Board paper: governing data and AI risk in regulated industries
Boards in regulated industries are increasingly accountable for data and AI risk they cannot see clearly. This paper frames the questions a director should ask, and the answers that indicate the organisation is genuinely in control.
What a board is actually being asked to do
A board does not build models, engineer data pipelines, or configure controls. Its role in the governance of data and AI risk is different and, in its way, harder: to provide oversight that is genuine rather than nominal, to ask the questions that surface real exposure, and to be able to attest, to regulators and shareholders, that the organization's use of data and AI is under control. This paper is written to help a board discharge that role, not by turning directors into technologists, but by giving them the frame and the questions that let them govern this risk as competently as they govern any other.
The difficulty is that data and AI risk is unfamiliar terrain for most boards. It does not fit neatly into the categories directors know well, and its technical surface can intimidate non-specialists into either disengagement or deference. Both are dangerous. A board that disengages leaves a material risk ungoverned; a board that defers entirely to management has abdicated the oversight that is its entire purpose. The path between them is to understand the risk well enough to govern it, which requires far less technical depth than it first appears.
The central message of this paper is that data and AI risk, stripped of its technical mystique, behaves like other material risks a board already knows how to govern. It has exposure that can be measured, controls that can be verified, coverage that can be tracked, and evidence that can be demanded. A board that insists on these, exposure, controls, coverage, evidence, is governing well, regardless of how little its members know about the mathematics of a model.
A board does not need to understand the mathematics of a model to govern the risk. It needs to insist on exposure, controls, coverage, and evidence.
Board paper in one view
The three questions a board should never stop asking
Effective board oversight of data and AI risk reduces, in practice, to three questions asked persistently and answered with evidence rather than reassurance. Their power is in their simplicity and their repetition: a board that asks them every time, and is not satisfied by comfortable non-answers, will surface the real state of the risk more reliably than any technical briefing.
Question one: what could go wrong, and how badly?
The first question is about exposure. Where is the organization using data and AI in ways that could cause material harm, to customers, to the business, to its standing with regulators, and how bad could that harm be? A board that cannot get a clear answer has found its first problem, because an organization that cannot articulate its own exposure cannot be governing it. The answer should be specific: not that AI is used broadly, but that these particular uses, in these particular decisions, carry these particular risks of these particular magnitudes.
The board's job here is to insist on specificity and to resist comfort. Management's natural instinct is to reassure, and a board that accepts reassurance in place of a clear exposure map is not doing its job. The right posture is a persistent, courteous refusal to be satisfied by generalities, until the exposure is laid out concretely enough to be governed.
Question two: what are we doing about it, and is it working?
The second question is about controls. Given the exposure, what controls are in place, and, crucially, are they actually operating rather than merely documented? This is where boards are most often misled, because a control that exists on paper and a control that runs in practice look identical in a slide. The board must probe the difference, asking not whether a policy exists but whether it produces evidence when it runs, not whether a committee meets but whether models are actually gated by its decisions.
The sharpest version of this question is to ask for the evidence directly. If the organization claims its high-impact models are validated before deployment, the board can ask to see, for a specific recent model, the validation artifact, dated, tied to that model, reviewed by an accountable person. If that artifact can be produced quickly, the control is operating. If it requires a scramble, the control is theatrical, and the board has surfaced a real gap that no amount of reassurance should paper over.
Question three: can we prove it?
The third question is about evidence and attestation. If a regulator, an auditor, or a shareholder asked the organization to demonstrate that its data and AI are under control, could it, on demand, without a special project? This is the question that ties the other two together, because exposure that is understood and controls that operate are only worth what they can be shown to be worth when scrutiny arrives.
A board that asks this question regularly changes the organization's behavior, because management learns that evidence must be ready, not assembled under pressure. And a board that can answer this question affirmatively can do the thing that is ultimately its responsibility: attest, with confidence, that the organization's use of data and AI is governed. That attestation, backed by evidence, is the deliverable of board oversight, and the three questions are how a board earns the right to make it.
Reading a data and AI risk report
Boards govern through reporting, and much depends on whether the report a board receives is built for reassurance or for governance. A report built for reassurance leads with activity: committees convened, policies published, initiatives underway. It is comfortable and largely useless, because activity is not control and a board cannot govern on it. A report built for governance leads instead with the measures that reveal the true state of the risk, and a board should insist on receiving the second kind.
The measures that matter are coverage, evidence, and exceptions. Coverage answers what share of the organization's data and AI is actually inventoried, risk-tiered, and under active control, because a governance programme that covers half the estate is a programme with an unexamined half, and the unexamined half is where the incident will come from. Evidence completeness answers whether the required artifacts actually exist for the assets that should have them. And exceptions, reported honestly, answer where the process is being bypassed, which models run outside it, which controls were skipped, because a report that hides its gaps is worse than no report when scrutiny arrives.
A board that learns to read for these three measures, and to trend them over time, can see whether the organization is climbing toward genuine control or slipping away from it. A board that accepts activity reporting is flying blind while feeling informed, which is the most dangerous state of all.
The exposure, in numbers
A board thinks in materiality, so it helps to reason about data and AI risk in the same expected-loss terms used for other risks. The exposure from ungoverned models is, in essence, the number of high-impact models in use, multiplied by the probability that an ungoverned high-impact model produces a harmful outcome in a year, multiplied by the cost of such an outcome when it occurs. Governance reduces this expected loss by reducing the probability, bringing models under control that catches problems before they cause harm.
The calculator below lets a board explore this exposure and see how it responds to governance coverage. It is deliberately simple and deliberately transparent, because a board should be able to see and challenge the logic rather than accept a black-box figure. The value is not the precise number but the shape it reveals: expected loss falling roughly in proportion to the share of high-impact models brought under genuine, evidenced control.
Data & AI risk exposure
Reason about expected annual loss from ungoverned models the way a board reasons about any material risk, and see the effect of governance coverage.
Expected loss falls roughly in proportion to the share of high-impact models brought under evidenced control. The exact figure is indicative; the slope is the point.
Reasoning this way lets a board govern data and AI risk as it governs any material risk: by understanding the exposure, verifying the controls that reduce it, and tracking whether coverage is rising or falling. It also reframes governance for the board, not as a compliance cost but as a measurable reduction in expected loss and, simultaneously, as the enabler of confident adoption. A board that sees the numbers this way can support both ambition and control, which is exactly the balance it exists to strike.
The board's own accountability
It is worth stating plainly, because it is sometimes left implicit, that the board's oversight of data and AI risk is not merely good practice but increasingly a matter of the board's own accountability. Regulators in multiple jurisdictions are making clear that responsibility for the governance of these risks reaches the board, and that directors cannot discharge it by delegation alone. A board that cannot demonstrate genuine oversight is exposed in its own right, not only on behalf of the organization.
This raises the stakes of the three questions and the insistence on governance reporting. They are not only how a board protects the organization; they are how a board protects itself, by creating a demonstrable record of genuine oversight. A board that asks the hard questions, insists on evidence, and tracks coverage over time has a defensible account of its stewardship. A board that accepted reassurance has none, and will find that uncomfortable if an incident brings its oversight into question.
None of this requires the board to become technical. It requires the board to govern data and AI risk with the same seriousness, the same insistence on evidence, and the same refusal to accept comfortable non-answers that it brings to any other material risk. The mystique of the technology can make this feel harder than it is. Stripped of the mystique, it is familiar work: understand the exposure, verify the controls, insist on the evidence, and be able to attest. A board that does this is governing well.
The board's insistence on evidence is not only how it protects the organization. It is how it protects itself.
What a board should ask for next
A board that wants to strengthen its oversight can act at its next meeting without any technical preparation. It can ask for an exposure map: a specific account of where data and AI are used in ways that could cause material harm. It can ask for evidence, on a specific high-impact model, that the controls the organization claims are actually operating. And it can ask for a governance report built around coverage, evidence, and exceptions rather than activity.
The responses to these requests will themselves be informative. An organization with operating governance will meet them readily; the exposure map exists, the evidence is retrievable, the coverage is known. An organization whose governance is theatrical will struggle, and the struggle is the finding. Either way, the board learns the true state of the risk, which is the first requirement of governing it.
The board's task in data and AI risk is not to master the technology. It is to govern the risk the technology creates, with the frame and the questions that any competent board can wield. Understand the exposure. Verify the controls. Insist on the evidence. Track the coverage. And be able to attest, with confidence grounded in that evidence, that the organization's use of data and AI is under control. That is the whole of the board's job here, and it is entirely within reach.
A worked scenario for the boardroom
Consider how the three questions play out in a specific, composite scenario a board might face. A financial institution has deployed a model that helps decide which customers qualify for a particular product. Management presents it to the board as a success: it is faster and more consistent than the manual process it replaced. The board's task is not to admire the success but to govern the risk, and the three questions are how it does so.
The first question, what could go wrong and how badly, surfaces the exposure. This model decides who gets access to a financial product, so an error or a bias in it could deny people unfairly, expose the institution to regulatory action for discrimination, and damage its reputation. That is a material, high-impact exposure, and naming it specifically, rather than accepting the general reassurance that the model works well, is the board's first act of governance. A model that decides about people, in a regulated domain, is exactly the kind that demands the board's attention.
The second question, is the control working, probes whether the exposure is actually being managed. The board asks to see the fairness assessment performed before the model went live, the record of who reviewed it, and the monitoring that has run since. If management can produce these promptly, the control is operating and the board can take assurance from evidence rather than words. If management cannot, the board has discovered that a high-impact model is running without demonstrable control, which is precisely the finding that justifies the board's insistence. The comfortable presentation of a successful model has become an uncomfortable but valuable discovery about the state of the controls.
The third question, can we prove it, tests whether the institution could withstand external scrutiny. If a regulator asked tomorrow for evidence that this model is governed, could the institution provide it on demand? A board that establishes the answer is yes has done its job; a board that discovers the answer is no has found a gap it can now insist be closed. In either case, the three questions have converted a comfortable management presentation into genuine governance, which is exactly what a board is for.
What boards get wrong
It is worth naming the specific failure modes of board oversight in this area, because they are common and avoidable, and a board that recognizes them in itself can correct course. Each is a way of appearing to govern while not actually governing, and each is comfortable enough that boards fall into it without noticing.
The first failure is deference: accepting that the technology is too complex for the board to question, and therefore trusting management entirely. This abdicates the oversight that is the board's purpose. The correction is to recognize that governing the risk does not require mastering the technology, only insisting on exposure, controls, coverage, and evidence, which any competent board can do. The mystique is not a reason to defer; it is a tactic, sometimes unconscious, that deference rewards.
The second failure is accepting activity as control: being satisfied by reports of committees convened, policies published, and initiatives underway, mistaking motion for governance. The correction is to insist on governance reporting, coverage, evidence, exceptions, rather than activity reporting, and to keep asking the uncomfortable questions until they are answered with evidence. A board that learns to notice when it is being shown activity in place of control has taken a large step toward governing well.
The third failure is episodic attention: engaging with data and AI risk only when an incident or a regulatory prompt forces it, rather than governing it continuously as a standing material risk. The correction is to place it on the agenda as a recurring item, with trended measures of coverage and evidence, so the board can see the trajectory rather than reacting to events. Data and AI risk is not an occasional topic; it is a permanent feature of a modern regulated institution, and it deserves the continuous attention the board gives to its other material risks.
The relationship between board and management
Effective oversight depends on a particular kind of relationship between the board and management, one that is neither adversarial nor deferential but genuinely inquiring. The board's persistent questions are not a vote of no confidence in management; they are the mechanism by which the board discharges its own accountability, and a healthy management team understands and welcomes them, because they also protect management by ensuring that gaps are found and closed before an incident finds them.
This relationship works best when both sides understand the division of labor. Management operates the governance: it builds the inventory, embeds the controls, produces the evidence, and reports honestly, including its exceptions. The board oversees the governance: it insists on exposure, verifies that controls operate, tracks coverage, and demands evidence, holding management to account for the state of the risk. When both play their roles, the institution governs data and AI risk well, and both the board and management can stand behind the attestation that the risk is under control.
The relationship fails when either side distorts it. If management presents reassurance and hides gaps, the board cannot govern and its attestation becomes hollow. If the board defers entirely or accepts activity as control, management is left without the external check that good governance requires. The board's insistence on evidence, applied consistently and without apology, is what keeps the relationship honest, and an honest relationship between an inquiring board and a forthcoming management is the foundation on which the governance of data and AI risk actually rests.
Preparing for the questions that are coming
A board that governs data and AI risk well is also preparing the institution for a future in which the questions it asks internally will increasingly be asked externally, by regulators, auditors, and the public. The direction of travel is clear: scrutiny of how institutions govern their use of data and AI is intensifying, and the ability to demonstrate control on demand is moving from a good practice to an expectation. A board that builds this capability now is not only governing today's risk but preparing for tomorrow's scrutiny.
This forward-looking dimension is part of why the board's insistence matters beyond any single model or incident. Every time the board asks for exposure, controls, coverage, and evidence, it is building the institution's muscle for producing exactly what external scrutiny will demand. An institution accustomed to answering its board's hard questions with evidence is an institution ready to answer a regulator's, while one accustomed to comfortable reassurance will be caught unprepared when the reassurance no longer suffices.
The board's task, then, is both immediate and anticipatory. Immediately, it must govern the data and AI risk the institution carries today, using the three questions and insisting on genuine governance reporting. Anticipatorily, it must build the institution's capability to demonstrate control, because that capability is becoming a condition of operating in regulated markets. A board that does both, governing today and preparing for tomorrow, discharges its accountability fully, and positions the institution to treat intensifying scrutiny as something it is ready for rather than something it fears. That readiness, grounded in evidence the institution can produce on demand, is the ultimate product of a board that governs data and AI risk well.
Every time the board demands evidence, it builds the institution's muscle for the external scrutiny that is coming.
Governing across the whole estate
A board's oversight of data and AI risk must eventually extend beyond individual high-impact models to the whole estate, because risk lives not only in the models the board has examined but in the ones it has not. An organization can have impeccable governance of the three models the board reviewed and no governance at all of the thirty it did not, and the board that looks only at showcased examples will miss exactly where the risk concentrates. Governing across the whole estate is therefore essential, and it changes what the board must ask for.
The key measure here is coverage, and it is worth the board dwelling on it. Coverage asks what share of the organization's data and AI is actually inventoried, tiered, and under active control, and its honest answer is often uncomfortably low, because ungoverned use, shadow AI, models procured rather than built, proliferates faster than governance extends to cover it. A board that asks only about specific models is being shown the governed showcase; a board that asks about coverage is asking about the ungoverned majority where the risk actually lives. The shift from examining individual models to insisting on coverage is a shift from governing the visible to governing the whole, and it is where mature board oversight is distinguished from the well-intentioned but partial kind.
This is also why the board should insist on honest reporting of exceptions, the models running outside the governance process, the controls that were skipped, the data with no owner. A report that shows only the governed estate and omits the exceptions is a report that hides exactly what the board most needs to see, because the exceptions are where the ungoverned risk lives. A board that insists on seeing the exceptions, and treats a growing exception list as the warning it is, is governing across the whole estate. A board satisfied with a clean report of the governed portion is governing the showcase and leaving the rest, which is where the incident that eventually surprises it will come from.
The board's enduring questions
As data and AI become more central to every regulated organization, the board's oversight of their risk becomes not an occasional topic but a permanent feature of its work, as enduring as its oversight of financial or operational risk. The questions this paper has set out, what could go wrong and how badly, is the control working, can we prove it, are not one-time diagnostics but standing questions the board should ask continuously, tracking the answers over time to see whether the organization is strengthening or weakening in its control of these risks.
The enduring nature of these questions reflects the enduring nature of the risk. Data and AI are not a passing initiative that the organization will complete and move past; they are a permanent and growing part of how it operates, and the risk they carry is a permanent and growing part of what the board must govern. A board that treats data and AI risk as a temporary topic, to be handled once and then forgotten, misjudges its nature. A board that treats it as a standing material risk, governed continuously with enduring questions and trended measures, judges it correctly and governs it well.
The paper closes where it began, with the uncomfortable question in the quiet room: can we show, right now, that our use of data and AI is under control? The board's task is to ensure that the organization can always answer that question affirmatively, with evidence, and to keep asking it until answering it becomes routine. A board that discharges that task, insisting on exposure, controls, coverage, and evidence, continuously and without apology, governs data and AI risk as competently as any other material risk, protects both the organization and itself, and can attest, with confidence grounded in evidence, that the organization's use of data and AI is genuinely under control. That confidence, earned through persistent oversight, is the deliverable of the board's work, and it is entirely within the reach of any board willing to ask the enduring questions and insist on real answers.
Data and AI risk is not a topic to handle once. It is a standing material risk, governed continuously with enduring questions and trended measures.
A note on culture and tone
Beyond the questions and the measures, a board shapes the governance of data and AI risk through something less tangible but no less important: the culture and tone it sets. A board that treats these risks with seriousness, that asks its questions persistently and refuses comfortable non-answers, signals to the whole organization that data and AI governance is a genuine priority rather than a compliance formality. That signal shapes behaviour far below the board level, because organizations attend to what their boards genuinely care about.
The tone matters in both directions. A board that engages seriously and inquires persistently encourages management to build genuine governance, because management learns that evidence will be demanded and gaps will be found. A board that defers, or that accepts activity as control, signals that the appearance of governance suffices, and management, responding rationally to that signal, invests in appearance rather than substance. The board's tone is thus a powerful, if indirect, lever on whether the organization's governance operates or merely exists, and a board that understands this uses its questions not only to surface information but to set the expectation that governance will be real.
This is also why the board's persistence matters more than any single question. A board that asks the hard questions once and then relents teaches the organization that the questions can be waited out. A board that asks them every time, tracks the answers over time, and treats deterioration as the warning it is, teaches the organization that governance must genuinely operate because it will genuinely be examined. The culture of real governance is built through this persistence, and it is one of the most valuable things a board contributes, because a culture that expects governance to be real produces governance that is real, far more reliably than any framework or tool. The board's tone, in the end, is part of the governance itself.
The board's role in data and AI risk, then, is larger than asking questions and reading reports, important as those are. It is to set, through its seriousness and its persistence, the expectation that governance will genuinely operate, and to hold that expectation continuously as a standing feature of its oversight. A board that does this governs not only the specific risks it examines but the culture that determines how all the risks, examined and unexamined, are handled. That cultural contribution, sustained over time, is among the most valuable a board can make, and it costs nothing but the discipline to take the risk seriously and to keep asking the questions until real answers become routine.
The questions in the language of the board
Because directors think and speak in the language of governance rather than technology, it helps to render the three questions once more in terms a board uses naturally for any material risk, so that data and AI risk takes its place alongside the risks the board already governs confidently. Cast this way, the unfamiliarity of the technology falls away, and what remains is the familiar work of oversight.
For any material risk, a board asks first about the exposure: what is at stake, how large is it, and where does it concentrate? For data and AI risk, this is the first question, what could go wrong and how badly, and it demands the same specific, quantified answer the board would expect for a credit, market, or operational risk. A board that would never accept a vague answer about its credit exposure should not accept a vague answer about its AI exposure, and framing the question in the familiar language makes that standard natural.
For any material risk, a board asks next about the controls: what mitigates the exposure, and is the mitigation actually working? For data and AI risk, this is the second question, is the control operating, and it demands the same evidence of effectiveness the board would expect for any control. A board that would probe whether a financial control actually operates, rather than accepting that a policy exists, should probe AI controls the same way. And for any material risk, a board asks whether the organization could demonstrate its control to an external party, which is the third question, can we prove it, framed in the board's familiar terms.
Rendered this way, data and AI risk is revealed as an ordinary object of board governance, unfamiliar in its technical surface but entirely familiar in the oversight it requires. The board that governs it well is not doing something new and strange; it is applying the same disciplines of exposure, control, and evidence that it applies to every other material risk, to a risk whose technical dress had made it seem to require something more exotic. Stripping away that technical dress, and governing data and AI risk in the plain language of board oversight, is the key that lets any competent board govern it as competently as it governs anything else.
This is the reassurance with which the paper closes. The technology can make data and AI risk seem to demand a competence the board lacks, but the demand is an illusion created by the technical surface. Beneath it, the risk yields to exactly the oversight the board already knows how to provide: insist on the exposure, verify the controls, demand the evidence, track the coverage, and be able to attest. A board that does this governs data and AI risk fully, and needs no technical mastery to do so, only the familiar discipline of serious oversight applied to a risk whose novelty is more apparent than real.
A short guide for the incoming director
A director newly joining a board, and encountering its oversight of data and AI risk for the first time, benefits from a compact orientation, because the topic can seem forbidding to a newcomer who is not a technologist. The orientation is simple, and it dispels the forbidding impression quickly: the newcomer needs no technical background to contribute, only the willingness to apply the board's ordinary disciplines to a risk in unfamiliar dress.
The incoming director should understand, first, that the board's job is to govern the risk, not to master the technology, and that governing the risk requires insisting on four things: a clear map of the exposure, evidence that controls operate, honest measures of coverage across the whole estate, and the ability to prove control to an external party. A director who insists on these four things is governing well, whatever their technical background, and a director who feels they must first understand the technology has misunderstood the role.
The incoming director should understand, second, that the most common failures of oversight in this area are deference, accepting activity as control, and episodic attention, and that avoiding them means asking the hard questions persistently, refusing comfortable non-answers, and treating data and AI risk as a standing material risk rather than an occasional topic. A director alert to these failure modes, in themselves and in the board as a whole, contributes to genuine oversight simply by helping the board avoid the comfortable traps that substitute the appearance of governance for its substance.
With this orientation, an incoming director can contribute to the board's oversight of data and AI risk from the first meeting, not by bringing technical expertise but by bringing the ordinary discipline of serious governance: insist on exposure, verify controls, track coverage, demand evidence, and refuse to be satisfied by reassurance. That discipline, applied persistently, is the whole of what the board's oversight requires, and it is available to any director willing to apply it, technologist or not. The forbidding surface of the topic conceals a task that is, at bottom, the familiar work of governing a material risk, and a newcomer who grasps that can govern data and AI risk as competently as any veteran.
A new director needs no technical background to govern data and AI risk well, only the willingness to apply the board's ordinary disciplines to a risk in unfamiliar dress.
A board that has read this far has, in effect, already equipped itself for the task, because the task is not technical mastery but the persistent application of ordinary governance disciplines to a risk whose novelty is more apparent than real. The board that insists on a clear exposure map, verifies that controls genuinely operate rather than merely existing on paper, tracks coverage honestly across the whole estate rather than admiring showcases, demands evidence that can be produced on demand, and treats data and AI risk as a standing material risk governed continuously rather than an occasional topic addressed reactively, is a board governing this risk as competently as it governs any other. Nothing more exotic is required, and nothing less will do. The uncomfortable question in the quiet room, can we show right now that our use of data and AI is under control, has a good answer only for the organization whose board has insisted, persistently and without apology, that governance genuinely operate and produce the evidence that lets the answer be yes.
Get the PDF of this insight
Enter your name and corporate email and we will send the download link to your inbox. We send the link to the address you provide, so it must be a real, corporate email. Free providers are not accepted.
Check your inbox
If the address is valid, the download link is on its way. It can take a minute to arrive.
Your next step, whatever your role
If this paper has prompted the board-level questions it was written to raise, here is how to answer them, whether through an independent risk assessment, a platform that produces the evidence, or executive-level capability building.
Get an independent assessment
See it operationalized in a product
Bring this thinking to your organization
Scope an engagement with a senior practitioner.