A board or owner does not need to understand AI to govern it. Ten questions do it: what AI is in use, including what staff use on their own accounts; what it costs per month and per unit; what it decides, and where a person decides instead; where our data goes and under what agreement; who is accountable for each system; what the measured return on the first process was; what the acceptance threshold is and whether we are meeting it; what happens when the model is retired or the supplier disappears; what a client or regulator would find if they asked; and what we have decided not to do. A firm in control answers each in a sentence with a number or a document behind it. A firm not in control answers with adjectives. The evidence is on the board’s side: most AI projects that fail do so for governance reasons, unclear value, uncontrolled cost, weak risk controls, poor data, that these questions surface.
- Questions
- Ten, each answerable in a sentence
- Good answer
- A number or a document
- Bad answer
- An adjective
Why the board should ask
Because everyone else is asking the firm. Clients send AI questionnaires; insurers ask about AI use at renewal; auditors ask about automated controls; staff ask what they are allowed to use. And because the surveys say the failures are governance failures: Gartner’s four causes of abandonment are unclear business value, escalating costs, inadequate risk controls and poor data; MIT NANDA found most generative AI pilots producing no measurable return; DSIT found most UK adopters reporting productivity gains but few seeing revenue change. Ten questions asked twice a year cost an hour and prevent most of that.
RelatedUK AI statistics 2026, sourced AI consultants for UK SMEs
The ten questions
Ask them in order; the third column is what to listen for.
| Question | The answer that shows control | The answer that should worry you |
|---|---|---|
| What AI is in use, including personal accounts? | A register: tools, plans, owners, and “no personal accounts, policy adopted [date]” | “Some people use ChatGPT” |
| What does it cost, monthly and per unit? | A figure per tool and per feature, against the invoice | “It is in the IT budget” |
| What does it decide, and where does a person decide? | A list: advisory here, unattended there, a person on money, individuals and access | “It handles it” |
| Where does our data go, under what agreement? | Processor records with DPAs, regions and sub-processors; DPIAs where needed | “It is all cloud” |
| Who is accountable for each system? | A named owner per system and process | A supplier’s name |
| What was the measured return on the first process? | Baseline, 90-day result, decision taken | “Staff say it saves time” |
| What is the threshold and are we meeting it? | A number, sampled weekly, with this month’s figure | “Accuracy is high” |
| What happens when a model is retired or the supplier goes? | A runbook, the deprecation routine, code and accounts in our name | “We would call them” |
| What would a client or regulator find if they asked? | One folder: policy, DPAs, attestations, thresholds, the twenty due-diligence answers | “We would put something together” |
| What have we decided not to do, and why? | A short list with reasons and a review date | Nothing |
RelatedAn AI strategy for a UK SME How to measure AI return in 90 days AI vendor due diligence checklist
What to do with weak answers
A weak answer to question one means shadow AI, fixed in a week with business plans and a policy. Weak answers to two and seven mean nobody measured, fixed by baselining the main process and setting a threshold. Weak answers to four and nine mean the data protection paperwork was never done, fixed by processor records and a DPIA where needed. A weak answer to eight means lock-in, fixed by getting the code, accounts and runbook into the firm’s name now. A weak answer to ten means nobody has decided what AI is for, which is the two-page strategy. None of these takes more than a month, and most cost nothing but attention.
RelatedShadow AI in a UK small business A DPIA for AI, with a template Your data when a supplier builds your software
The two decisions the board actually owns
Scope: what AI may and may not be used for, in particular that it never decides about an individual without a person and never moves money or changes access unattended. And appetite: what the firm is prepared to spend on a first measured process and what return would justify a second. Everything else is management. A board that has made those two decisions in writing has done its job, and the ten questions are how it checks the decisions are being kept.
RelatedFractional AI officer, consultancy or a hire? An AI business case template
What the board should not do
Ask for an AI strategy deck. Approve a budget line for “AI” with no process attached. Delegate the data protection question to the supplier. Or decide the firm needs an AI agent because a competitor announced one. The honest answer to “what should we do about AI” is sometimes “nothing yet, and here are the three counts we will revisit in six months”, and a board should be able to hear that.
RelatedDoes a small business actually need AI? Why most AI pilots never reach production
Common questions
What should a board ask about AI?
What is in use including personal accounts; cost per month and per unit; what it decides and where a person decides; where data goes and under what agreement; who owns each system; the measured return; the threshold and whether it is met; what happens on model retirement or supplier loss; what a client or regulator would find; and what has been decided against.
Do directors need to understand AI to govern it?
No. They need the ten questions and the ability to tell a number or a document from an adjective. The technology is management’s job; scope and appetite are the board’s.
How often should a board review AI?
Twice a year against the ten questions, and whenever a client questionnaire, an insurer or a regulator asks something the firm cannot answer in a sentence.
What are the biggest AI governance failures in small firms?
Personal accounts with no policy; no measured baseline or threshold; no processor records or DPIA; code and accounts in a supplier’s name; and budget with no process attached. Each is fixable in a month.
What two decisions does the board own?
Scope, including that AI never decides about individuals or moves money unattended, and appetite: what to spend on a first measured process and what return justifies a second.
Is it acceptable for a board to decide not to use AI yet?
Yes, if it is a decision with reasons and a review date rather than an absence of one. The three counts in our “does a small business need AI” guide are the basis.