Chapter 11 of 12 · Now, and whenever AI plans change
Q11: What New Risk Are We Taking On With AI?
- Do we know where AI is being used here?
- Who approves new AI tools?
AI tools are arriving faster than most approval processes. Staff use them to write, code and analyse, often before anyone has decided whether they should. The board does not need to understand the models. It needs to know the company is in control of how they are used.
What you should hear
- A list of the AI tools and systems in use, including those bought by business teams.
- Clear rules on what data may and may not go into them.
- Who approves a new AI use, and how risk is checked before it goes live.
- Who owns the decision when an AI system acts on its own, such as sending messages or changing records.
Red flags in the answer
- "We have banned it." Bans without alternatives push use out of sight.
- No one can say which tools staff actually use.
- AI is treated as only an IT matter, with no business owner.
The question you might not ask out loud
Is this a security question or a strategy question?
Both. The strategy decides where AI is used. Security and risk decide how safely. The board should hear about both in the same conversation.
Follow-up
"What is the most sensitive data that has gone into an AI tool here, and who decided that was acceptable?"
Why this matters: AI can change how a company handles data, makes decisions and serves customers, and it can do so quickly. A board that hears about AI only as an opportunity misses half of what it is overseeing.
Rule of thumb:You cannot govern what you have not listed.