Boards do not need to approve every AI feature, but they do need to govern the risk appetite and accountability structure that determines where AI may be used. A board pack should show material use cases, risk classes, incidents, customer outcomes, concentration, model changes, unresolved validation findings and the evidence supporting management's conclusions.
Set boundaries that management can apply
Risk appetite can limit prohibited or unacceptable uses, human-oversight exceptions, customer-impact thresholds, vendor concentration, unresolved high-severity findings and time to remediate. Vague statements about responsible AI are not operational limits.
Assign accountable executives
Each material use case needs a business owner with authority over purpose, budget, controls and retirement. The model owner, data owner, technology owner, compliance adviser, validator and internal-audit reviewer should have defined responsibilities and escalation routes.
Ask for evidence, not reassurance
Boards should ask to see the inventory, classification rationale, validation summary, data-protection assessment, supplier evidence, incident dashboard and remediation ageing. Where management relies on an external provider, the board should understand what cannot be independently verified.
The European Commission AI framework and NIST AI RMF are useful reference points. This article reflects Quantica Risk Modelling's governance perspective and is not legal advice.