Boards and the governance artifact: the seven questions every director should be asking.

This briefing is written for chairs of audit and risk committees who have been asked to set AI governance for an institution that does not, at the moment of the request, have a governance artifact in place. The seven questions described in the body are the questions that, asked of management, distinguish a governance artifact that will survive the next platform cycle from one that will not. The questions are not the only questions a board should ask. They are the minimum.

01What the board is being asked to govern

The board, in the AI governance context, is being asked to govern three distinct things, and the failure mode we have observed most often is the conflation of the three. The first is the strategy: the description of what you intend to do with AI over a defined horizon. The second is the operating model: the artifact specifying how the strategy is executed, instrumented, and escalated. The third is the architecture: the technical implementation through which the strategy runs.

The board's primary governance object is the second, not the first or the third. Boards are not equipped to govern the architecture, and the strategy is the artifact the board approves rather than the artifact the board governs. The operating model is the artifact through which the strategy is held accountable, and the seven questions below are written against it.

02The seven questions

Question 01. What are the named kill criteria for each tier of the portfolio?

A kill criterion is an instrumented condition under which management is required to either rewrite the strategy or terminate the program. The board should be able to read the criteria, in writing, for each tier. If the criteria are not named, instrumented, and continuously measured, the operating model does not have the discipline to absorb a workload shift, and the board has no leading indicator that the strategy is failing.

Question 02. What is the escalation path from a kill-criterion breach to a decision?

The path should be written, calendar-independent, and capable of moving inside 72 hours. If the path requires a board agenda item to reach a decision, the path is calendar-dependent, and the board calendar will not move at the cadence the unit economics now require.

Question 03. Where does the rewrite trigger sit?

The rewrite trigger is the authority to rewrite the strategy in response to a workload shift. If the trigger sits at the board, the strategy will not be rewritten between board meetings, and the operating model will, in the interval, run against a strategy that no longer fits. The trigger should sit below the board, on a delegated authority that the board has explicitly authorized to act inside the meeting cycle.

Question 04. Who maintains the runtime audit trail, and to whom do they report?

The runtime audit trail records what the system did. The governance artifact records what the system was permitted to do. The two should be maintained by separate teams reporting through separate lines, and the board should be able to name both.

Question 05. What is the vendor concentration ratio, and what triggers a forced architectural review?

Vendor concentration above 40 percent on a single provider is, on the evidence of every portfolio we have studied, a leading indicator of a forced renegotiation in the next workload-shift cycle. The board should know the ratio, the threshold, and the named architectural pattern that you will move to in the event of a breach.

Question 06. What is the per-transaction unit economic, and how is it trending?

The per-transaction unit economic is the metric most highly correlated with portfolio drift. The board should see it, in writing, on every meeting agenda, with a written explanation of the trend across the most recent four quarters and a written explanation of any deviation from the originally approved envelope.

Question 07. What is the date of the most recent rewrite of the operating model, and what triggered it?

An operating model that has not been rewritten in 18 months is, on the evidence of the workload composition shifts of the last three years, almost certainly out of fit with the workload it is governing. The date of the most recent rewrite, and the trigger that caused it, are leading indicators of the discipline of the operating model.

03The board calendar problem

The board calendar, in most institutions, runs on a quarterly cadence. The unit economics of an AI portfolio in 2026 do not. The interval between a workload composition shift and the moment at which the unit economics break is, on the evidence of the 17-portfolio dataset, somewhere between six and 20 weeks. The interval between a quarterly board meeting and the next one is, by construction, 12 to 14 weeks. The board calendar is, against this trajectory, structurally incapable of governing the unit economics directly.

The board does not need to govern the unit economics. The board needs to govern the operating model that governs the unit economics, and to make sure that the operating model is authorized to act between meetings. Briefing note, audit committee, global insurer, fourth quarter 2025

04What the next 12 months require

For boards setting governance from a standing start, the sequence we recommend is the following. The first 90 days are spent writing the operating model and the kill criteria. The second 90 days are spent instrumenting the criteria against the existing portfolio. The third quarter is spent rewriting the escalation path and explicitly delegating the rewrite trigger. The fourth quarter is spent in the first dry run of the path, with a deliberately simulated breach used to test that the artifact actually moves at the cadence the unit economics require.

None of the four steps is technologically novel. Each is the operating discipline that, on the evidence of the benchmark, distinguishes institutions that have absorbed the last three years cleanly from institutions that have not.