Welcome to the final edition of a six-part series on AI Governance that started with Edition 7.
Back in Edition 9, a CEO briefed the board that "AI now handles 40% of our customer volume. That makes us the most cost-efficient player in the market. We're on strategy, with a great partner." The board noted it. The Chair said well done. The agenda moved on.
This final edition is about what that board should have had in place to enable a governance-grade discussion, and why. Six editions on, that's where the series has been heading.
There's a test that separates two kinds of board. One kind watches a technology and asks whether it works. The other governs a strategic resource and asks whether it's the right bet, and whether the return is achievable and sustainable. Editions 7 through 11 each took one part of that challenge. This edition puts them all in one frame.
The strategic resource, not the tool
AI arrives in most boardrooms dressed as a technology, or a tool. That framing hands it to the people who understand the technology. And it invites the board to ask technology questions. Does it work? Is it secure? Is there a human involved? All reasonable questions. None of them strategic. Edition 7 drew attention to this distinction, between AI literacy and AI governance competence. Literacy asks the technology questions. Competence asks the strategic, governance-grade ones.
Edition 10 made the distinction between AI that delivers efficiency and AI that improves competitiveness. A lower-cost version of the same business can still lose. Savings buy time. They don't buy position. So the board that governs AI as a strategic resource asks the positioning question every time the efficiency slide appears. Efficiency and competitiveness are two different metrics. Only one of them decides whether the company is still standing in five years.
What "in place" actually means
Ask a board what it has in place for AI governance. You'll often get a policy document. A responsible AI framework, filed and referenced. Edition 8 showed what that assurance is worth when a director accepts it without a follow-up. It gives the board nothing to act on.
Having something "in place" means having live mechanisms. Mechanisms that produce information the board can govern with. Here are five, drawn from the series.
A question architecture that runs on a cadence. Edition 8 laid out governance-grade questions ranging over five domains and three timing categories. "In place" means those questions appear on agendas by design. Standing questions at every relevant meeting. Formal reviews on a recurring schedule. Trigger questions ready before the trigger event. A board that asks governance-grade questions only when prompted has not reached the level needed to adequately govern AI. This calls for a governance architecture that is tested and in place.
A named owner "in place" for every AI system that matters. Edition 11 put this at the contract stage. That's where it stays. One executive owns the outcome of each material system. What makes the executive ownership work is reflected in what they secured before go-live. Records deep enough to reconstruct what the system was asked and what it returned. The running version logged. The provider bound to preserve evidence and cooperate. The authority to stop the system. The board approves which systems need an owner. The board approves the owners. That matter sits in the schedule of matters reserved for the board.
A dependency threshold that is "in place". Edition 9 watched a dependency form gradually, one sensible transaction at a time. It reached 40% of customer volume on a single provider. No fallback had been tested. "In place" means the threshold was set in advance. By spend, by volume, or by share of a revenue-affecting function. The concentration risk triggers a board conversation while the company still has choices. A threshold set in advance controls the exposure. A threshold set after the dependency forms only describes it.
A remuneration design that measures all of the consequences. Also Edition 9. The executive incentive plan rewarded the cost saving. It said nothing about the concentration risk built alongside it. So the board paid to create an exposure it would later have to govern. "In place" means the Remco has asked what the plan measures and what it misses. And Remco closed the gap. This doesn't need a redesign of executive pay. It needs one question, asked and answered.
An incident plan built for a failure you caused. Edition 11 again. Most crisis protocols assume an attacker, as a cyber event does. This is not helpful on the day an approved AI system is discovered to have been quietly harming customers for eleven months. "In place" means the plan has been tested against a self-inflicted failure. Who can stop which systems. What stops with them. Who holds the authority to pull one when no board can be convened inside the reporting window.
Look again at the five paragraphs above. Every item is a governance mechanism. Each one produces a decision, a name, a threshold, or a record. That's what governing a strategic resource looks like.
Where AI sits, resolved
Edition 10 settled where AI governance sits. It belongs to the full board, with the Chair leading. This edition confirms it.
AI governance sits with the board as a strategic matter. The Chair leads it. Committees feed specialised work upward. Audit takes the controls. Risk takes the downside. A dedicated committee, if one exists, takes the technical depth. But the question of whether AI improves the company's competitive position belongs to none of them alone. It's a strategy question. Strategy sits with the full board.
The schedule of matters reserved for the board makes this tangible. Edition 11 introduced that schedule and put named executive owners on it. We now produce the full list. The board reserves the approval of the dependency threshold. It reserves the named owners of material systems. It reserves the decision to return a system to use after a failure it couldn't explain. Once those sit in the reserved schedule, AI governance has a home that no committee gap can invalidate. And the Chair has the standing to lead it.
What changes for you personally, one last time
Across this series, your understanding has been developing edition by edition. Edition 7 asked you to tell literacy from competence. Edition 8 handed you the governance-grade questions. Edition 9 asked you to read the good-news slide for the dependency it hid. Edition 10 asked you to raise the question of where AI governance sits, and to offer to help the Chair carry it. Edition 11 asked you to sit with the silence when you request an executive name and none comes back.
This Edition 12 asks something that holds all of those together. Your duty of oversight hasn't changed. What has changed is that you now need evidence to show you discharged it. And that's where the record becomes important.
What you asked. When you asked it. What you were told. A director who has spent six editions learning to ask governance-grade questions has been building that record already. Keep building it. When the AI item reaches the board, ask the strategic resource questions. See that the answers reach the minutes. Where the answer is a pause, see that the pause reaches the minutes too.
Language / Clarity / Confidence
This edition exists so you can walk into your next board meeting with the language, the clarity, and the confidence to govern AI as a strategic resource.
Language. The phrase to focus on is "return on the strategic resource." When the efficiency slide appears, switch to "what competitive position is this buying us, and is the return sustainable?" Efficiency and competitiveness are two different metrics. The language keeps them apart.
Clarity. The clarity is in the reframe from tool to strategic resource. AI is a strategic resource the board deploys, values, and monitors for an expected return. The way it already does with capital and talent. Every mechanism in this edition flows from treating it that way. If your board is still asking technology questions, that's the reframe to make in the next meeting where AI appears.
Confidence. You don't need to fully understand the AI model to govern the resource. Six editions have shown the governance capability was never technical. It's the informed confidence to ask what return the resource is earning. To name the dependency before it sets. To hold the strategic question in a room where everyone else is satisfied with the efficiency answer. That confidence is now yours to use.
Boardroom Takeaway
For the Chair: "I want us to govern AI as a strategic resource. That means five things must be in place. A question cadence. A named owner against every material system. A dependency threshold. A remuneration plan that measures the risk we're building. A crisis plan for a failure we caused. I want to know which of those we have, and where the gaps are."
For you as a board member: what return is this strategic resource earning, and is it sustainable? And of the five things a board should have in place, which does ours actually have?
This is where the series has been heading since Edition 7. The destination was always a board that governs AI with the same discipline it brings to any strategic resource that decides whether the company wins. AI expertise on the board was never the point. The efficiency story the CEO told in Edition 9 was true. It was also the smaller part of the question. The board that asks the other part is doing the job.
That's the series. Six editions on, the work is to govern AI, and to govern it as what it is. A strategic resource this company needs a return on, held to the same standard as every other resource that matters.
Until next time,
- Paul