A board does not need an AI strategy slide. It needs a short list of questions that management cannot answer with adjectives. The answers should name systems, owners, dates, and residual risk. If a question cannot be answered that way, the company does not govern AI yet. It experiments in production.
Directors already know how to do this for money, safety, and cyber. AI is not a new duty of care. It is a new place the same duty fails.
Why is this a board matter now, not after 2027?
Because law and loss are already in motion.
The EU AI Act is in force. Prohibitions, AI literacy, general-purpose model rules, penalties, and Article 50 transparency are live. The Digital Omnibus postponed most high-risk system duties to 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Postponement is not permission to run unsupervised agents into customers and staff.
Directive (EU) 2024/2853 treats software as a product. It applies to products placed on the market or put into service after 8 December 2026 (Article 2(1) as corrected on 7 May 2026). An agent that injures a person can be a product-liability fact.
Colorado replaced its 2024 AI Act with SB 26-189, signed 14 May 2026, effective 1 January 2027, for automated decision-making in consequential decisions. California’s SB 53 (signed 29 September 2025) binds frontier developers and treats unauthorised access to, modification of, or exfiltration of frontier-model weights that results in death or bodily injury as a critical safety incident. India’s DPDP Act already makes the company, as Data Fiduciary, responsible for processors that handle personal data, including model vendors.
NIST’s AI RMF and the July 2024 Generative AI Profile are voluntary. ISO/IEC 42001 is a voluntary management system. They are how you structure the answers. They are not why you ask.
A material AI incident — a biased hiring pass, a leaked corpus, an agent that sent the wrong payment — will be explained to this board. Ask before that meeting.
What must exist before any other question is useful?
An inventory. Not a strategy. A list.
For each production or pilot system that can affect a person, a payment, or a filing:
- name and owner (an executive, not “digital”)
- provider or deployer (EU AI Act Articles 3 and 25)
- data classes and whether personal data leaves the perimeter
- tools the system may call, and whether a human must approve write/send/pay
- the next legal date that applies to it (Article 50 is already due if people talk to it; high-risk duties if Annex III or I)
- residual risk accepted, in one sentence
If management cannot produce the list in a week, that is the finding. Do not proceed to ethics principles.
What should directors ask about role and liability?
1. For our five most powerful systems, are we the provider or the deployer?
If the company branded, fine-tuned, or changed the purpose of a high-risk system, Article 25 may have made you the provider. That is a capital and insurance question. “We only use vendors” is often false.
2. Which actions can an agent take that would bind the company without a named human?
This is agency plus OWASP LLM06. Mail, refunds, code deploy, ledger writes. If the answer is “none” and the architecture says otherwise, believe the architecture.
3. If a customer is harmed, who do we think pays, and is that in a contract or in a hope?
The Product Liability Directive and ordinary negligence do not read your MSA first. Indemnity is between you and the vendor. The injured person is not a party to it.
4. Can we replay last month’s material decisions?
Prompt, retrieved documents, tool trace, model digest, approver. If you cannot replay, you cannot defend.
What should directors ask about law and calendar?
5. Which current uses are prohibited under Article 5?
Untargeted facial scraping, social scoring, and the listed biometric cases are already banned. This is a now question. The CSAM and non-consensual intimate-image bans apply from 2 December 2026.
6. Is Article 50 live in the products our customers and staff see?
Disclosure that they are talking to an AI system. Machine-readable marking of synthetic media. Notices for emotion recognition and biometric categorisation if you use them. Due since 2 August 2026; older synthetic systems have until 2 December 2026 for marking.
7. Which systems will be high-risk under Annex III, and what file will exist by December 2027?
Employment, education, essential services, credit-adjacent uses. The postponement is time to build the file. Ask whether that time is scheduled.
8. Where else are we in scope?
DPDP if you process digital personal data of people in India. Colorado ADMT from 1 January 2027 if you materially influence listed consequential decisions. Sector rules that never mentioned AI and still apply.
Do not accept a single “global AI policy” as the answer to question 8.
What should directors ask about security and custody?
9. Which production agents have send, write, or pay tools, and what is the tool budget?
Prompt injection (LLM01; ASI01) is how an outsider uses those tools. The residual risk is the budget, not the filter.
10. Do we hold the weights of any model we rely on, and do we hash them?
If you cannot name the bytes, you cannot name what decided. OWASP LLM03 is explicit that model cards are not provenance. Closed APIs cannot be hashed; they must be contracted as services.
11. What happens to inference if the primary vendor is dark for a week?
This is the sovereignty question without the slogan. If a core process stops, you have a concentration the board has not priced.
12. How do we find systems we did not approve?
Shadow AI is a discovery problem. If the only answer is “acceptable-use policy,” you will learn the inventory from an incident.
What should directors ask about management systems?
13. Who is accountable for AI, by name?
ISO/IEC 42001’s leadership requirement exists because “the AI council” owns nothing. One executive. A committee can advise.
14. What residual risk did management accept since the last meeting?
A sentence. “We accepted that the claims chatbot can draft, not send, and that 4% of drafts will be wrong, with a human editor on every outbound.” If they cannot say it, they have not accepted it. They have ignored it.
15. Are we buying a 42001 certificate, and what is the scope?
Certificates cover a scope. If production agents are outside it, say so in the minutes.
NIST’s Govern / Map / Measure / Manage is a sufficient agenda if you dislike ISO numbers. Use one skeleton. Do not run three.
What does good look like in the minutes?
Short. Dated. Uncomfortable.
“Inventory of 37 systems; 6 can write; 2 lack a human gate; gates to be on by [date]. Article 50 gaps on 3 customer chatbots; owner [name]. Two Annex III candidates; files owned by [name] for 2027. No Article 5 uses found; CISO to reconfirm quarterly. API concentration accepted for marketing copy; custody required for legal and claims — Architecture Review booked.”
If the minutes could have been written in 2019 with the word “cloud,” they are not minutes about AI.
What should the board refuse to hear?
- “We are fine until 2027.” False for bans, transparency, GPAI, penalties, and product liability.
- “The model did it.” The company did it.
- “We have a responsible-AI charter.” Not an inventory.
- “Our vendor is compliant.” Your role is still yours.
- “We cannot inventory shadow AI.” Then you cannot claim control.
- Fake metrics. No “AI risk score 82” without a defined numerator.
Honest failure is acceptable: “We do not know yet; here is the date we will.” Pretence is not.
What to do next
Put the fifteen questions on the next agenda. Require written answers, not a presentation. Where the inventory or the role table does not exist, commission it. Where the estate is mixed and the custody question is real, book an Architecture Review — a working session that maps the current AI estate and what a sovereign stack would replace.
The board’s product is the question set and the residual-risk sentence. Everything else is management’s.