The board's best moment to govern AI is before the money is spent. Once the contract is signed and the system is live, the board is reviewing a decision. Before that, it is shaping one. Most of a director's leverage sits in that earlier window, and most boards spend it too lightly.
I have seen technology decisions from both sides of the table. As an operator, I built the systems. As a director, I ask about them. The questions that matter most are the ones asked early, while the answer can still change the plan.
Why does timing matter so much for AI oversight?
Because AI commitments compound. A model is trained on your data, wired into your workflows, and trusted by your people. Each step makes the next one harder to undo. By the time a problem shows up in the numbers, the cost of changing course has grown. A board that asks hard questions at approval spends a little time. A board that asks them after an incident spends a great deal more.
What should a board ask before approving an AI investment?
Five questions cover most of it: what problem it solves and how we will measure it, who owns it when it is wrong, what data it touches, how we will know it is working, and what the exit is. None of them require technical fluency.
- What problem does this solve, and how will we measure it? If management cannot name the measure before launch, it will not be able to show success after.
- Who owns it when it is wrong? Every AI system will be wrong sometimes. A named executive should answer for that. Not a vendor, and not a committee.
- What data does it touch, and do we have the right to use it that way? Data rights, privacy, and security are where many AI projects carry their largest hidden risk.
- How will we know it is working, and how will we know it is not? Ask what will be monitored, how often, and who sees the results.
- What is the exit? If the vendor fails, the costs rise, or the system drifts, what does it take to stop? A plan with no exit is a commitment with no limit.
What does a good answer look like?
A good answer is specific. It names a person, a number, and a date. For example: the chief operating officer owns it, we expect claim handling time to fall by a set amount within two quarters, and we will report against that target at the April meeting. That is an answer a board can hold someone to.
A weak answer is general. "We are confident in the vendor." "The team is monitoring it." "It is industry standard." None of those are wrong. None of them are enough.
Does a director need a technical background to do this?
No. These are questions about accountability, risk, and measurement. Those are a director's questions in any field. A technical background helps a director notice when an answer is vague. It does not replace the discipline of asking.
Many AI pilots never reach production. Some of that is healthy. Pilots are meant to fail cheaply. But much of it traces back to decisions that were never framed well at the start.
Where should a board start?
Take the next AI investment that comes before you. Ask the five questions. Write down the answers. Bring them back in two quarters and compare. That one habit will teach a board more about its AI program than any briefing.
Good AI governance is not about slowing down. It is about spending well. And it is easiest before the money is spent, not after something breaks.