Adoption tells you nothing. Here are the 12 questions every board should ask management about AI, across strategy, risk, data and oversight. Most boards can answer 6. The other 6 are your personal liability.

Adoption is easy to report and easy to fake. It tells you nothing about whether AI is an edge or an exposure. The boards that get blindsided are not the ones using too little AI. They are the ones who never asked where it was making decisions they are accountable for.

Whether you are an independent director or an investor sitting on your portfolio boards, the exposure is the same, and so is the liability.

So we compiled the 12 questions every board should ask management about AI this year, across four areas: strategy and value, risk and compliance, data and security, and people and oversight. We call it the AI Board Audit.

Most boards can answer 6 of them, the soft ones on strategy, value and people. The 6 they cannot are the ones that decide personal liability: where AI makes decisions you are accountable for, who trains on your data, and whether you could defend an AI-assisted decision to a regulator tomorrow. That gap is the whole risk, and it is sitting inside companies that feel like AI leaders because everyone has a license.

Strategy and value

Where does AI change our economics, not just our workflows?
A good answer: one line in the P&L where AI changes the economics, with a number attached.
Which AI-native competitor could rebuild our offering without our costs?
A good answer: management identifies that competitor, or sketches how one could be built, plus the company's response.
Do we have an AI strategy, or a pile of pilots?
A good answer: three priorities tied to the corporate strategy, each with an owner and a kill date.

Risk and compliance

Which rules actually apply to us, in every market we operate in, and who owns each one?
A good answer: management names the applicable regulatory regimes and assigns one owner per regime.
Where could an AI system make a decision we are legally accountable for?
A good answer: a map of the decision points, with a human checkpoint at each.
How exposed are we if a single AI vendor fails, changes terms, or triples its prices?
A good answer: the company identifies the vulnerable processes and has tested fallback procedures.

Data and security

Where are our people putting confidential data into public AI right now?
A good answer: monitoring reveals the actual practices, and a sanctioned, governed alternative exists.
Who can see our data, and who trains on it?
A good answer: contract-level clarity per tool, specifying retention, training use and tenant arrangements.
Could we audit how an AI system reached an answer we acted on?
A good answer: any material AI-assisted decision can be reconstructed, the inputs, the sources, and who checked it.

People and oversight

Is this board AI-literate enough to challenge management on any of the above?
A good answer: the board has run working sessions on the company's actual systems, not vendor demos.
What is our plan for the people whose roles AI compresses?
A good answer: management names the affected roles in the next 18 months, with numbered reskilling plans.
When an AI system gets it wrong, who is accountable, and is that written down?
A good answer: a named executive owner for every AI system, on paper, before anything fails.

Stop asking how much AI you are using. Start asking where it makes decisions you would have to defend tomorrow.

Frequently asked questions

What questions should a board ask about AI?

Cover four areas: strategy and value, risk and compliance, data and security, and people and oversight. The 12 questions above are a working checklist. The ones that matter most for personal liability are where AI makes decisions the board is accountable for, who trains on the company's data, and whether an AI-assisted decision could be defended to a regulator.

What is an AI board audit?

An AI board audit is a structured set of questions a board asks management to see where AI is an edge and where it is an exposure, across strategy, risk, data and oversight, rather than measuring how many AI licences have been issued.

Who is legally accountable when AI makes a decision?

The board and its directors remain accountable for the decisions the company makes, including AI-assisted ones. That is why a good answer maps every point where an AI system acts and puts a named human owner and a checkpoint at each.

Go deeper. Making a board AI-literate enough to ask these questions is the heart of The AI Boardroom Edge, a free six-day course for board directors. Enrol free →

Want to run this audit on your own boards and portfolio, securely, without the pack ever leaving a safe room? Start free on BoardLens. You can also read the original on The AI Leadership Edge.

About BoardLens

Private market intelligence for boards and portfolios. Your AI analyst for board and post-investment work.

BoardLens gives directors a single secure workspace across every board they serve, while keeping each company's information completely separate and confidential. It reads your board materials into a clear, cited brief, tracks commitments and follow-ups, maintains a governance calendar of meetings, covenants and reporting deadlines, and drafts follow-up emails straight from your minutes or transcripts.

Governance-grade by design: your data is never used to train AI models, enterprise agreements and DPAs are in place with every underlying provider, and all data is encrypted in transit and at rest, in an isolated workspace per company.

Start free, with a demo company already set up so you can explore it without uploading your own materials. www.boardlens.ai

12 Questions every board should ask management about AI