Skip to content
LOUIS WILLACY, ESQ.
Board Governance

The Seven Questions Every Board Should Ask About AI

The point of AI oversight is not to turn directors into engineers. It is to make sure management has a defensible strategy and a disciplined way to execute it.

1. How does AI change our competitive position?

Begin with the business model, not the software budget. Where might AI reduce the value of our existing products, lower barriers to entry, or enable competitors to serve customers in new ways? A board should distinguish incremental productivity tools from changes that could fundamentally alter the economics of its industry. Management should be able to articulate both threats and opportunities.

2. What are we trying to accomplish?

A portfolio of pilots is not a strategy. Ask management to identify a limited set of measurable objectives: cost-to-serve, revenue growth, customer retention, product velocity, quality, or speed. Identify whether each initiative is exploratory, in production, or being scaled, and assign accountable business owners.

3. How do we measure results?

Anecdotes about time saved are a starting point, not a return-on-investment analysis. Boards should seek metrics that account for implementation costs, integration, evaluation, ongoing oversight, and what happens when an output is wrong. The goal is comparable evidence that links investment to enterprise value.

4. What must remain under human control?

Different AI uses warrant different levels of review. Internal drafting assistance should not necessarily be governed in the same way as automated eligibility decisions or customer-facing commitments. Ask management to define escalation thresholds, evidence requirements, logging, and responsibility for consequential decisions.

5. Who owns the risks and opportunities?

A generic statement that the board oversees AI is insufficient. Boards should understand management ownership, relevant committee responsibilities, material-risk reporting, and how governance connects with existing enterprise risk management. Artificial intelligence intersects with cybersecurity, privacy, intellectual property, employment, procurement, and reputation, but it also belongs on the strategic agenda.

6. Does the organization have the capability to execute?

Buying access to AI tools is not the same as building organizational capability. Is the data usable? Are workflows documented? Can outputs be tested? Does management understand vendor dependencies, change management, workforce implications, and the security perimeter? Does the leadership team have incentives to scale what works and stop what does not?

7. Is the board itself ready?

Directors increasingly use AI to prepare for meetings. They need clear rules concerning confidential information, approved platforms, verification, and records. Boards should establish a recurring learning agenda and seek independent advice when the limits of internal expertise become material.

For the board

The right board conversation is neither AI enthusiasm nor AI fear. It is disciplined inquiry into strategy, evidence, accountability, and value. The strongest directors will challenge management constructively without trying to manage the implementation themselves.


Related reading: When an Algorithm Reads Your Proxy and AI Is on the Ballot (Harvard Law School Forum on Corporate Governance, Nov. 5, 2026). The analysis above reflects the author’s perspective.

← Back to Insights