What to Put in a Board Report About AI Risk

A board report on AI risk should fit on one page and answer four questions: what are we running, what could it do to us, what are we doing about it, and what has changed since last time. Most reports I see answer none of those, because they explain the technology instead.

Directors are not asking to be educated about transformers. They are asking whether the organization can demonstrate it exercised care, which is the standard their own duties are measured against.

The six numbers that belong on the page

The last row is the one that changes board conversations. Risk acceptances are legitimate decisions, but an acceptance that has been open for fourteen months is no longer a decision, it is a habit. Showing the age turns an invisible drift into a visible choice.

What should not be in it?

Model names, vendor names, accuracy percentages, and architecture. None of that helps a director make a decision, and a board pack circulates more widely than people assume.

Also leave out the language of certainty. "We are compliant with AI regulations" is not a sentence anyone can support today, given that Canada's own framework is still in front of Parliament. "We have assessed our seven highest-risk systems against the requirements we expect, and here are the gaps" is defensible and considerably more useful.

How do you frame risk without either alarming or sedating the board?

Give each material risk three lines: what could happen, how likely you think it is, and what would have to be true for it to happen. That third line is the one that produces good discussion, because it turns an abstract fear into a chain someone can break.

For example, instead of "risk of biased hiring outcomes", write: a candidate could be filtered out on a proxy for a protected characteristic; we consider this possible because the tool was not tested on our applicant pool; it would require the vendor's model to weight a feature we have not reviewed. Now a director can ask the right question, which is whether you have asked the vendor.

Rate likelihood in words, not percentages you cannot support. A fabricated seventy-three percent is worse than "we think this is plausible and untested".

How often should this go to the board?

Twice a year for most companies, quarterly if AI sits in a core revenue or safety path, and immediately for a material incident.

Between reports, one thing matters more than frequency: the same person presents it each time, and the numbers are defined the same way. Boards detect changing definitions instantly, and a metric that was redefined between meetings destroys trust in the entire report, fairly.

What does the board actually need to decide?

Give them decisions, not information. A report with no decision on it teaches directors that the topic is handled and does not need their attention, which is the opposite of what governance requires.

Realistic board-level decisions: approving the risk appetite for automated decisions about customers, funding a control that governance has requested twice and not received, accepting a specific residual risk with a review date, or requiring an independent assessment of the highest-tier system. Each of those is a real choice with a cost, which is what a board is for.

Record the decision in the minutes with enough specificity that it can be relied on later. "The board discussed AI risk" is worth nothing in a subsequent inquiry. "The board accepted the residual risk on the claims triage system until the Q2 re-assessment, subject to monthly override monitoring" is a governance artefact.

For the structure underneath the reporting, who owns AI governance covers the committee that should be producing it.

This is general information, not legal advice.

Valdra produces the underlying numbers from the register, assessments, and incident log directly, so the board report reflects the current state rather than a manually assembled snapshot. The AI governance view holds them.