What are boards actually asking about AI?
Boards are moving from "should we discuss AI" to "show us". Deloitte's Governance of AI report, second edition, based on 700 board members and executives in 56 countries surveyed in January and February 2025, found that 31 percent said AI was not on the board agenda, down from 45 percent in the previous edition, while 66 percent said their boards had limited to no knowledge or experience with AI, down from 79 percent. NACD's 2025 Public Company Board Practices and Oversight Survey (analysis dated July 28, 2025) found that more than 62 percent of director respondents set aside agenda time for full-board AI discussions.
The questions themselves are fairly consistent. NACD's Director Essentials: AI and Board Governance (September 15, 2023) includes an oversight checklist that asks, among other things, which business units and functions use AI tools, whether they were built or procured, whether management knows how employees use publicly available AI tools, which committee has primary oversight, and whether the company is compliant with current AI laws. The ten questions below are my synthesis of those themes for a leader who has to answer in plain English. They are not a quotation of any one source, and your board may phrase them differently. Investors and LPs often ask the same things in their own words.
What are the ten questions, and how do I answer each one?
Use the same shape for every answer: one sentence that answers, one sentence of evidence, and one sentence about what is not done yet. Plain words, and no product names unless someone asks.
| Question | Answer shape | Evidence to bring | Do not claim |
|---|---|---|---|
| 1. Where do we use AI today? | Name the three to five real uses, including staff using tools on their own. | A short inventory: use, owner, tool, data involved. | That nobody uses it. Check before you say so. |
| 2. What data does it touch? | Describe by class (public, internal, restricted) and say which classes are allowed. | The data rules page. | That data never leaves, unless you verified the vendor's terms. |
| 3. What is our strategy? | Name two or three places AI could help and one where it could threaten the business. | A one-page plan with owners and dates. | Being "AI-first" with no plan behind the phrase. |
| 4. Who is accountable? | One named executive and the escalation path. | A role description and the meeting where it is reviewed. | That a committee that has never met provides oversight. |
| 5. What are the main risks? | Three risks in business terms: confidentiality, wrong output acted on, vendor dependence. | A one-page risk list, ideally mapped to a reference such as the NIST AI RMF. | That risk is low, with no basis. |
| 6. Are we compliant with the laws and contracts that apply? | Say what you checked and with whom. | Counsel's written list of the obligations that apply. | Compliance with a standard you have not been assessed against. |
| 7. What has it delivered? | Give one or two before-and-after examples in hours, errors or cycle time that you measured. | The baseline and the current number from the same source. | Savings you estimated but did not measure, or any figure from a vendor deck. |
| 8. What is it costing? | Total spend by tool, plus the people time involved. | A one-line budget with the approval owner. | That there is no cost because the tools are free. |
| 9. What happens when it goes wrong? | Describe who is told, how fast, and who decides next steps. | The incident steps, and one rehearsal or real example if you have one. | That nothing has gone wrong, unless you have a way to know. |
| 10. What do you need from us? | One ask: a decision, a budget approval, education or a committee assignment. | The ask on one line, with the reason. | That you need everything. A board cannot help with everything. |
What evidence should I bring to the meeting?
Bring four things, not a deck. First, the inventory of uses from question 1. Second, a one-page AI policy; ten questions and a policy skeleton are a starting point, and the same logic works for a company of any size. Third, a dated plan with owners; the 90-day roadmap shows one shape. Fourth, one real example of an output and the human review that checked it.
If the board wants more structure on oversight, AI governance for non-technical CEOs lays out seven decisions and a three-tier risk model, and the maturity model gives you a way to describe where you are without overstating it.
What should I not claim in front of a board?
- Numbers you did not measure. Where you have an estimate, call it one and say how you made it.
- Compliance or certification you have not had assessed. Saying you are aligned with a framework only means something if you can show how.
- Control because a policy exists. A policy is a start. Show how it is followed and who checks.
- A vendor's results as your own. Case studies belong to the vendor.
- Certainty about a fast-moving area. "As of today, and we review it every quarter" is stronger than "we are covered".
- Outcomes you cannot promise. Describe the plan and the measures, not the result.
What does a one-page board briefing look like?
Use this outline. If a section is empty, write "not yet" and give a date; that reads as honest, not weak.
- Position. One sentence on where we stand with AI today.
- Where we use it. Three to five rows: use, owner, tool, data class.
- Data rules. What may and may not be entered into AI tools.
- Governance. Named owner, review cadence, last review date.
- Results so far. Measured only, with the baseline beside each number.
- Top three risks. The control for each and who owns it.
- Next 90 days. Three actions with dates.
- The ask. What we need from the board, in one line.
How do I prepare in one week?
- Day 1. Ask each executive and team lead which AI tools they know of. Send staff one short, no-blame question about what they use.
- Day 2. Build the inventory and sort the data involved into public, internal and restricted.
- Day 3. Ask counsel to list the contract and legal obligations that apply. Ask IT or your security provider which tools can be reached from company devices.
- Day 4. Draft the one-page policy, or confirm the existing one is current. Name the owner.
- Day 5. Collect results you can show with a baseline. Drop every figure you cannot source.
- Day 6. Write the briefing page. Rehearse the ten answers aloud with someone who has not read it.
- Day 7. Send the page to the chair ahead of the meeting. List the questions you could not answer and promise a date for each.
If you want a private rehearsal partner, executive AI coaching is one to one, on video, and built around your own materials. If you would rather have a leader inside the team who owns this ongoing, see fractional CAIO engagements.
Sources
- Deloitte Global Boardroom Program, Governance of AI: A critical imperative for today's boards, second edition (survey fielded January to February 2025). 700 respondents in 56 countries: 31 percent said AI was not on the board agenda (45 percent previously), and 66 percent said boards had limited to no knowledge or experience with AI (79 percent previously).
- NACD, 2025 Public Company Board Practices and Oversight Survey, AI analysis (July 28, 2025). More than 62 percent of director respondents dedicate agenda time to full-board AI discussions.
- NACD, Director Essentials: AI and Board Governance (September 15, 2023). An AI oversight checklist covering where AI is used, built or procured, employee use of public tools, committee oversight and legal compliance.
- NIST, Artificial Intelligence Risk Management Framework (AI RMF 1.0) (January 26, 2023). A voluntary reference for managing AI risk, organized around Govern, Map, Measure and Manage.