The AI update is slide nine of the quarterly board deck at a 200-person engineering firm. It lists four pilots, a vendor logo and a line that says productivity is up. A director asks one question: which of these tools touch client data? The CEO looks at the COO, the COO looks at the IT director, and nobody knows, because the four pilots on the slide aren’t the tools people actually use. I’ve sat in versions of that meeting. The fix isn’t a longer slide. It’s three AI questions a board should ask every quarter, and a one-page answer the CEO can stand behind.
Why these questions belong on every agenda
AI use inside a company is set by employees, not by the pilots on the slide. In Microsoft and LinkedIn’s 2024 Work Trend Index, 78 percent of people using AI at work said they brought their own tools. Verizon’s 2026 Data Breach Investigations Report found that frequent AI use by employees went from 15 percent to 45 percent in a single year. When I led a shadow AI assessment at a Fortune 500 company, the inventory surfaced 346 unsanctioned AI tools across 130 departments. Mid-market companies have the same pattern with fewer zeros.
The cost of not knowing is now measured. IBM’s 2025 Cost of a Data Breach Report found that one in five breached organizations had a shadow AI breach, that heavy shadow AI use added an average of $670,000 to the cost, and that 63 percent of breached organizations had no finished AI governance policy. IBM’s 2026 report, released July 29, put the global average breach at $4.99 million and found that one in four malicious breaches was AI-enabled, at an average cost of $6 million.
Regulators are moving too. Texas’s AI law has been in effect since January 1, 2026. Colorado’s SB 26-189 applies to consequential decisions, such as hiring, lending, insurance, housing and health care, made on or after January 1, 2027. The EU’s amended AI Act now applies its high-risk rules from December 2, 2027 and August 2, 2028. A board doesn’t need to know these rules in detail. It needs to know that management does.
Question one: what AI is in use, and who approved it?
This is the inventory question, and it comes first because every other answer depends on it. A good answer is a number, a change and a name: how many tools are in use, how many are approved, how many were found and are under review, how many were retired this quarter, and which executive owns the list. It counts features switched on inside software the company already pays for, such as meeting transcription and email assistants, because those arrive in updates, not purchase decisions. A weak answer is “we have a policy.” A policy is a statement of intent. The inventory is evidence. I wrote up how to run the first one in the shadow AI inventory you can run this week.
Question two: what data does it touch, and what stops it from leaving?
Every approved tool should map to a data class: public, internal, client, employee and regulated, which for a defense supplier means controlled unclassified information. The board should hear which tools touch the most sensitive class and what sits between the tool and the data. The controls are ordinary: single sign-on instead of personal accounts, retention settings, contract terms that bar the vendor from training on company data, logging, and a block on the unapproved path. IBM’s 2025 report found that 97 percent of organizations that reported a breach of an AI model or application lacked proper AI access controls.
Question three: who is accountable, and what happens when it goes wrong?
A committee isn’t an owner. The board should be able to name one executive accountable for AI use, the way it can name who is accountable for cash. That person reports three things each quarter: incidents and near misses, such as a client document pasted into a consumer chatbot or an AI-written deliverable sent with an invented citation; the decisions management needs from the board; and the calendar of dates that apply to the company, from state AI laws to client contracts that now ask about AI. Texas’s law bars liability for a violation a company finds through its own internal review when it substantially complies with the NIST Generative AI Profile or another recognized framework. That is a reason to run the review, written into a statute.
The one-page answer
The brief that answers all three questions fits on one page because a board needs the trend, not the tooling. Mine has six blocks. Inventory: tools approved, found, and retired this quarter. Data map: which tools touch client and regulated data. Controls: the five controls above, with a status for each tool that touches sensitive data. Incidents and near misses, with what changed as a result. Decisions needed from the board. Calendar: the regulatory and contract dates in the next twelve months. The first version takes a few weeks, because the inventory has to be real. After that it’s a quarterly refresh in the same order as the SAFE framework: find what’s in use, decide what matters, fence it, then expand what works.
The one-pager also does something a policy can’t: it gives directors a record that they asked, that management answered with evidence, and that the answer improved over time. If a client, an insurer or a regulator ever asks what the board knew about AI, that record is the answer.
Frequently asked questions
How often should a board review AI use?
Quarterly, with the same one-page brief each time so the trend is visible, plus an out-of-cycle update whenever a new use case touches client or regulated data or an incident occurs.
Does a private company board need AI oversight?
Yes. Clients, insurers and state AI laws don’t distinguish between public and private companies, and most mid-market AI exposure comes from everyday tools rather than formal AI projects. A quarterly review is the minimum.
What should an AI brief for the board include?
Six blocks on one page: the AI inventory with changes since last quarter, a data map, control status for tools that touch sensitive data, incidents and near misses, decisions needed from the board, and the regulatory and contract calendar.
My team at Stealth Technology Group builds this brief with executive teams as part of our AI strategy and governance work. If your next board meeting has an AI slide and no inventory behind it, get in touch.