The Five AI Questions Every Board Should Be Asking

Most boards cannot yet answer five basic questions about AI in their organisation: what is running, who owns each piece, which uses carry real exposure, which rules apply, and what happens when something goes wrong. That gap is the issue. Whether the business “uses AI” stopped being a useful question some time ago.

In a growing number of boardrooms this year, a director has raised a version of the same point: the organisation is already using AI in several places, officially and unofficially, and nobody at the table can say with confidence who approved which use, what it touches, or what happens if it goes wrong. The silence that follows is the real finding. It says the business has AI activity without AI ownership.

Individual AI tools are cheap and quick to adopt. A team member can start using a new assistant in an afternoon, often well before IT, procurement, or the board hear about it. Multiply that across a business of any size, and the result is a set of AI use cases running quietly, with no register, no named owner, and no answer for what happens if one of them gets something wrong.

A board does not need to understand how a model works. It needs assurance that someone competent is holding the AI question end to end: visibility, ownership, risk, evidence, and value. That comes down to five AI questions every board should be asking, and be able to have answered in plain terms, at any time.

Why “do we use AI?” is no longer a useful board question

Most boards are still asking whether the organisation uses AI. For almost any business past a certain size, the answer is yes, and the question has stopped being useful. The better version replaces it: where is AI already in use, who owns each instance, what does it affect, and could the controls around it be evidenced if someone asked. That shift, from a yes-or-no question about adoption to a governance question about ownership and evidence, is where a board’s real responsibility sits.

The five AI questions every board should be asking

1. What AI is running in this business right now, and who owns each piece?

Unofficial AI use is usually well-intentioned and productive, which is exactly why it spreads quietly. The real test is whether anyone can currently answer:

• What AI tools are in use, official and unofficial
• What data each one touches
• Who is accountable for it

2. Which AI use cases touch decisions that a regulator, court, or customer would care about?

An AI tool that drafts internal notes carries different weight to one that informs:

• A hiring decision
• A pricing model
• Customer advice
• A credit assessment
• A complaint response

Those are the use cases that carry real exposure, and the ones that warrant closer attention now.

3. Which rules apply to us today, and which have dates attached?

Regulation, professional standards, procurement requirements, and insurer expectations around AI are moving quickly. A board does not need to master the detail. It needs to know which obligations plausibly apply, which have dates attached, and where specialist advice is needed, particularly anywhere AI touches:

• Employment, credit, or insurance
• Health, education, or children
• Personal data moving across borders

4. If we were asked to prove who approved this, could we?

A business that can describe its AI controls in conversation but cannot produce anything in writing has intention rather than governance. Answering this question well usually comes down to five artefacts:

• A short AI use policy
• A live register of what is running and who owns it
• An AI risk assessment on every tool before it is implemented
• An audit trail for significant decisions
• A named person accountable for sign-off

Building this does not need a large framework, only a decision, made in advance, that the answers should exist before anyone asks for them.

5. What happens when it goes wrong?

Every system fails eventually, and AI is no exception. Organisations that handle this well have already worked out:

• The realistic worst case for each significant use
• How they would know if it happened
• Who is responsible for monitoring it
• What the fallback is if the system is down or wrong

Finding out through an angry customer, rather than through monitoring built to catch it first, is the position no board wants to be in.

All five questions rest on the same requirement. Decisions about AI need to be grounded in what is actually happening, not in reassurance from one enthusiastic team. A board that can see the register and read the audit trail is working from evidence. A board relying on a verbal assurance is working from hope.

Does risk follow the decision or the technology?

The instinct is to ask whether an AI tool is risky. The more useful question is what decision it affects, who it affects, and what happens if it gets that decision wrong.

A tool used to summarise a meeting and one used to inform a hiring shortlist or a pricing decision are not equivalent, even on the same technology. The second touches someone’s opportunity, cost, or outcome, and deserves more scrutiny, sign-off, and record-keeping. Risk follows the decision, not the technology, and that is the test worth applying before judging any AI tool risky in the abstract.

What does AI governance look like in practice?

Governance sounds like bureaucracy to most growth-stage leadership teams. In practice, it comes down to the five artefacts above: a policy, a register, a pre-implementation risk assessment, an audit trail, and a named owner. That is the foundation that lets a leadership team answer hard questions with evidence rather than reassurance. Building that foundation without adding unnecessary admin is worth doing carefully.

What is the shadow AI problem?

The most dangerous AI in your business may be the AI nobody knows your team is using.

Unofficial adoption is rarely reckless. Staff using a new tool without asking permission are usually trying to work better and faster, and often succeeding. The risk sits in the absence of visibility: leadership cannot manage what it does not know exists. Shadow AI is shadow IT moving at AI speed, and it deserves the same discipline IT leaders have long applied to unmanaged software.

What boards need to decide now

None of this asks a board to become fluent in artificial intelligence, only to apply the same discipline it already brings to finance, safety, and compliance: someone accountable, answers in writing rather than in memory, and a plan for the moment something goes wrong.

The organisations getting this right have decided, early and deliberately, that AI activity needs an owner, a register, and a named person who can answer for it. That decision costs very little to make, and it is available to any board willing to ask the five questions and expect a real answer.

“Risk follows the decision, not the technology. A board does not need to understand the model. It needs to know who owns it, what it touches, and what happens when it gets something wrong.”

If your board could not yet answer these five questions with confidence, the AI Readiness Scorecard is a useful first step. It takes around five minutes and shows where your organisation’s foundations for AI are strong and where the gaps are.

Take the AI Readiness Scorecard →

© The Systems Lab® 2026. All rights reserved.