What the Board Should Ask About AI: One Board Paper, Read From the Chair's Seat

Part of our topic guides on AI Governance & Data Strategy and AI Skills for Business.

By James Cotton, Founder, iO-Sphere

The paper in the pack

This paper is an illustration; no company is named. Management proposes an AI tool for the customer claims team. It will score each incoming claim, draft the reply, and settle small claims without a person reading them. Most of the paper describes the vendor's demonstration and the expected savings. Its last line asks the board to approve the contract.

The FRC's Corporate Governance Code Guidance says what a board paper should be: "accurate, clear, comprehensive", with "a summary of the contents", written to "Inform the director what is expected of them on that issue." Non-executives seek more from management "where they consider the information provided is inadequate or lacks clarity".

The UK Corporate Governance Code applies to companies in the commercial companies category, on comply or explain; the guidance is not mandatory and not part of the Code. Private company and trustee boards have codes of their own, further down, and the same questions serve them.

The guidance also lists what distorts board decisions, in Figure 3, "Risk factors for poor decision-making". Four of its items describe this paper closely: "Inadequate information or analysis."; "Poor quality papers."; "Insufficient knowledge and ability to test underlying assumptions."; and "a tendency to bring matters to the board for sign-off rather than debate." Figure 3 never mentions AI; reading an AI paper against it is our own application.

Paragraph 29 adds what bends the judgement of "well-intentioned and experienced leaders", including "emotional attachments" and "inappropriate reliance on previous experience and decisions". A sponsor fresh from a good demonstration is exposed to both. Paragraph 27's answer is time, "investing time in their decision-making", with "expert opinions when necessary".

The Code makes constructive challenge, and holding management to account, part of the non-executive's job. It gives the board the decision on which principal risks the company will take to reach its long-term aims, as paragraph 242 of the guidance repeats. Executives, paragraph 75 says, "should welcome constructive challenge from non-executive directors as an essential aspect of good governance".

Reading it, one question at a time

Each question below is one that a body writing for boards, or the data protection regulator, already asks.

Which decisions will it make about people, and who can challenge each one?

This tool decides about people twice: it scores every customer who claims, and below a set value it settles without a person reading the claim. ecoDa and Accountancy Europe's briefing paper on board oversight of AI, published 7 October 2026 and informed by a small-scale survey of 87 European company directors, asks: "Can AI decisions and outputs be traced, explained, and evidenced where required?"

The paper should list each decision, whether a person sees it, and how a customer who disagrees gets it looked at again, and say how each stands under the rules on automated decision-making. The briefing paper also asks how staff are "prevented from over-relying on AI outputs, particularly in high-impact decisions".

What does it cost, what counts as success, and when does it stop?

The paper gives savings and no point at which the board would call the tool a failure. The briefing paper asks: "What business outcomes are expected from major AI initiatives, and how will they be measured?" and "At what point will AI initiatives be paused, redesigned, or stopped if they fail to deliver the expected value?"

In the Chartered Governance Institute's research, published July 2026, 26 of the 76 governance professionals who answered that question said their organisation had done a cost-benefit analysis before starting any AI project. Asked how many AI pilots had scaled to enterprise-wide use, 45 of 73 answered 0 to 25%.

The briefing paper's next question is "Who is ultimately accountable if AI initiatives fail to deliver expected business value?" CGI's respondents named management teams 47 times, boards 18 times and chief executives 8 times. The chair asks for the measure, the date it is read, the result that pauses the rollout, and how the tool serves the company's data and AI strategy.

Whose data does it use, and under what right?

The tool draws its scores from the company's past claims, which are records about customers. The briefing paper asks: "Do we understand what data our AI systems rely on, and do we have the right to use it?" It gives the reason in one line: "Many AI failures originate in poor data rather than model design."

For personal data, the AI and data protection risk toolkit from the Information Commission (the ICO), under review because of changes made by the Data (Use and Access) Act, sets the control: "Identify and document valid grounds for collecting and using personal data." The paper should name that lawful basis, and the person who answers for the data's quality.

How will a wrong output be caught, and by whom?

The same toolkit has a test for this. Its row on meaningful human review names the risk: "Non-meaningful human review is caused by automation bias or a lack of interpretability." The briefing paper defines automation bias as "the tendency to place undue reliance on AI-generated outputs because they appear authoritative or data-driven."

The test is one sentence: "You could periodically test whether a human reviewer identifies an intentionally inaccurate decision." The row also suggests a log of "all automated decisions that were overridden by a human reviewer and the reasons why." Both are options, not requirements, and both give a board evidence it can read.

Other rows say reviewers should be trained "to interpret and challenge outputs made by an AI system" (row 3.9), and that the organisation should document "when you will incorporate meaningful human review" and "who will conduct the review" (row 1.9), set "metrics and thresholds for model drift that trigger review and testing" (row 4.1) and keep an incident plan saying "who responds when an incident occurs" (row 3.6).

Row 1.2: "You should appoint a senior owner or senior process owner to drive accountability." That person is the owner of AI governance for this tool. The chair wants the name in the paper, and the date on which a deliberately wrong claim will first be put in front of a reviewer.

If it failed badly, what would show the controls had worked?

The briefing paper puts it hard: "If a material AI failure occurred within our organisation today, could we clearly explain who is accountable, how it happened, and why controls did not prevent or detect it earlier?" Then: "What evidence gives us confidence that AI controls and governance arrangements are operating as intended?"

These are Code questions under another name. Provision 29 says the board's monitoring and review "should cover all material controls, including financial, operational, reporting and compliance controls", for financial years beginning on or after 1 January 2026. The guidance says material controls could include controls over "new technologies (e.g. artificial intelligence)", and the board decides which are material.

The evidence is the board's call too. "There is no requirement or expectation in the Code or this guidance that companies obtain external advice or assurance on the effectiveness of the material controls," the guidance says, and the type of assurance is "a decision for the board". So the board says what evidence it will accept before the tool goes live.

Who else is in the chain?

The tool is the vendor's model, on the vendor's platform. The FRC's guidance asks: "To what extent has the company identified risks from joint ventures, third parties and from the way the company's business is organised? How are these managed?" The briefing paper says oversight should extend "to third-party AI providers and services", and calls for "appropriate authority to intervene or halt AI systems where necessary."

In the CGI survey, 20 of 73 respondents said their organisation had carried out a third-party AI risk assessment; 53 said it had not. The paper should say who can change the model, who is told when it changes, and who can switch it off.

Who on this board can test the answer?

Every question above ends in management's answer, which the board must judge. The briefing paper's standard: directors "are not expected to be technical experts, but they must have sufficient understanding of AI systems to challenge management, assess strategic choices, and evaluate risks". Where internal expertise is limited, boards "should bring in external specialists".

It asks: "What balance of capability best supports effective oversight: specialist expertise within the board, broader full-board literacy, or a hybrid approach?" The FRC names a board skills matrix as one tool to find "any gaps in skills or competencies", and asks nomination committees: "How often is a skills audit undertaken and are we keeping up with the pace of change?"

In the FRC's 2025 review of annual reports, one company noted that "with the exception of one director, no others had detailed experience of AI", and said steps were being taken to enhance expertise. The guidance expects that "All directors continually update their skills, knowledge and familiarity with the company".

Where the matrix shows a gap, a leadership team learns this on its own decisions, not in a lecture: our team training for a board or executive team is a session built around the board's own papers and decisions; Data & AI Governance (Level 4) is for the person who will own governance every day and AI Transformation (Level 4) for the person carrying the change.

What the FRC counted, and what governance professionals said

The FRC's Annual Review of Corporate Governance Reporting, published 13 November 2025, analysed the annual reports of 100 randomly selected companies that follow the Code, from the FTSE 100, FTSE 250 and Small Caps. The reports were written under the 2018 Code; the FRC expects reporting on the new Provision 29 from 2027 onwards.

When the FRC first looked in 2023, around half of companies mentioned AI in their report. This time 86 of the 100 did. Twenty disclosed AI as an emerging risk and three more as a principal risk, all 23 in the FTSE 350. Eleven reported having an AI policy or reviewing their code of conduct to include a section on AI.

Ten stated that the board had access to AI expertise, mostly through updates, training or deep dive sessions. Set 86 beside 10 and you have two counts of what reports said, not a count of boards without expertise. On cyber, the same review found a fifth reporting board access to cybersecurity expertise, mostly through a board member with prior experience.

The FRC's view, in the same review: "Robust governance and oversight around the use of AI is essential for managing risk and ensuring the ethical development and deployment of AI systems."

The Chartered Governance Institute UK & Ireland asked governance professionals, company secretaries and similar roles, between February and May 2026, across the corporate, public, charity and education sectors: 16 roundtables with 61 participants, and a survey whose charts mostly show 73 respondents (38 corporate, 16 public sector, 11 charity and third sector, 8 education).

Five of the 73 said their board had a formal "AI kill switch policy", a policy to halt an AI system, and 68 said it did not; asked how well training had prepared them to challenge AI outputs, the 73 gave an average of 2.4 out of 5.

The report's principal author, Dr Valentina Dotto, said in the Institute's release of 10 September 2026: "Boards need clear oversight of where AI is being used, how decisions are being influenced and what controls are in place to ensure outcomes remain explainable and accountable."

The law under the questions

The FRC's guidance reminds directors that their duties are set out in sections 171 to 177 of the Companies Act 2006, and that they "must act in a manner consistent with their statutory duties". Two of those sections bear on this paper.

Section 172 requires a director to act as he considers, in good faith, "would be most likely to promote the success of the company for the benefit of its members as a whole", having regard to matters including "(a) the likely consequences of any decision in the long term" and "(e) the desirability of the company maintaining a reputation for high standards of business conduct".

Section 174 says: "A director of a company must exercise reasonable care, skill and diligence." The measure is both what "may reasonably be expected of a person carrying out the functions carried out by the director in relation to the company" and "the general knowledge, skill and experience that the director has."

Neither section mentions AI. Neither needs to: approving the claims tool is a decision, and these are duties about how directors decide. CGI reports a view from its roundtables, describing practice: section 174 is "being operationally reinterpreted in practice rather than needing legal amendment", and "directors cannot rely on AI outputs in a passive manner."

The FRC's Wates Principles for Large Private Companies, December 2018, ask that board information "is reliable, enabling directors to monitor and challenge the performance of the company". They do not mention technology or AI. The FRC's Wates Reporting Insights, December 2025, asks reporters, where a board lacks diversity, to be transparent about gaps in skills, including where it may lack specific capabilities, giving "digital transformation" as an example.

Trustees have the Charity Governance Code, 2025 edition, whose compliance "is not a regulatory requirement". Under Principle 6, trustees "ask questions about data or analyses they do not understand", and its suggested evidence includes "A policy for the use of technology and AI tools", which makes it the only one of the three codes on this page whose own text names AI.

Its Principle 5 suggests "Board papers that identify key data and factors for informed decision making, including associated risks" and "Board minutes that capture the rationale for decisions and actions". For a trustee board, the first is the test of a paper like this one and the second is the test of its minute.

What the 2026 papers for boards add

ecoDa, the umbrella body for the main national institutes of directors across Europe, and Accountancy Europe published the briefing paper on 7 October 2026. The Institute of Directors, an ecoDa member, published a foreword to it.

The paper sums up the board's role as "to set the boundaries, test the value case, oversee material risks, require evidence, and ensure that management has the capability and discipline to execute", and warns that "poor governance with AI is often simply poor governance at scale." It adds that "Accountability for AI outcomes cannot be delegated to technology."

Its Principle 10 turns to the board's own papers: where AI helped prepare them, "its use should be transparent", and "Confidential board information should not be entered into unauthorised, non-secure, or public AI tools."

The Institute of Directors' review NEDs reimagined, 15 January 2026, recommends that "NEDs should build their understanding of AI and adopt relevant tools", and names a risk that fits this paper: "If AI tools are developed or controlled by management, NEDs may struggle to maintain independent oversight."

Spencer Stuart's 2025 UK Board Index, covering "the top 150 companies with a premium listing on the London Stock Exchange" with board data as at 30 April 2025, found a technology committee on 3% of boards and describes most as "seeking counsel on these issues from external advisors".

Deloitte's Governance of AI survey of board members and executives worldwide, fielded January to February 2025, found 31% of respondents saying AI was not on the board agenda, against 45% in the previous wave, and 66% saying their boards had "limited to no knowledge or experience" with AI, against 79%.

Two standards address the governing body. ISO/IEC 42001:2023, the AI management system standard, titles clause 5 "Leadership", and its governing body can include "board of directors, committees of the board, supervisory board, trustees or overseers". ISO/IEC 38507:2022 "provides guidance for members of the governing body of an organization to enable and govern the use of Artificial Intelligence (AI)".

The paper goes back

The chair's decision is to defer. The paper returns to management with the questions written on it and a note on the front naming the answers it cannot come back without. Where the company has no AI governance framework yet, that note is where one starts.

Returned for the next meeting. Please bring back the result that stops the rollout and the name of whoever can halt it.

Bring the documented lawful basis for the data the tool uses, and the result of a test in which reviewers were handed deliberately wrong decisions, with the senior owner by name. The other questions in the margin are to be answered in the revised paper.

The minute records why the paper went back. Before the next meeting the board books a session of its own on these questions, and the nomination committee adds AI to the skills matrix, so that whoever reads management's answers can test them.