Governance Architecture for Directors: Four Questions, One Framework, and the Documentation Boards Should Expect
Boards of directors are now legally accountable for AI governance — not because they chose to be, but because the regulatory frameworks their organisations operate under have made them so. The EU AI Act creates board-level accountability obligations for organisations deploying high-risk AI systems. SEC cybersecurity disclosure rules require boards to report material AI-related cybersecurity incidents. The UK FCA's Senior Managers and Certification Regime creates individual accountability for AI governance failures at the level of Senior Management Functions. Institutional investors are increasingly incorporating AI governance into governance, risk, and compliance assessments of portfolio companies.
This brief provides a governance framework for board oversight of artificial intelligence — specifically, what oversight means in practice, what questions boards should be asking of executive management, and what documentation board members should expect to see. It is written for directors who are not AI specialists and do not need to become them, but who do need to exercise informed, defensible oversight of their organisations' AI programs.
AI governance became a board matter at the intersection of three developments that occurred simultaneously in 2023–2025: regulatory requirements attaching individual accountability to AI governance decisions; investor and institutional stakeholder interest in AI risk as a material governance factor; and a wave of AI deployments in regulated industries creating systemic risk exposure that boards had not previously assessed.
The regulatory development is the most significant. EU AI Act Article 16 imposes obligations on AI providers — including documentation, quality management, post-market monitoring, and incident reporting — that are ultimately board-level governance responsibilities. The Act's enforcement regime includes penalties of up to €35 million or 7% of global annual turnover for violations of prohibited AI practices, and up to €15 million or 3% of turnover for violations of high-risk AI requirements. These are penalties that boards will be asked to explain to shareholders.
In the US, the SEC's cybersecurity disclosure rules (effective December 2023) require public companies to disclose material cybersecurity incidents within four business days, and to annually disclose cybersecurity risk management, strategy, and governance. AI-related security incidents — adversarial attacks, data poisoning, model theft — are within scope. The SEC also requires disclosure of board oversight of cybersecurity risk, which encompasses AI systems that create cybersecurity exposure.
The institutional investor development accelerates the governance pressure. Large institutional investors — BlackRock, Vanguard, State Street — are increasing the specificity of their AI governance expectations in stewardship engagement. Proxy advisors are beginning to incorporate AI governance into ESG scoring. Governance gaps in AI programs are becoming reputational risks that are increasingly visible to external stakeholders.
"Most board AI governance failures are failures of accountability design, not failures of understanding. A board that has not assigned AI governance accountability to a named executive has not governed AI — it has noted that AI exists."
The following four questions are designed to be asked by board members who are not AI specialists. They are designed to elicit the information that a board needs to exercise informed oversight, without requiring the board to assess the technical architecture of AI systems or review AI model documentation directly. The questions expose accountability gaps, documentation failures, and governance program immaturity — the three conditions that create regulatory and reputational risk for boards.
Question 1: Which AI systems in our portfolio are classified as high-risk under the EU AI Act, and what is the status of their compliance documentation? This question is designed to reveal whether the organisation has conducted a systematic EU AI Act risk classification exercise — or whether AI Act compliance is being addressed reactively, system by system, as regulatory pressure increases. High-risk AI systems under Annex III of the EU AI Act include systems used in employment decisions, credit scoring, insurance pricing, law enforcement, and other consequential domains. Most financial services, insurance, and healthcare organisations have high-risk AI systems in production. If the management team cannot answer this question with a documented risk classification inventory, the organisation is not managing its EU AI Act exposure systematically.
Question 2: Who is accountable for AI risk governance in this organisation, and what authority does that person have? AI governance accountability is frequently diffuse — shared between the Chief Data Officer, the Chief Risk Officer, the Chief Information Security Officer, and product engineering teams, with no single owner of the AI risk program as a whole. This diffusion of accountability creates specific failure modes: AI risk assessments that are not completed because responsibility is unclear; AI governance policies that are drafted but not enforced because authority is not defined; and AI incidents that are escalated through multiple channels without a clear resolution authority. The board's role in answering this question is to create accountability clarity, not to manage the AI risk program — but clarity requires that the board can identify the name of the individual accountable for AI governance and confirm that the individual has the authority and resources their accountability requires.
Question 3: Has the organisation conducted an AI risk assessment for all production AI systems, and what is the risk register? The NIST AI Risk Management Framework MAP function requires organisations to categorise their AI systems by risk and document the categorisation methodology and results. The EU AI Act requires documented risk management records for high-risk AI systems. Neither requirement is satisfied by an informal awareness of AI risk — both require documented evidence that a systematic risk assessment has occurred and that the results have been reviewed and acted upon. A board that cannot be shown an AI risk register for production AI systems cannot demonstrate that it is exercising informed oversight of AI risk.
Question 4: What is the organisation's AI incident response procedure, and has it been tested? AI incidents — model failure, adversarial manipulation, training data breach, algorithmic bias complaints — require organisation-specific incident response procedures that are different from cybersecurity incident response procedures in important respects. The EU AI Act imposes serious incident reporting obligations with specific timelines. The NIST AI RMF MANAGE function requires documented incident response. A board that has not reviewed the organisation's AI incident response procedure and confirmed it has been tested has not exercised oversight of a material operational risk.
Effective board AI governance requires four structural elements: a clear accountability assignment at the executive level, a regular reporting cadence, a defined scope of board review, and a board-level escalation trigger. Each element is described below.
Accountability assignment: The board should confirm that a named executive — the Chief AI Officer, Chief Risk Officer, or equivalent — holds primary accountability for the organisation's AI governance program. The accountability should be documented in the executive's role description and included in the board's annual governance review. Secondary accountability should be documented for each production AI system: a named system owner who is accountable for the system's compliance documentation, risk assessment, and incident response.
Reporting cadence: AI governance should appear on the board agenda at least twice per year — once for an annual AI risk assessment review, and once for a mid-year AI governance program review. Incident reporting should be immediate for AI incidents that meet the materiality threshold for board notification. The annual AI risk assessment review should include a review of the AI risk register, the EU AI Act compliance status for high-risk systems, and the AI governance program's maturity relative to the NIST AI RMF or equivalent framework adopted by the organisation.
Defined review scope: The board does not review AI system technical documentation — that is management's function. The board reviews the governance program: the risk register, the accountability structure, the compliance status relative to applicable regulations, the incident history, and the improvement trajectory. Board members should be able to confirm that they have seen each of these elements at least annually.
Escalation triggers: The board should define the conditions under which AI governance issues are escalated to board attention outside the regular reporting cadence. At a minimum, these should include: any AI incident that requires regulatory notification; any EU AI Act high-risk system that is deployed without a completed conformity assessment; any AI risk register finding rated high or critical that has not been remediated within the defined treatment timeline; and any regulatory inquiry, investigation, or enforcement action related to an AI system.
Board members exercising AI oversight should expect to receive three categories of documentation at the intervals described above. This documentation does not require board members to review technical AI system documentation directly; it provides the governance-level evidence that informed oversight requires.
Annual documentation: the AI system inventory (all production AI systems, their risk classification, their regulatory classification under applicable frameworks, and their compliance documentation status); the AI risk register (all material AI risks, their rated severity, their assigned owner, and their treatment plan status); and the AI governance program maturity assessment (the organisation's current maturity level against a defined framework such as NIST AI RMF, with year-on-year trajectory and planned improvement activities).
Semi-annual documentation: an AI governance program update (progress against the prior year improvement plan, any changes to the AI system inventory or risk register since the last board review, and any regulatory developments that affect the organisation's AI governance obligations).
Event-triggered documentation: incident reports for AI incidents meeting board notification criteria, regulatory correspondence related to AI governance, and any significant changes to the AI risk register classification of existing systems.