could be harmed, how seriously, and what limits apply to the system’s use.
Questions five to eight
Examine what the assurance rests on.
Move from the system and its purpose to its foundations, evidence, and ability to recover.
- 05
Foundations
What is it built on?
Examine the data, models, suppliers, and dependencies the system relies on.
- 06
Obligations
What are we required to do?
Ask which legal, contractual, and ethical requirements apply to this use of AI.
- 07
Assurance
How do we know any of this is true?
Request evidence that the controls work, and understand who checked that evidence.
- 08
Resilience
What happens when it goes wrong?
Establish who can intervene, what happens after an incident, and how the business continues.
A worked example: Visibility
A list is a starting point. How was it checked?
Illustrative management answer
“IT maintains a list of that.”
Clarify the scope.
Does it include AI features in existing products, internally developed systems, and staff use of public tools?
Ask for the check.
When was the list compared with another source, and what did that comparison find?
Follow up on the gap.
If the list covers purchases only, ask how other uses will be found, who will do the work, and when the board will hear back.
An incomplete answer is a reason to investigate. It is not proof of evasion.
Explore the complete free Visibility example →The central idea
Find where your assurance stops.
Strong evidence about the systems on a list cannot establish what is missing from that list.
Testing can support confidence within this scope.
Those results do not cover systems nobody identified.
Illustration: an incomplete inventory limits the reach of later assurance.
Work through the questions in order. Record unresolved foundations instead of averaging them away.
Your next board meeting
Make the next conversation more useful.
Request the current picture.
Ask for the AI systems in use, their owners, and when that information was last checked.
Choose a material use.
Work through the eight questions for a system that matters to the organization.
Ask for supporting evidence.
Distinguish what management can demonstrate from what it intends to put in place.
Agree the follow-up.
Record the missing evidence, the person responsible, and when the board will review it.
A free starting point
Where might your AI oversight need a closer look?
Eight questions. Free. Your answers stay in your browser.
Take the free check →theassuranceline.com/assessmentContinue the work
Turn better questions into ongoing oversight.
Use the free briefing and check to start. Choose an edition when you need the detailed working resources.
For meeting preparation
Board Edition
The Board Guide and complete Board AI Questions, with follow-up questions and answers to examine across all eight domains.
For governance and assessment
Professional Edition
Board resources plus the complete framework, full assessment, project and launch checklists, reporting template, and standards mapping.
Created by Daniel Johns. More than 20 years of experience in cybersecurity, engineering, and assurance. About the author
Further reading: the four-page 15-Minute Briefing, framework overview, and free Visibility worked example.
This briefing supports oversight discussions. It does not provide independent assurance, legal advice, or certification.