A director had read something troubling that morning before the board meeting. A competitor had deployed an AI system that made incorrect pricing decisions across thousands of insurance policies before anyone caught it. Reputational damage. Regulatory investigation. Law suits filed.
So the director raised it during the board discussion on AI. Not formally. Just an impromptu question to the CEO.
"Are you confident in our AI controls?"
The CEO paused and said: "Absolutely. We have a responsible AI framework in place."
The director nodded, not sure how to follow-up. The Chair did not assist. No one else raised their hand. The board moved to the next point on the agenda.
In this example, an assurance was given by the CEO that a responsible AI framework is in place. Was the response appropriate? Is the board any more informed by that assurance?
Let's get started on how to improve AI governance
The question is the instrument of governance
Edition 7 drew a line between AI literacy and AI governance competence. Literacy is knowing what AI is. Competence is knowing what to ask, and how to follow up when the answer is thin.
That line matters here because the problem in most boardrooms isn't silence. Directors are asking about AI. They're just not asking governance-grade questions.
A governance question does three things. It maps accountability. It asks who owns an outcome, not just who manages a process. It probes verifiability by asking how the board would know, not just whether management is confident. And it's specific enough that a vague answer is recognisable as a non-answer, rather than something that sounds like information.
The difference between the questions isn't technical knowledge. The value of governance-grade questions lies in the quality of the business insights they reveal.
Five domains. Five questions that change the dynamic.
AI governance oversight spans five domains, and the question architecture has to cover all of them. As an example, here is one governance-grade question per domain — alongside the easy question that can impair governance of AI.
Accountability
The easy question: Who is responsible for AI in this organisation?
The governance-grade question:
- For each AI system making or influencing material decisions, what is the name of the individual accountable when it produces a wrong or harmful outcome — and what is the escalation path to this board?
The easy question produces an org chart answer: the Chief Data Officer, the CTO, the AI ethics committee. The governance-grade question produces a name with responsibility. Accountability isn't a job title. It's a named person, with a defined scope of responsibility, and a duty to report upwards when something goes wrong. If management can't provide that detail, it doesn't yet exist.
Failure detection
The easy question: How do we know if something goes wrong with our AI?
The governance-grade question:
- What quality indicators are used for each material AI-assisted process — and what is the threshold that triggers a report to this board before an incident becomes a crisis?
Most AI risk monitoring is retrospective: something fails, it's reported. A board that only receives post-incident reports isn't overseeing AI — it's reviewing what already happened. The governance question builds in the expectation of early-warning indicators and a defined escalation trigger. If the answer is "we'd escalate anything material," the follow-up is: what makes something material, who decides, has that ever been tested? And most importantly, does the board agree with the escalation process?
Human oversight
The easy question: Is there a human in the loop?
The governance-grade question:
- Where human judgment has been preserved in our AI processes, can management confirm that those individuals have the authority, the information, and the time to actually change an outcome — or are they reviewing decisions that have effectively already been made?
Edition 7 introduced the human in the loop concept. The governance question operationalises it. Being in the loop is meaningless if the human is positioned after the consequential moment, reviewing at speed, without the authority to reverse. Directors who accept "yes, there's a human involved" without asking whether that human can impact the outcome are accepting the form of oversight without the substance.
Regulatory exposure
The easy question: Are we complying with AI regulations?
The governance-grade question:
- Which regulatory frameworks apply to our AI deployments and has management conducted a formal gap assessment against each? Where are the material compliance risks, and what's the remediation timeline?
"Yes, we're compliant" is not a governance-grade answer. The question asks for the detail the board needs to exercise meaningful oversight of legal and regulatory exposure. The answer tells you something about the quality of AI governance at management level.
Information and reporting
The easy question: What AI updates should we be receiving?
The governance-grade question:
- What decisions about AI deployment, modification, or decommissioning has management made in the last quarter that it determined were below the threshold for board reporting? And on what basis was that determination made?
This is the question that changes the accountability dynamic most sharply. It asks about information flows and escalation decisions. Who decided that the board didn't need to know, and why? If management has never considered this question, the reporting threshold was set by default rather than design. That default setting should be jointly reviewed by board and management to determine an appropriate escalation protocol.
The second dimension: cadence
The right question at the wrong moment is a missed opportunity to govern. The question architecture has to answer not just what to ask, but when.
Three categories shape the cadence.
Standing questions or recurring agenda items belong at every board or relevant committee meeting: accountability mapping, incident log review, threshold breach reporting, regulatory status. These are the monitoring layer. They establish whether AI governance is a continuous activity or an occasional one.
Formal review questions include a structured assessment of the organisation's AI governance posture, board competency review, external benchmarking, AI policy refresh. These questions will impact the shape of governance in general, because of the wide scope of AI. The board and its committees' leaders need to think about this in their own context and agree an appropriate governance cadence.
Trigger questions activate when circumstances demand: a major AI investment decision, a new system deployment, an external incident at a peer organisation, a regulatory development, a whistleblower concern. Governance-grade boards don't wait for the agenda cycle when something material shifts. They have the question architecture ready before the trigger fires.
A question architecture spread across five domains and three cadence categories is not an onerous system. It's a governance instrument. The difference between a board that has it and one that doesn't shows up long before anything goes wrong.
Language / Clarity / Confidence
This edition exists so that you can walk into your next board meeting with the language, the clarity and the confidence to ask governance-grade AI questions, even if no one else does.
Language. The five domain question examples in this edition give you a working vocabulary for AI governance oversight — one that distinguishes accountability from responsibility, monitoring from reporting, and the activity from the framework. When a CEO says "we have a responsible AI framework," you now have the language to develop a discussion and improve governance.
Clarity. The clarity-of-questions problem isn't about knowing too little. It's about asking the wrong thing. Most boards are one question away from a genuinely different conversation. The shift from "are you confident in our AI controls?" to "who is accountable, and how would we know before it's too late?" is a clarity shift, not a technical one. You can make it today, or in the next meeting where AI appears on the agenda.
Confidence. You don't need a machine learning background to ask these questions. You need the structure, which includes the five domains, the three cadence categories and the confidence to follow-up when the answer sounds vague. That structure is now in your hands and it can be applied, with careful preparation, in your own context.
Boardroom Takeaway
The director who accepted "we have a responsible AI framework" walked out of that board session with no more information than they walked in with. The director who asks questions that produce insights is making progress.
The gap between those two directors isn't knowledge. It's preparation, language, clarity and confidence.
And if you're building toward a board role rather than already in one: the governance capability that will distinguish you isn't AI expertise. It's knowing what to ask when the expert presents, and knowing what a thin answer sounds like.
Until next time,
Paul
Edition 9 will address a question that applies to all boards: when your AI strategy depends on a handful of external providers does your board know how deep the dependency runs?