Why are boards being asked about AI now?
AI is now built into software most organisations already buy, staff use their own tools, and agentic systems that take actions are arriving. The AICD and the Human Technology Institute at UTS updated their governance resources in June 2026 to account for this kind of change, publishing a director's guide, a board summary and checklist for small businesses and not-for-profits, and a snapshot. An AICD article from September 2026 says directors' duties are unchanged and that AI is changing how those duties may be assessed when decisions are challenged. The guide organises board oversight across four elements: strategy, governance structure, governance practices and enablers.
What should the board ask about AI strategy?
Start with the current position before discussing new investment. The AICD's checklist for smaller boards asks directors to understand where AI is already used, including AI features in third-party products, to discuss risk appetite with management, and to assess where AI could add value using existing resources such as current software subscriptions. The questions below turn that into prompts for a board meeting. Ask management to bring evidence for each answer.
- Where is AI used today, including inside products we buy?
- What is our appetite for AI risk, and where is the line?
- Which processes would benefit most, and how do we know?
- Does any proposed AI investment need new resources or significant spending?
Who is accountable, and how are AI uses approved?
The AICD checklist asks boards to assign accountability for AI oversight to an appropriate senior leader, establish a proportionate approval process based on potential impact, and agree when and how the board is updated, including targeted metrics on AI use, effectiveness and risk. The National AI Centre's foundations guidance starts in the same place: a senior leader as the overall AI governance owner, with enough authority and understanding to oversee all AI use. Ask who that person is, what they can approve on their own and which uses must come to the board.
What should the board ask about policy, risk and vendors?
An AICD article by a Corrs Chambers Westgarth partner suggests boards ask whether the organisation has an inventory of AI systems, including those embedded in procured software, and policies that state which tools are approved, restricted and prohibited and are actually enforced. It also points to vendor contracts that address data handling, model limitations and liability for AI-generated outputs, and to public statements about AI that match actual practice, because overstating capability or governance maturity creates exposure under Australian consumer law. Ask management to show the register, the policy and the relevant clauses of the main supplier contracts.
How is AI shaping the board papers themselves?
AI may already be summarising risk reports, financial analysis and management papers before directors read them. The same AICD article says boards need visibility of four things where AI is involved in the information they receive: purpose, validation, exceptions and overrides, and accountability. It also cites judicial comments that a director who simply adopts an AI-generated recommendation without independent reasoning has not made a conscious decision, which matters for the protection the business judgment rule provides. Ask management to label where AI contributed to a paper, and agree a board policy on directors' own use of AI tools.
What does a credible management answer look like?
A credible answer points to records that exist and are kept current. A general assurance that AI is under control, a list of tools without owners or a policy nobody has been trained on are warning signs. Directors should see enough to judge whether management understands the technology and its risks, without inspecting technical detail. The evidence below lines up with the National AI Centre's six practices, which the AICD guide refers to as AI6.
- An AI register with an accountable person for each system.
- A current AI policy with an owner and a review date.
- Risk screening or assessment records for higher-risk uses.
- An incident and complaints log that includes AI outputs.
- Training records for staff who use or oversee AI.