Artificial intelligence has moved from the laboratory to the ledger, and the board is now accountable for systems most directors did not design and few fully understand. The defining governance question of 2026 is no longer whether to oversee AI, but how to oversee it proportionally — applying the right intensity of scrutiny to the right level of risk. This briefing reduces that challenge to two reusable structures every board can carry into the next meeting.
Framework One: The Five Questions of AI Governance
A board does not need to build AI systems; it needs to confirm that management has built the right ones and can prove it. Any defensible governance framework answers five questions, in order. If management cannot answer all five for a given system, that system is operating outside the board’s oversight.
| Question | What the board is confirming |
|---|---|
| 1. Inventory — What exists? | A living register of every AI system in use, including third-party and embedded tools. You cannot govern what you have not counted. |
| 2. Ownership — Who is accountable? | A named human owner for each system. Accountability that is shared across a committee is accountability that belongs to no one. |
| 3. Risk — What could go wrong? | Each system classified by its potential impact on customers, capital, and compliance. Classification drives every downstream control. |
| 4. Controls — What constrains it? | The guardrails, approval gates, and human-in-the-loop checkpoints proportionate to the system’s risk tier. |
| 5. Evidence — How do we know? | The monitoring logs, audit trails, and performance metrics that let the board verify the first four answers rather than assume them. |
Framework Two: The Proportionality Matrix
Proportionality is the discipline that prevents two opposite failures: smothering low-stakes tools in process, and waving high-stakes systems through on trust. The matrix maps a system’s risk tier to the oversight intensity it earns. Most organizations misallocate attention because they apply a single standard to every system.
- Tier 1 — Low impact (productivity tools)
- Drafting aids, internal search, meeting summaries. Oversight: management-level policy and acceptable-use rules. The board confirms a policy exists; it does not review individual tools.
- Tier 2 — Moderate impact (operational systems)
- Demand forecasting, internal analytics, candidate screening support. Oversight: documented owner, periodic management reporting, and a defined escalation path. The board reviews the category annually.
- Tier 3 — High impact (decisions affecting people or capital)
- Credit, pricing, hiring, safety, and customer-facing automated decisions. Oversight: board-committee review, independent validation, bias and accuracy testing, and a documented kill switch. The board sees these by name.
Read together, the two frameworks interlock: the Five Questions tell the board what to know about every system, and the Proportionality Matrix tells the board how hard to look at each one.
How to Apply This
Begin at the next board meeting by asking management for the inventory — the register of AI systems with named owners. That single request surfaces both the systems in use and the gaps in accountability. Next, ask management to assign each system a risk tier and to demonstrate that the oversight intensity matches the tier; mismatches are where governance failures originate. Then confirm the evidence: for every Tier 3 system, the board should be able to inspect monitoring data and validation results, not merely receive assurances. Finally, calendar the review — proportional oversight is a recurring discipline, not a one-time audit. A board that runs this cycle quarterly can credibly say it governs its AI rather than merely permits it.