Boards spent the last decade learning they could not ignore cybersecurity. AI is now arriving at the same door, and boards that wait for an incident to take it seriously will repeat the same painful education.
The board’s job is not to select tools or understand model architecture. It is to ensure the organization is using AI deliberately rather than accidentally, and to be able to show that oversight existed. Directors need command of exactly five questions.
Where is AI in use in this organization today, officially and unofficially? If management cannot answer, that itself is the finding, because shadow use is nearly universal now.
What data does it touch? The board should know whether client information, employee records, or regulated data flows through external tools, and under what protections.
Who is accountable? Every significant automated process should have a named human owner. “The vendor” and “the system” are not names.
What could go wrong, and would we know? Error channels, review checkpoints for consequential outputs, and honest incident reporting up to the board.
Are we capturing the benefit? Oversight is not only defensive. A board should ask whether the organization is deliberately gaining productivity, or merely paying subscriptions, because falling behind is also a risk.
The mechanism is light. A one-page quarterly AI summary from management and twenty minutes of discussion, minuted. That documented rhythm accomplishes two things. It genuinely reduces risk, because sunlight changes behavior below. It creates the record that regulators, insurers, and courts increasingly expect, showing this board saw the technology shift and governed it.
Boards do not need to become technical. They need to do what boards are for. Require answers, name owners, and keep receipts.
Mel Meier, DBA is an applied social scientist and the founder of iB Consulting USA, a woman owned, WOSB certified advisory firm. She serves boards, associations, and executive teams through board advisory, organizational diagnostics, speaking engagements in the United States and internationally, and organizational assessments.
