Back to Resources

    Board questions pack

    Ten Questions a Board Should Ask About AI-Enabled Actions

    A practical discussion guide for boards, senior leaders and governance committees.

    10-minute discussion guideBuildMoat executive resource
    Take the SMF Accountability Diagnostic

    Why boards should ask

    Boards do not need to approve every AI experiment. They do need confidence that the firm understands where AI is materially affecting customers, operations, compliance or resilience, and that accountable leaders have appropriate controls, evidence and intervention arrangements.

    This guide supports constructive executive challenge. It is not legal advice or a substitute for a board’s own governance responsibilities.

    The ten questions

    1. Which AI-enabled workflows can materially affect customers, financial outcomes, regulatory obligations or important business services? Ask for a prioritised inventory, not a list of every tool licence.
    2. Which systems can recommend, initiate or execute actions rather than only assist staff? Focus on delegated operational authority, not only model sophistication.
    3. Who approved the permitted authority and boundaries for each material workflow? Ask what is allowed, prohibited and subject to human approval.
    4. Who owns the outcome when an AI-enabled workflow affects a customer or operational process? Clarify business ownership, executive oversight and independent challenge.
    5. What data, tools, systems and third parties can each workflow access? Ask whether permissions are proportionate and dependencies understood.
    6. How are material changes assessed and approved? Include model/provider changes, prompts, retrieval sources, tool integrations, permissions, customer scope and autonomy level.
    7. What evidence would allow the firm to reconstruct a material AI-enabled action? Ask whether the firm can establish authority, context, controls, human involvement, action and outcome.
    8. What management information demonstrates that customer and control outcomes remain acceptable? Expect information on exceptions, overrides, errors, complaints, incidents, changes, remediation and trends.
    9. Who can restrict, suspend or revoke AI authority, and what is the tested fallback process? Ensure intervention is a practical capability, not only an aspiration.
    10. What decisions or investments are required in the next 90 days? Ask management for a prioritised plan with owners, timing, risk decisions and evidence of progress.

    Suggested board pack outputs

    • AI use-case inventory and prioritisation
    • Autonomy and impact heatmap
    • Accountable ownership map
    • Material changes and approvals
    • Exceptions, incidents, complaints, overrides and remediation
    • Control and evidence gaps with action status
    • Key risk decisions requiring executive or board input

    Give leadership a decision-ready view of material AI workflows

    BuildMoat’s AI Accountability Diagnostic provides a prioritised inventory, autonomy assessment, accountability map, evidence and control gap review, and 90-day action plan.

    Take the SMF Accountability Diagnostic Request a confidential conversation

    This resource provides practical governance guidance for discussion and planning. It is not legal advice, an audit, regulatory certification, a compliance score or a substitute for your firm’s own legal, regulatory, risk and governance decisions.