Most boards now have a framework for overseeing AI. Far fewer have directors who are very confident the board has the skills to oversee AI, cyber risk and data governance, and a board cannot close that gap on its own calendar. Management closes it, by bringing AI to the board in the same shape as any other investment the directors are asked to judge.
The gap is wide. Four in five directors in BDO's latest board survey say their board has a clear framework for AI and cyber risk, yet only 36% are very confident their board has what it takes to oversee AI, cyber risk and data governance, as Cybersecurity Dive reported. A framework is a set of rules for what the board looks at. If the directors are unsure how to read what they see, the rules have nothing to work on.
Directors are counting on management to bring them AI they can judge
The same survey, which reached more than 200 directors at U.S. companies in June, asked about the executives too. 88% of directors were confident that management has the expertise to find and adopt new technology and to manage cyber risk.
When nearly nine in ten directors trust management's expertise, my read is that the job lands on the CEO. A board that relies on management's expertise judges AI by what management puts in front of it. If what goes in front of it is a vendor demo, a chart of how many people logged in, or a policy document, the directors have a framework and nothing they can judge with it.
There is a second warning in the survey. About a quarter of directors said their agendas have grown so crowded that oversight of AI and cyber risk has slipped down the list. When an agenda is full, the item that is hardest to read is the one that slides to next quarter.
Bring AI to the board the way a new plant arrives
A board already knows how to judge a new plant, a price change or a sales hire. AI is one more growth lever, and it should reach the board in that same shape. For each AI effort that matters, the page answers five things:
- What it is for, in the company's own numbers: the sales, margin or hours it should move.
- What it costs to run this year, and who approves it when that grows.
- What has gone wrong or could, and what the company did about it.
- Which executive is accountable for it.
- What you need from the board: a decision, an answer, or nothing yet.
An AI update that answers the first question in general terms and skips the rest is a usage report, whatever its title. My own first question about any AI project is the same one I ask about everything else: why? If the page cannot answer that in a sentence, the board should hear that before it hears about the tool.
Training directors helps, but it runs on the board's clock
BDO's advice is aimed at boards themselves: stronger technology governance, AI oversight frameworks, more fluent directors and better coordination between committees. All of it is worth doing. It also moves at the pace of a board, a handful of meetings a year, while the company's use of AI can change from one month to the next. A CEO can have a better page in front of the board by the next meeting.
Companies using AI only in chat tools can skip the page
If AI in your company means a few people using chat tools, with no customer data in them and no process depending on them, one line in the CEO report covers it. The page earns its place once AI touches customers, pricing, financial reporting, or a vendor contract you would have trouble leaving.
Write the page for your largest AI effort first
Before your next board meeting, pick the AI effort that costs the most and fill in those five answers for it alone. If you cannot name the number it should move or the executive who owns it, that is the first thing your board needs to hear, and it is better coming from you.
I have written about scoring AI on growth instead of savings and about testing AI before you bet on it. Here is how I work with leadership teams on AI and growth. If you want a second read on that page before it goes to your board, get in touch.
John Wyatt · John Wyatt's page · All posts · RSS