The Board Is Asking About AI Risk. Are You Ready?

It's not an if anymore. It's a when. Somewhere in the next board meeting, someone is going to ask how exposed the company is to AI — and "we use it a lot" isn't an answer.

Why This Question Is Showing Up Now

AI adoption moved faster than AI governance. Teams plugged it into workflows, customer support, code, and content long before anyone mapped out what happens if the model is wrong, biased, breached, or simply unavailable. Boards are catching up to that gap — and they're catching up fast, because regulators, customers, and insurers already are.

What "AI Risk" Actually Covers

It's rarely one thing. The real exposure usually falls into a few buckets:

Operational dependency. What breaks if a core AI vendor changes pricing, deprecates a model, or goes down for a day?

Data exposure. What's actually being sent to third-party models, and does anyone have a full inventory of it?

Decision accountability. If an AI system makes or influences a customer-facing decision — a rejection, a price, a recommendation — who's accountable when it's wrong?

Compliance drift. Regulations are moving quickly and unevenly across regions. What was compliant six months ago may not be now.

What the Board Actually Wants to Hear

Not a demo. Not a list of tools in use. They want to know three things:

1. Do you know where AI is actually being used across the business? Not the sanctioned tools — all of it, including what individual teams adopted on their own.

2. Is there a person or team accountable for AI risk specifically? Vague ownership across "everyone" usually means no one.

3. What's the plan if something goes wrong? A model hallucinates in a customer interaction, a vendor has an outage, a decision gets challenged — is there a response process, or is it improvised?

The Uncomfortable Gap Most Companies Have

Most organizations can answer "what are we doing with AI" reasonably well. Far fewer can answer "what happens when it fails" — and that second question is the one boards are increasingly trained to ask, because it's the one insurers, regulators, and customers ask too.

Where to Start

You don't need a finished framework to walk into that meeting prepared. You need:

• A current inventory of where AI touches the business

• Clear ownership of AI risk, even if it's a temporary designation

• One documented response plan for the most likely failure mode in your business

That's not the whole answer. But it's a real one — and it's a lot more than most companies can currently say.

Frequently asked questions

Q1: What is AI risk in a business context?
It refers to the operational, legal, reputational, and financial exposure a company faces from using AI systems — including data handling, decision accountability, vendor dependency, and compliance issues.

Q2: Who should own AI risk within a company?
It varies by size and industry, but it typically needs a clear owner — whether that's a CTO, a dedicated risk lead, or a cross-functional committee — rather than being left undefined across teams.

Q3: What's the first step in preparing for a board question about AI risk?
Start with a basic inventory of where AI is actually used across the company, including tools adopted informally by individual teams, not just officially sanctioned systems.