Board questions about AI: what to ask every quarter

Most boards handle AI in one of two ways. They ignore it because it feels like a management matter, or they ask for "an AI strategy" and receive forty slides of ambition. Neither works. The board questions about AI that matter are few, they get asked every quarter, and the board insists on evidence rather than enthusiasm.

A board's job here is the same as its job everywhere else: test whether management understands the risk and the opportunity, and notice early when the story and the numbers part company. AI doesn't need a new kind of governance. It needs the old kind, applied to a subject most directors feel slightly out of their depth on, which is exactly why it gets either waved through or over-engineered.

AI doesn't need a new kind of governance.

When a chair asks for an AI strategy, management hears "show us you're on top of it". So they commission a deck. It has a maturity model, a long list of use cases scored on a two-by-two, and a roadmap that starts next quarter. It is presented once, praised, and never mentioned again.

The problem is that a strategy deck tests presentation skills. It doesn't test whether anything changed in the business. I've sat on both sides of that table, as the executive presenting and as the director listening, and the deck is comfortable for everyone. That is the warning sign.

The alternative is duller and much more useful. Four groups of questions, the same ones every quarter, each with a clear idea of what a good answer sounds like. Over three or four quarters the answers build a picture no single deck can: which claims held up, what got switched off, and whether management's grip is tightening or loosening.

Start outside the building. The first question is how AI changes your market, your pricing and your competitors' cost base.

Early 2026 gave boards a live example of how quickly this can move. Listed software stocks sold off sharply on fear that AI agents would undercut seat-based SaaS pricing, and J.P. Morgan Asset Management noted the knock-on for private equity and private credit, where software is one of the largest sector exposures. Whatever you think of the reasoning, sentiment moved in weeks. Valuations followed. A board that first discussed its exposure after that happened was late.

Exposure isn't only a software question. Picture a professional services business that bills by the hour, where a competitor uses AI to cut the drafting time on a standard piece of work by half. That competitor can hold price and take the margin, or cut price and take your clients. Either way your pricing model is now a board matter.

A good answer names specific revenue lines, says which are protected by something AI can't easily copy (relationships, regulated activity, physical delivery, proprietary data) and which are exposed. It includes what management has seen competitors actually doing, not what vendors say they could do.

The warning sign is a generic answer. "AI is an opportunity for us and a threat to slower competitors" tells you management hasn't looked.

The second group is about what exists today. What AI is in production, meaning used by real staff or customers on real work, unattended by the people who built it? What does each item return, in hours or in margin? And what is still running six months after launch?

That last question matters because most AI work never reaches it. MIT NANDA's study of enterprise generative AI found 95% of the pilots it examined showed no measurable P&L impact. Critics point out that some of that reflects pilots with no baseline measured before launch, which is itself a finding a board should care about: if nobody measured the before, nobody can prove the after. S&P Global Market Intelligence found 42% of companies abandoned most of their AI initiatives in 2025, up from 17% the year before, and the average organisation scrapped 46% of its proofs of concept before production. I've written more on the causes in why AI pilots fail.

A good answer is a short list with numbers attached. Take an illustrative £60m distribution business with 300 staff. Management reports four use cases in production: order entry from emailed purchase orders, supplier invoice matching, a first draft of customer service replies, and a weekly stock exception report. Together they return 1,100 hours a month. At a loaded cost of £35 an hour that is £38,500 a month, or about £462k a year. Tooling, hosting and support cost £9k a month, £108k a year. Net, roughly £354k.

Then the board asks the follow-up that separates real value from paper value. Where did the 1,100 hours go? If they were absorbed into a slightly less busy week, the saving is notional. If they covered growth without new hires, or removed agency spend, it shows in the accounts. Measuring AI ROI covers how to set that up.

The warning signs: a count of pilots with no production list, benefits expressed as "productivity" with no hours, and no mention of anything that was stopped. A business doing this properly kills things. If nothing has been switched off in a year, nobody is looking.

The third group is where boards usually feel most at home, and where they often ask the wrong question. "Do we have an AI policy?" gets a yes. The better question is what happens in practice.

Start with data. What customer, employee and commercial data is going into AI tools, which tools, and on what terms? Under UK GDPR, personal data sent to a third party model needs a lawful basis, a processor agreement and, often, a data protection impact assessment. The ICO expects the same accountability here as anywhere else.

Then the uncomfortable one. What are staff pasting into public tools on personal accounts? In most businesses I walk into, the honest answer is that nobody knows. Pricing sheets, contract drafts and customer lists end up in consumer chat tools because the approved route is slower or doesn't exist.

Intellectual property comes next. Who owns outputs, and does any vendor have the right to train on your data? If you sell into the EU, the EU AI Act is live. Prohibited practices have applied since February 2025, general-purpose model obligations since August 2025, and transparency duties under Article 50 since August 2026. The Digital Omnibus on AI pushed high-risk obligations for standalone systems to 2 December 2027 and for AI in regulated products to 2 August 2028, as Gibson Dunn's summary sets out. Deferred isn't cancelled. Those dates fall inside most PE hold periods.

Finally, vendor dependency. If your main AI supplier doubled its price or changed its terms next quarter, what would break, and how long would it take to move?

A good answer is specific: a register of tools in use, what data each touches, who approved it, and a view on shadow usage backed by something (licence data, network logs, a staff survey). The warning sign is a policy nobody has read and a confident statement that "staff know not to do that".

The last group is about people. Who on the executive team owns AI outcomes, meaning the numbers, not the enthusiasm? And can the business build, change and maintain what it buys?

Talent is the constraint most often cited. FTI Consulting's 2026 Private Equity AI Radar found talent was the top barrier to scaling AI (35%), and only 36% of portfolio companies deploy AI in production with real operational impact.

A good answer names one executive, usually the COO or CFO rather than IT, with specific targets in their objectives. It describes who maintains each production system when the builder has moved on, and what the business does itself versus what it pays others for.

The warning signs: ownership sits with "the AI working group"; one enthusiastic individual holds everything together; or every system depends on a supplier the business couldn't replace. Capability that lives in one person's head is a key person risk, and boards already know how to treat those.

This is the list worth keeping. Not every question needs a long answer every quarter, but each should get some answer.

Questions are half of it. The board also needs a few habits of its own.

Put AI on the agenda once a quarter, for twenty to thirty minutes, as a standing item. Not a special session and not an away day. Standing items get compared quarter to quarter, and that comparison is where a board earns its keep. Some investors already formalise this: Bain's Global Private Equity Report 2025 describes Vista Equity Partners asking portfolio companies to submit goals and quantified benefits for generative AI initiatives.

Six numbers, tracked over time:

If management can't produce these, that's the answer to the capability question.

Two pages. What tools are approved, what data must never go into any AI tool, who to ask when unsure, and who owns the policy. A twenty-page policy protects the author, not the business. Staff don't read it, so they keep pasting.

If nobody on the board has built or run AI systems in a business, the board is relying on management to mark its own homework. That's the point to add a NED or adviser with hands-on experience: someone who can tell a production system from a demo, and who knows roughly what things should cost and how long they take. Look for delivery scars rather than conference slots. It needn't be a permanent seat. An adviser for four quarters, while the dashboard beds in, is often enough.

A year from now, the useful question for any board is simple. Can you name what is still running, unattended, that wasn't a year ago, and what it returns each month? If you can, the governance is working. If you can't, more slides won't fix it.

If your board wants someone in the room who has built these systems as well as governed them, I take a small number of board and NED seats, and the first conversation is always a free 30-minute call.

Brannan Coady

Founder of Anyway Ventures. Exited founder, former CEO of YourParkingSpace, investor and board member; now building AI inside PE-backed and mid-market businesses. More →