The 12 AI Questions Your Board Will Ask (and the Answers That Hold Up)
12 AI governance board of directors questions on data, liability, spend, and oversight, with the evidence that answers each and a quarterly report template.
Board-level AI governance is no longer optional homework. In a 2025 NACD survey, more than 62% of directors said their boards now reserve full-board agenda time for AI discussions [6]. If you run technology or risk at a regulated firm, the AI governance board of directors conversation is coming to your next meeting, whether you scheduled it or not. This article gives you the twelve questions directors actually ask, grouped by data, liability, spend, and oversight, plus the specific evidence that makes each answer hold up under follow-up. It ends with a one-page quarterly AI-risk report format you can reuse. It is written for CEOs, CTOs, CISOs, and general counsel who will be standing in front of the board.
Why AI governance is now a board of directors problem
Three forces moved AI from the IT budget line to the board agenda.
First, enforcement became real. In March 2024, the SEC settled its first "AI washing" cases against two investment advisers, Delphia and Global Predictions, for claiming AI capabilities they did not have. Penalties were modest ($225,000 and $175,000), but the signal was not: public statements about AI are now securities-disclosure territory, and marketing language must be substantiated with documents [2].
Second, the governance bodies formalized the expectation. NACD now publishes boardroom tools listing the questions directors should ask about AI use, competitive position, and risk [1]. IOSCO's guidance for capital-markets regulators treats missing board oversight, no AI inventory, and undocumented approval processes as red flags in supervision [5].
Third, the baseline frameworks exist, so "we did not know what good looked like" stopped working. NIST's AI Risk Management Framework (released January 2023) names Govern, the function covering accountability, policies, and decision rights, as the cross-cutting layer that holds the other three together [3]. ISO/IEC 42001 offers a certifiable management-system counterpart. Voluntary, yes. But in a dispute, "we aligned to NIST AI RMF" is a sentence your lawyers can use.
The 12 questions, and the evidence that answers each
Directors do not ask about models. They ask about exposure. These twelve questions cover the four categories that recur across NACD guidance, regulator red flags, and our own board-prep work. The middle column is what a weak answer sounds like. The right column is the artifact that survives a follow-up question.
Data
| Question | Weak answer | Evidence that holds up |
|---|---|---|
| 1. Where does our data go when staff use AI tools? | "We have an acceptable-use policy." | Gateway logs showing every AI request, destination, and data class. An enforced policy, not a PDF. |
| 2. Do we have a complete inventory of AI systems in use? | "IT is working on a list." | A living AI registry: system, owner, data touched, vendor, approval status. IOSCO flags the absence of this as a supervisory red flag [5]. |
| 3. Can client or patient data end up training a vendor's model? | "The vendor says no." | Contract terms (zero-retention, no-training clauses) plus deployment architecture: models in your VPC or your tenant, verified by config, not by sales deck. |
Liability
| Question | Weak answer | Evidence that holds up |
|---|---|---|
| 4. If the model is wrong, who is liable? | "We are looking into insurance." | Vendor indemnity terms reviewed by counsel, E&O/cyber policy endorsements that name AI, and a documented human-in-the-loop rule for high-stakes decisions. |
| 5. Could we substantiate every public claim we make about AI? | "Marketing wrote that page." | A claims file: each external AI statement mapped to internal evidence. The Delphia and Global Predictions cases turned on exactly this gap [2]. |
| 6. What happens when a model makes a decision we cannot explain? | "The vendor handles model quality." | Decision logs with inputs, model version, and output for consequential decisions. In a 2021 FICO/Corinium survey, 65% of companies could not explain how specific model decisions were made. That is the failure mode this question probes [4]. |
Spend
| Question | Weak answer | Evidence that holds up |
|---|---|---|
| 7. What are we spending on AI, all-in? | "About $X on licenses." | Per-request cost telemetry rolled up by use case: API fees, infrastructure, integration labor, and the human review time nobody budgets. |
| 8. Which use cases have paid back? | "Adoption is strong." | A short list with measured before/after numbers (hours saved, error rates, cycle time) and a kill list of pilots that did not. |
| 9. What if a vendor doubles prices or kills a model we depend on? | "We would switch." | A portability assessment per critical use case: can the workload move to another model or a self-hosted one, and what does the switch cost? |
Oversight
| Question | Weak answer | Evidence that holds up |
|---|---|---|
| 10. Who is personally accountable when AI causes harm? | "It is a team effort." | A named accountable executive per AI system, in writing. NIST AI RMF's Govern function exists because this question usually has no answer [3]. |
| 11. How would we know about an AI incident, and how fast? | "Security would catch it." | An AI-specific incident runbook, detection hooks on model outputs and data flows, and at least one tabletop exercise on record. |
| 12. What would we hand a regulator tomorrow? | "We would assemble something." | An audit trail that already exists: request logs, decision records, approvals, eval results, retrievable in days, not assembled in panic. |
Notice the pattern. Every strong answer is an artifact that exists before the question is asked. Every weak answer is a promise to produce one later.
The quarterly AI-risk report: one page, five sections
Boards do not want a forty-slide deck. They want a standing one-pager they can compare quarter over quarter. This format works:
- Inventory delta. AI systems added, retired, or reclassified this quarter, with owners. If this number is zero every quarter, your detection is broken, not your adoption.
- Spend vs. value. All-in AI spend, the two or three use cases with measured returns, and anything killed. One honest kill builds more credibility than five wins.
- Incidents and near misses. Count, severity, time to detect, time to resolve. A quarter with zero incidents and zero near misses is a monitoring gap, not a perfect record.
- Control coverage. One line per NIST AI RMF function (Govern, Map, Measure, Manage): status, and what changed. This is the vocabulary regulators and auditors increasingly share [3].
- Top three open risks. Each with an owner and a date. Not thirty. Three.
Keep it to one page. Put the detail in an appendix the audit committee can request. The board's job is to spot trend lines and ask where the owners are; the report's job is to make that easy.
The case against board-level AI governance
The strongest criticism is not that AI governance is wrong. It is that most of it is theater.
Academic work on AI governance implementation names the failure mode directly: "paper compliance risk," the gap between governance documents and what actually shapes decisions during incidents [7]. Research on financial institutions finds existing frameworks "checklist-based and not dynamic enough" for systems whose behavior drifts after deployment [8]. Directors, the critics add, lack the technical depth to evaluate what management shows them, and quarterly metrics cannot track systems that change weekly. The 65% of firms that cannot explain their own model decisions mostly had governance programs [4].
There is a cost side too. Every hour of board prep, every committee charter, every framework mapping is time not spent shipping. For a firm running three low-stakes internal copilots, a full NIST AI RMF program is overhead disproportionate to the risk.
Both points are true, and neither is a reason to skip the twelve questions. They are a reason to answer them with evidence instead of documents. The theater critique indicts binders, not inventories. It indicts attestation, not telemetry. The fix for paper compliance is not less board attention; it is answers built from logs, contracts, and measured outcomes, which is precisely what the right-hand column above describes.
Our read
Boards are asking the right questions. Management teams are mostly answering with the wrong materials.
The gap we see in regulated firms is rarely awareness. It is that the answers live in slideware while the evidence lives nowhere. A policy is not an answer to "where does our data go." A log is. The firms that handle board scrutiny well treat governance as instrumentation: they can show the inventory, the spend telemetry, the decision records, and the incident history because those things were built as running systems, not assembled for the meeting.
Start with the five-section quarterly report. It forces the artifacts into existence. Once the report has two quarters of real numbers, the twelve questions stop being interrogation and become a working session. That is the actual goal: a board that can exercise judgment because management shows its work.
What this means for you
- If you are a CEO or managing partner: assign question 10 (named accountability) this week. It costs nothing, and every other answer gets easier once a person owns each system.
- If you are a CTO or CISO: build the AI registry and the request log before anything else. Questions 1, 2, and 12 all collapse into "show me the system," and both artifacts come out of one gateway deployment.
- If you are a CFO: demand per-use-case cost telemetry before the next renewal cycle. Question 7 is the one where weak answers become budget surprises.
- If you are general counsel or compliance: open the claims file now. Pull every public AI statement on your website and in your filings, and map each to substantiating evidence. The SEC has already shown what happens when the file does not exist [2].
- If you sit on the board: ask for the one-page quarterly report as a standing agenda item, and ask which of the three open risks has slipped its date twice. That single follow-up tells you more about the governance program than any framework attestation.
Book a free assessment: systemics.ai.
References
- "Boardroom Tool: Questions for Directors to Ask About AI," National Association of Corporate Directors (NACD), 2025. nacdonline.org
- "SEC Charges Two Investment Advisers with Making False and Misleading Statements About Their Use of Artificial Intelligence," U.S. Securities and Exchange Commission, press release, March 18, 2024. sec.gov
- "AI Risk Management Framework (AI RMF 1.0)," National Institute of Standards and Technology (NIST AI 100-1), January 2023. nist.gov
- "The State of Responsible AI," FICO and Corinium, 2021. Survey findings as cited in "AI and Data-Driven Business Models," Practising Law Institute, 2022. pli.edu
- "Artificial Intelligence in Capital Markets: Use Cases, Risks and Challenges," International Organization of Securities Commissions (IOSCO), 2025. iosco.org
- "Matters to Consider for the 2026 Annual Meeting and Reporting Season," Skadden, Arps, Slate, Meagher & Flom LLP, December 2025 (citing NACD director survey data). skadden.com
- "Beyond Compliance: Skeptical Intelligence for Digital Twin Governance in Critical Infrastructure," Preprints.org, May 2026. preprints.org
- Research on checklist-based AI governance limits in financial institutions, Scientia et Cultura, 2025. sci-cult.net
Related reading
Start with a free architecture assessment.
Thirty minutes, no slides. Tell us where your AI posture stands and we will tell you honestly whether we can help.