25 AI Governance Questions for Boards

0 / 25 answered

Strategy, business value & investment

Which AI use cases does the organization treat as strategic priorities, and which business outcomes are they tied to?

Are production, pilot, and idea-stage applications clearly separated from one another?

Has expected value, cost, risk, and a success metric been defined for each use case?

Do AI investments form one coherent enterprise architecture, or are they progressing as disconnected projects?

Are the organization's model, platform, cloud, and GPU investments backed by real usage need and capacity data?

Which applications are critically dependent on a single model, provider, platform, or specialist team?

Production readiness & architectural capacity

Have critical AI systems been tested under real users, real data, high load, failure, and outage conditions?

Is the data, model, application, agent, tool, and identity flow visible end-to-end, from user request to business outcome?

Is it known which data each system can access, which transactions it can initiate, and which human approvals it depends on?

How does the business process continue when a model, data source, or external service is unavailable?

Are changes to models, prompts, data sources, and applications tested and released to production in a controlled way?

Are quality, security, performance, cost, and business outcome monitored within the same operating view?

Risk, security & resilience

Has the organization's AI attack surface been mapped across the user, model, RAG, agent, tool, API, vendor, and infrastructure layers?

Have prompt injection, sensitive data exposure, data poisoning, agent privilege escalation, and uncontrolled tool use been tested?

Do agents operate with distinct identities and the least-privilege principle?

Is there explicit human approval, a transaction limit, and a stop mechanism for critical or hard-to-reverse actions?

Has the fallback model, provider, region, or manual continuation method been tested under real outage conditions?

Is it known how many business processes would be affected simultaneously by an outage of a shared provider or platform?

Governance, evidence & management oversight

What sources verify the organization's AI system inventory, and how are usages outside that inventory detected?

Can live configuration, test results, production metrics, and incident records be produced for critical controls, alongside the policy and architecture documents?

Are unknown areas, exceptions, and out-of-scope applications shown explicitly in management reports?

Does every material risk have a single owner, a target date, a success metric, and a follow-up mechanism?

Do management reports show category imbalances, failed tests, critical dependencies, and open risks alongside the overall score?

Is the organization's target architecture profile aligned with business strategy, risk appetite, regulation, and investment capacity?

How often is the AI architecture reassessed as technology, threats, the use-case portfolio, and regulatory expectations change?

25 questions every Board and Executive Committee should ask

Strategy, business value & investment

Production readiness & architectural capacity

Risk, security & resilience

Governance, evidence & management oversight