Is your Board asking About AI?

The gap is information, Boards want to oversee AI, and management is not yet giving them material that connects AI use to outcomes and risk.

Cybersecurity is the risk that boards name first. The Board puts cybersecurity, privacy and IP at the top of their AI concerns. They call cybersecurity and risk the top barrier to scaling. They rank an AI-enabled security risk first.

The vCISO relationship is becoming a Board relationship. The Board of Directors want to hear from the person who understands AI security threats and risks to the business.

Not every company needs a new committee, a new charter or a new director. For most companies under 200 people, I advise against all three.

You probably do not need a dedicated AI committee if AI is a productivity tool rather than your product, if your leadership team can list every AI system from memory, and if no customer contract makes specific AI commitments. In that situation, a standing 15-minute item on the existing board agenda, backed by the one-page inventory and register above, is proportionate and credible.

You do need more when AI makes or shapes decisions about your customers, when you sell into healthcare, financial services or government, or when an investor or acquirer has asked for an AI governance framework in writing. At that point, align formally to a framework and report against it every quarter.

The Board of a 50-person company is small, and that is an advantage. You do not need to educate a dozen directors. You need two or three people to agree on what they want to see each quarter.

The pressure arrives from outside first. An enterprise customer's security review asks whether your board oversees AI risk. An investor's diligence list asks for your AI policy and inventory. An auditor asks who approved a new AI tool that touches customer data. Each of those questions is a Board question in disguise.

The exposure is proportionally larger because an unanswered question at your size stalls a deal or a round, not a quarterly report. And the directors asking are increasingly the same people who sit on those large company boards.

There is also a practical benefit beyond the boardroom. The same inventory, register and framework mapping that satisfy your board will answer most of the AI questions in an enterprise security review, an insurance renewal and a due diligence request. You build the evidence once and reuse it four times.

The upside is speed. A founder can put board-grade AI reporting in place in one quarter. A large enterprise usually needs two years.

1. What are Boards asking about AI in 2026? Boards want to know where AI is used, who owns each system, what could go wrong, and which frameworks/standards / regulations the company measures itself against. Cybersecurity, data privacy and intellectual property risk are their top AI concerns. They also want to hear more often from the security leader, such as a vCISO, who understands Generative & Agentic AI threats and risks.

2. What should an AI Board Report include? Good AI Board reporting has the following Five (5) Parts:

3. Does a Small Business need a Board AI Committee? Usually not, if the company has fewer than 200 people and uses AI as a productivity tool rather than as its product. A 15-minute standing item on each quarter’s board agenda, backed by a one-page AI inventory and risk register, is enough. A formal committee and framework alignment become necessary when any of these apply:

4. Should we choose ISO 42001 or NIST AI RMF? Choose ISO/IEC 42001 if your customers ask for certificates, because it is certifiable. Choose NIST AI RMF if you want a voluntary, flexible framework. Whichever you pick, map your current practice to it and show the gaps to your Board.

5. How fast can an SMB or SaaS company get board-ready on AI Governance? Most SMBs and SaaS companies can put board-grade AI reporting in place within one quarter. Large enterprises often need about two years. The same evidence pack also answers enterprise security reviews, insurance renewals and due diligence requests, so you build it once and reuse it.

The work above is what our Virtual CISO Services deliver: an accountable security and AI risk executive who reports to your Board. Our AI Governance practice builds the inventory, register and framework alignment, and our Governance, Risk & Compliance team maps customer commitments to working controls. Where AI is embedded in operations, our Process Risk & Controls work redesigns those processes so they can be evidenced. For context on the role itself, see our explainer on what a virtual CISO does.

To start on your own, use the free tools at irmcon.com/products, including the AI Governance Playbook, the ISO 42001 Gap Assessment and the SOC 2 Gap Assessment. When you want a second opinion on your next board pack, book a free consultation.