Board oversight of AI is becoming a regulatory and fiduciary expectation. Done well it sharpens the business. Done badly it produces glossy slides and no meaningful decisions.
Regulators in multiple jurisdictions are converging on the view that AI risk is enterprise risk and that the board is responsible for its oversight. The UK Corporate Governance Code's emphasis on emerging risk, the EU AI Act's accountability obligations on deployers, and the SEC's expectations on material-risk disclosure all push in the same direction (FRC 2024; European Parliament 2024; SEC 2023). Boards that treat AI as an operational matter for management alone are increasingly out of step.
The reasonable counter-argument — we are not technologists — is true and irrelevant. Boards do not need to be technologists to govern AI any more than they needed to be accountants to govern finance. They need a small set of well-chosen questions and a habit of asking them.
The five questions below, asked routinely and answered with evidence, cover the substance of AI oversight.
A board cannot govern from a verbal update. Three artefacts, kept current, give it what it needs.
The AI register. One row per AI system in production or active pilot. Columns for owner, business purpose, data categories, supplier stack, risk classification, control set and last review date. The board does not read every row; it reads the count, the distribution and the exceptions.
The AI risk heatmap. A visual that locates each material AI risk on likelihood and impact, with treatment status. The board's job is to interrogate the top-right corner.
The incident summary. A short list of incidents since the last meeting, with categories, root causes and the actions taken. Even a list of zero is informative if the organisation has the detection capability to populate it.
The most common failure of board AI oversight is the production of impressive but uninformative packs. A 40-page AI strategy that arrives the night before a meeting is not oversight; it is paperwork. Oversight is the moment a non-executive director asks why a particular risk has been accepted, and an executive answers without consulting notes.
Recovery from oversight theatre takes deliberate work: reducing the pack, raising the quality of the conversation, and inviting management to bring decisions rather than updates. The reward is a board that adds judgement to the organisation's AI posture, not just signatures.
ISO-STANDARD.app produces the AI register, the risk heatmap and the incident summary your board needs — current, evidenced and ready for the next meeting.
ISO-STANDARD.app ships a ready-to-adopt ISO 42001 workspace with the risk register, controls catalogue, policies and audit-ready exports already wired together — no spreadsheet sprawl, no consultant lock-in.
Prefer a conversation? Email hello@iso-standard.app — a real human responds within one business day.
