Boards ask about AI now, usually in some version of "what are we doing about it". The usual answer is a list. Tools bought, pilots running, people trained. It sounds busy and tells the board almost nothing it can act on.
A board doesn't need an inventory. It needs to know what has been decided, what it costs, what could go wrong, and whether it's working. Four things, on one page.
1. The position
One paragraph. Where AI matters to the business, where it doesn't, and what the organisation won't do. If that paragraph is hard to write, that's the finding.
2. The money
Total AI spend, as one number. Licences, cloud, consulting and staff time, which in most organisations are booked in four different places. Then what it buys. The use cases in production, what each costs and what each returns.
Return is hard to measure precisely, and boards know that. What they won't accept is no attempt. For each use case, a before and after on the one measure that matters to its owner. Time per case, error rate, throughput, revenue per customer. Rough and honest beats precise and invented.
3. The risk
What could go wrong, and who owns each risk.
Regulatory. Any use that counts as high-risk under the EU AI Act, and where the work on it stands.
Data. Where sensitive data meets AI tools, and the controls in place.
Dependency. Which vendors you rely on and what it would take to switch. More in choosing AI vendors.
Shadow use. What you know about use outside the approved tools, and the trend.
Boards are more comfortable with known risks that have owners than with a report that says there are none.
4. Adoption, honestly
Licences issued isn't adoption. Logins aren't either. What counts is whether the work has changed. Report the share of people using AI in their regular work, by team, and the use cases that moved from pilot to daily use this period.
Report the ones that stopped too. A portfolio where nothing ever stops isn't being managed. Why AI pilots stall covers the difference.
The cadence
Quarterly suits most boards. Monthly is for the leadership team, where the decisions get made. The board report should summarise decisions already taken, not ask the board to take them.
What belongs with the board
Some decisions do belong there. The overall position and appetite for risk. Budget above a set threshold. Anything high-risk that touches customers or employees. And who owns AI at leadership level, which is the decision that makes the rest of this report possible. If that's still open, fractional or permanent is where to start.
One page
If the AI report runs to twenty slides, it's often hiding the absence of decisions. One page, four sections, the same structure every quarter, so the board can see the trend. Everything else is an appendix.