What boards should ask about AI risk

Treat AI like any material dependency

If a single foreign provider can change your costs, cut off your access, or see your data, that is concentration risk the board already knows how to interrogate. AI does not need a new risk vocabulary; it needs the existing one applied.

Ask where the dependencies are and what happens if they fail.

Demand accountability, not confidence

The right question is not 'how accurate is it' but 'can we prove what it decided and defend it'. A system whose decisions can be independently verified is governable; one that cannot be verified is a liability waiting for a challenge.

Require honest scope

Boards should reward management and vendors who state clearly what the AI does not do and what its numbers do not prove. Overclaiming is the risk indicator; candour is the control.

A short standing agenda item

AI risk does not need a special committee so much as a short, recurring place on the agenda: what consequential decisions is AI now making, what are our dependencies, and can we prove and defend those decisions. Asked regularly, those questions keep management honest and surface problems early.

The board's job is not to understand the model but to insist on evidence and accountability, and to treat inability to provide them as the finding, not a detail to revisit later.