In most organisations, AI arrived quietly. Staff started using generative AI tools to draft emails and summarise documents, suppliers added AI features to their software, and somewhere a team began experimenting with something bigger. Very often, the board has not yet had a proper discussion about any of it.
You do not need to be a technologist to govern AI well. You need to ask good questions. Here are five to start with.
1. Where are we using AI today?
Ask management for a simple inventory: the AI tools staff use, the AI built into the systems you buy, and anything you are developing. The answer is almost always "more than we thought".
2. What could go wrong, and how bad would it be?
The main risks include confidential data being put into public tools, inaccurate outputs being relied on, bias in decisions about people, security weaknesses and intellectual property issues. Which of these matter most for you?
3. Who is accountable?
Someone at senior level should own AI risk, and it should be clear who approves new uses of AI. If the answer is "IT", ask whether that is really where the business decisions are made.
4. What are our rules?
An AI policy does not need to be long. It should say what staff can and cannot do, which tools are approved, and how new uses are assessed. Frameworks such as ISO/IEC 42001 can help structure this as you mature.
5. How will the board know it is working?
Agree what the board will see and how often: the inventory, any incidents, and progress against the policy. AI should become a regular item on the risk agenda, not a one-off presentation.
If your board has not yet had this conversation, these five questions are a good place to start.