Executive management is responsible for how AI is built, bought, deployed and run day to day. The board's role is to set the direction and risk appetite, satisfy itself that management's approach is sound, and challenge decisions that carry material strategic, financial, regulatory or reputational consequences. Board advisory work is designed to strengthen that oversight role without drawing the board into operational decisions that belong with management.

No. Directors need enough working AI literacy to ask informed questions, recognise where management's claims deserve scrutiny, and understand the shape of the risks involved. That is a materially lower bar than technical expertise, and it is what board briefings are designed to build.

AI risk appetite should be agreed explicitly by the board, expressed in terms directors can apply to real decisions, and reviewed on a set cycle rather than left implicit. It should cover the risk categories that matter most to the organisation, such as regulatory exposure, customer harm, third-party dependency and reputational impact, and be revisited as AI use and regulation evolve.

Good board reporting on AI focuses on material decisions and exceptions rather than volume of activity: significant new AI investments, material risks or incidents, progress against the agreed risk appetite, and regulatory developments that could change the organisation's obligations. It should be concise enough to prompt genuine discussion, not simply be noted.

The EU AI Act's obligations are phased in over time and fall most heavily on providers and deployers of higher-risk AI systems. Boards of organisations in scope are expected to understand their organisation's exposure, satisfy themselves that governance and compliance arrangements are adequate, and be able to demonstrate that oversight if asked. We help boards understand what that means in practice for their specific AI use.

ISO/IEC 42001, the international standard for AI management systems, expects top management commitment and clear governance accountability as part of certification. For many organisations that means the board needs a defined role in setting AI policy and reviewing how the management system is performing, even where day-to-day operation sits with the executive.

There is no single right answer. Organisations with extensive or high-risk AI use often benefit from a dedicated committee or a standing agenda item with real time allocated. Others integrate AI oversight into existing risk, audit or technology committees. The right structure depends on board size, the scale of AI use, and how AI risk compares with other priorities already on the board's agenda.

Agentic AI systems that plan and act with limited human intervention introduce risk categories that traditional board reporting was not built to catch: autonomous decisions made in production, cascading errors across connected systems, and less obvious human accountability when something goes wrong. Boards increasingly need to ask specifically how much autonomy these systems have and what stops them acting outside agreed boundaries, rather than treating them as another item on the existing AI risk register.