Ten questions a board should ask about AI

Use these as written, or put them to management ahead of your next meeting. If the answers are vague, that itself tells you something.

1. Who is personally accountable for AI risk here, and where is that written down?

   A good answer: a named senior executive, with responsibilities in policy and in their objectives. Be concerned if: the answer is "IT" or "everyone".

2. How many AI systems do we have, and how do we know the list is complete?

   A good answer: a maintained inventory that is reconciled to procurement and change records, and includes AI inside vendor products. Be concerned if: the list was compiled from memory or covers only what the technology team built.

3. Which of our decisions most affect customers, and who decides when a human must be involved?

   A good answer: a list of high-impact decisions, each with a documented level of human oversight. Be concerned if: nobody can name them.

4. Which systems have been independently validated, and which have not?

   A good answer: validation by people independent of the developers, scaled to risk, with findings tracked to closure. Be concerned if: developers test their own work.

5. When did we last test our customer-facing AI for bias, and what did we find?

   A good answer: a recent dated test, results reported to senior management, and actions tracked. Be concerned if: testing happened once at launch, or never.

6. Which vendors embed AI in products we already use, and what do our contracts let us see and audit?

   A good answer: a vendor list with AI-specific due diligence and contractual information and audit rights. Be concerned if: the answer relies on the vendor's assurance alone.

7. If an AI system began behaving badly tomorrow, who could stop it, and how fast?

   A good answer: a named person, a documented and tested stop procedure and a fallback process. Be concerned if: stopping it would need the vendor or a development project.

8. What does our staff do with public AI tools today?

   A good answer: written rules, an approved tool list, technical controls and training. Be concerned if: nobody knows.

9. What would the supervisor ask us about AI, and could we answer with evidence?

   A good answer: management can name the likely questions and has evidence ready for each. Be concerned if: the evidence would need to be created first.

10. What are the three biggest gaps in our AI governance, and when will they close?

    A good answer: three specific gaps, with owners and dates. Be concerned if: management says there are none.

Why these questions

They follow the main building blocks of AI governance: accountability, inventory, risk rating, validation, fairness, third parties, monitoring and the ability to stop, people, and assurance. The same themes run through the NIST AI Risk Management Framework and, for licensed financial institutions in the UAE, the Central Bank's 2026 guidance.

Related terms

• AI governance
• AI inventory
• High-impact decision
• Human in the loop, on the loop and out of the loop
• Model validation
• Three lines of defense

Sources

• Central Bank of the UAE: Guidance Note on Consumer Protection and Responsible Adoption and Use of Artificial Intelligence and Machine Learning (11 February 2026)
• NIST Artificial Intelligence Risk Management Framework 1.0 (NIST AI 100-1)

Sources last checked: 5 October 2026. General information, not legal, regulatory or professional advice. Requirements change, so confirm the current text before relying on any point. Spotted an error? Tell us.