If your board approved the AI budget, could it also explain the risk?

An AI policy sets direction. It does not prove anyone is checking that the direction is being followed. Boards routinely accept the existence of a policy, a framework, or a certification as evidence that oversight is happening, when none of those things describe what is reviewed, by whom, or how often.

• The organisations that get caught out are rarely the ones with no AI policy. They are the ones whose policy was never tested against a real incident
• "We have a governance framework" and "a named person reviews this system's output every week" are different claims. Only the second is oversight
• A board that cannot name its three largest AI risks has not been shown a risk register. It has been shown a summary
• NACD's 2026 governance research found the share of boards assigning AI to a named committee, rather than leaving it as a standing full-board topic, has roughly quadrupled year over year. A committee with a charter is a different structure from a shared agenda item, and it changes who is accountable when something goes wrong
• Oversight built for conventional AI tools does not automatically transfer to agentic systems that act autonomously across multiple steps. NACD has flagged this as a distinct governance question in its own right

1. Treat any unchecked item in Sections 1 or 3 as the priority. Ownership and human oversight are the load-bearing sections
2. Ask for evidence, not descriptions, when reviewing management's next AI update
3. Re-run this checklist after any AI incident, near-miss, or major vendor change, not just once a year

"What can this AI system do that we would not want it to do?" is a single question that separates real oversight from paperwork. If management can answer it specifically and without hedging, oversight exists. If the answer is reassurance rather than specifics, it likely does not yet.

• A vague answer ("we have guardrails in place") is not a boundary. A specific answer ("it cannot approve a payout above $X without a named reviewer") is
• Boards that ask this question before an incident tend to catch the gap while it is still cheap to close
• Boards that only ask it after an incident are, by definition, asking too late for that particular case

1. Put this exact question on the agenda for the next AI update, before the item covering incident history
2. Expect a specific boundary as the answer, and treat a general principle as a non-answer
3. If no one in the room can answer it precisely, that gap belongs on the risk register today

This checklist tells you where the gaps are today. It does not replace a facilitated board briefing, an independent review of your specific AI systems, or ongoing oversight as your AI programme evolves. Treat a high score as a good baseline instead of a finished job.

• Boards that treat AI oversight as a one-time review rather than a standing item are routinely surprised by drift: the system in production is no longer the system that was approved
• A single strong score today says nothing about six months from now, once the vendor has shipped a model update or the use case has expanded
• The highest-leverage change most boards can make is simply putting AI oversight on a fixed cadence

1. Once you cross roughly 85%, the priority shifts from closing gaps to maintaining cadence
2. Assign the unchecked items to a named owner
3. If your board wants this run as a facilitated session, that is a conversation worth having directly