What is the board's role in AI governance?
Oversight, not management. The board’s job is to establish that AI decisions have an owner, a number and a reporting line, and to test that the answers hold up. It is not to approve models or vendors. In practice that means asking for three things each quarter: who owns the AI purchase, what result would vindicate it, and where the AI security budget sits.
Which board committee should oversee AI?
There is no single right answer, and the choice matters less than making one. Audit committees tend to pick up AI risk and controls, technology committees pick up strategy and deployment, and some boards handle AI at the full board while exposure grows. What causes trouble is AI arriving as an update from whoever presented last, with no committee owning it between meetings.
What AI metrics should directors review quarterly?
Seven lines cover it: the named owner of AI purchasing; who signed the last purchases above the approval threshold; AI spend by funding source; payback dates on the largest commitments; the rate at which proving ROI is blocking further spend; an inventory of AI agents in production and what credentials each holds; and the AI security funding status.
The full dashboard is here.
How should boards evaluate AI investment and ROI?
By asking who is answering, not just what the number is. In our September data 70 percent of CEO-seat respondents expect measurable AI payback inside six months against 42 percent at the finance seat, on bases of 80 and 52. Both are honest answers from the same companies. A board shown only the first has been shown the most optimistic reading available, so ask for the counter-seat number on the same page.
What should an AI incident report contain?
What system was involved and who owned it; what access or credentials it held; what data or decision was affected; when it was detected and by what; what the containment was; who outside the company has been told and under what obligation; and what changes as a result. An incident report that cannot name the owner of the system is itself the finding.
Who should report to the board about AI?
More than one seat. The governance gap is least visible from the chair boards hear from most: unowned AI decisions run at 2 percent from the CEO seat, 15 percent at finance and 30 percent at the technology seat. A single-seat AI report inherits that seat’s blind spot, so the practical fix is a standing line from finance and from security alongside the CEO’s narrative.
How should boards oversee third-party AI vendors and models?
Through the access the vendor holds rather than the contract alone. The questions that matter are what systems and credentials the vendor or model can reach, who inside the company owns that relationship, what happens to the data, how the arrangement is monitored, and what the exit looks like. Ask whether the vendor inventory is generated from systems or maintained by hand, because a hand-kept list is stale the week it is written.
What questions should directors ask management about AI adoption?
Start with ownership and proof: who signs, what number vindicates the spend, and where the money came from. Then test the answer one level down, since the seat reporting to the board is usually the most optimistic one in the company.
Ten questions, with the figures behind each.
How can board directors participate in Open Future Forum discussions?
Open Future Forum runs a Public Board Member Dinner Series for directors of public and late-stage companies, alongside the executive forums for each C-suite seat. Discussions are private and off the record, and access is by invitation, referral or application.
Apply here, or read the
Board Director AI Governance Report.