この記事は現在英語でのみご利用いただけます。
AI Governance Board Reporting: What to Include, How Often, and What Good Looks Like
Board AI governance reporting is evolving from occasional technology briefings to structured risk reporting. What regulators and institutional investors expect to see in board AI governance reports — and a template for what good looks like.
Key Takeaways
Board AI governance reporting should occur at minimum quarterly — more frequently during periods of significant AI deployment activity or regulatory change.
Effective board AI governance reports are structured around risk, not technology — the board needs to know what AI risks exist and how they are being managed, not how the AI systems work.
The five components of a board AI governance report: AI system inventory summary, risk register update, regulatory and legal update, incident and near-miss summary, and governance programme status.
The board should be asking specific questions that demonstrate active oversight — not just receiving reports — and those questions and the responses should be minuted.
Institutional investors and proxy advisors are beginning to assess AI governance quality as part of ESG evaluation — board-level AI governance reporting is increasingly a disclosure expectation.
"情報提供のみを目的としています。この記事は法律、規制、財務または専門的なアドバイスを構成するものではありません。具体的なアドバイスについては、資格を持つ専門家にご相談ください。"
What boards actually need in AI governance reports
AI risk has moved firmly into board reporting cycles. APRA's 30 April 2026 industry-wide letter to regulated entities established board AI literacy as a minimum expectation. The EU AI Act elevates AI governance to board-level responsibility for in-scope organisations. ASIC's October 2024 REP 798 specifically named board AI oversight gaps. The Federal Reserve's SR 26-2 (17 April 2026) on model risk management applies to AI/ML at large US banks. Most modern AI governance failures begin with poor board reporting — either because boards aren't seeing the right information, or they're seeing too much detail to act on.
This article provides a practical template for AI governance board reports, structured for monthly or quarterly cadence. The template balances coverage (so boards see the risks) with brevity (so they can actually engage with what they see).
Section 1: Executive summary (one page)
Every AI governance board report should start with a single page covering: total AI systems in production (count, broken by risk tier); changes since last report (additions, decommissions, material updates); status against key risk indicators (KRIs) and risk appetite (RAG status); material incidents since last report (count, severity, status); upcoming regulatory deadlines (with named owner); key decisions requested of the board.
The executive summary should be readable in 90 seconds. If it requires more, you've already lost the board's engagement. Detail belongs in appendices.
Section 2: AI system inventory and risk classification
Boards need confidence that the organisation knows what AI it operates. Report on:
Total AI systems in production, broken into risk tiers (typically High Risk, Elevated Risk, Standard Risk). For each tier: count, change since last report, status of governance documentation, validation status.
High Risk system list — name, business purpose, business owner, risk classification rationale, key controls, validation date, next validation due. For organisations with material EU exposure, also AI Act classification (Annex III category) and conformity assessment status.
Vendor concentration — material AI vendor dependencies, contracted SLA performance, contractual coverage status (CPS 230, DORA, AI Act provisions), exit planning status for highest-concentration vendors.
Section 3: Risk appetite and key risk indicators
The board has approved an AI risk appetite statement (if it hasn't, this is item one for the next board meeting). Report against the appetite:
KRI dashboard — typically 5-10 KRIs covering: model performance against accuracy/error thresholds; bias monitoring (demographic outcome gaps); data quality indicators (drift, missing data); incident frequency and severity; vendor SLA performance; regulatory and compliance breach indicators. Each KRI shows current value, threshold, trend, RAG status.
KRI breaches — any KRI that triggered review since last report, what was done, status of remediation.
Risk appetite alignment — for material AI systems, whether their operating profile sits within board-approved appetite. Material misalignment requires either control change or appetite adjustment, both board-level decisions.
Section 4: Incidents and near-misses
Boards need to know what has gone wrong, what was learned, and what changed. Report:
Incident summary — all material AI incidents since last report. For each: brief description, systems involved, customer/regulatory impact, root cause, remediation, learning applied, status.
Near-miss summary — significant near-misses (issues caught before customer/regulatory impact). Near-misses are often more useful than incidents for understanding control gaps because they reveal where defences worked.
Concerning answer for boards: "We haven't had any significant issues this quarter." Distinguish between genuine absence of incidents and absence of incident detection. The right question to test this: "what monitoring identified that no issues occurred?"
Section 5: Regulatory and compliance landscape
AI regulation moves quickly. Boards need a curated view of what matters to them:
Regulatory developments since last report — new guidance, enforcement actions, court decisions relevant to the organisation. For Australian entities: APRA, ASIC, OAIC, ACCC. For EU: EU AI Act implementation, EU AI Office actions, national regulator developments. For UK: ICO, FCA, MHRA, Ofcom. For US: SR 26-2 (Fed/OCC/FDIC), FTC, CFPB, EEOC, state laws (California, Colorado, Illinois, Texas, New York). For multi-jurisdiction operations, only material developments — not exhaustive coverage.
Compliance status — for in-scope regulations, status of organisational compliance. EU AI Act Article 4 literacy obligation (in force February 2025). EU AI Act Annex III high-risk obligations (December 2027). APRA CPS 230 (1 July 2025 in force; 1 July 2026 amendments). DORA ICT third-party provisions (17 January 2025).
Upcoming deadlines — named regulatory deadlines in the next 3-12 months with named owner and current status.
Section 6: Third-party AI vendor risk
Most AI risk now sits in third-party vendor relationships. Report:
Material vendor changes — new material AI vendors, terminated relationships, material contract changes, ownership/control changes affecting vendors.
Vendor incidents — incidents reported by AI vendors (model behaviour issues, security incidents, regulatory enquiries). Vendor incidents that don't directly affect the organisation often signal future risk.
Concentration risk assessment — top-three AI vendors by criticality, contingency planning status, alternative provider assessment, exit feasibility.
Section 7: Board decisions required
This section is what makes the report operational. Each board AI report should end with: decisions the board is asked to make this meeting; decisions deferred from previous meetings; matters for board awareness only (no decision required).
Typical board decisions: new material AI deployment approval; risk appetite changes; material vendor contract approval; incident response approvals exceeding management authority; resource allocation decisions for AI governance programme.
Cadence and document discipline
Most large organisations operate AI governance reporting at quarterly board cycle, with monthly risk committee reporting (the operational layer). For organisations with material AI risk, monthly board-level summary plus quarterly deep dive is appropriate. The cadence should reflect the risk; AI is a fast-moving area and "annual review" is generally inadequate.
Length discipline. Most board AI reports should be 10-20 pages including appendices, with 1-page executive summary front and back. Material that's too detailed to read won't be read.
Pre-read time. Material should be circulated at least 5 working days before the meeting to give board members reading time.
Director engagement. Report content should be drafted to support director engagement — not just inform, but enable challenge. APRA's expectation is "effective challenge" — boards need information structured to facilitate that.
What boards should ask when reviewing AI reports
Strong AI governance reports invite strong board questions. Boards reviewing an AI report should test: do we have an AI inventory we trust? Are our material AI dependencies on regulated paths (AI Act conformity assessment, CPS 230 contracts, DORA arrangements)? Are our KRIs measuring the right things, and are they actually triggering review when they should? Are our incident detection mechanisms genuinely catching issues, or are we missing them? Do our vendor relationships create defensible concentration risk profiles? Is our AI literacy at board level adequate for the decisions we are being asked to make?
For organisations starting from a low base, the existence of a structured board AI report is itself an indicator of maturity. The first iterations may be imperfect — that is acceptable. What matters is that the discipline of board-level AI reporting is established.