Does the board need to approve AI use?

The board typically approves the policy that governs AI, not each tool. Management approves individual tools and uses under that policy and reports to the board on what is in use, the risks, and any issues.

How often should the board hear about AI?

A substantive first briefing, then a short update at the cadence your board uses for other technology and risk topics — often quarterly — plus prompt notice of any significant AI-related incident.

Should directors receive AI training?

A short education session helps directors ask good questions: what generative AI does well and badly, where the institution uses it, and what can go wrong. Directors do not need technical depth, but they do need enough to challenge management.

What questions should directors ask management about AI?

What AI do we use and who owns it? What customer or member data does it touch? How do we review its output? Which vendors provide it? What would we do if it failed? How do we know staff follow the policy?

Guide · People & Governance · CEOs, executive teams, and board secretaries

How to brief your board on AI

What a community bank or credit union board needs to hear about AI, what to leave out, and a one-page structure for the first briefing and the quarterly update.

Most board AI briefings fail in one of two directions. Either they are a vendor-style tour of what AI can do, which leaves directors impressed and no better equipped to oversee it. Or they are a list of risks with no sense of proportion, which leaves directors anxious and inclined to say no to everything. Neither helps the board do its job.

The board's job here is the same as everywhere else: set direction, approve the policy, and hold management accountable. A good briefing gives directors exactly what they need for those three things.

The first briefing: one page, five sections

1. Where we use AI today. The honest list, from your AI use case inventory — including AI embedded in vendor products. Three columns: what it does, who owns it, and its risk tier.

2. How it is governed. The policy that covers it (or the plan to adopt one), who approves new uses, the rule on customer and member data, and how output is reviewed before it reaches anyone outside the building.

3. The risks that matter for us. Not a generic list. The three or four that apply to your actual uses: data leaving the institution through unapproved tools, vendor AI changing without notice, inaccurate output reaching a customer, and any AI touching credit decisions.

4. The opportunity, in plain numbers we can stand behind. Where AI is saving staff time or could, described as specific workflows. Avoid projections you cannot source; directors remember them.

5. What we are asking the board for. Approval of the policy, comment on the risk appetite, or simply acknowledgment. Be explicit.

What to leave out

Industry hype. Demos. Technical architecture. Peer comparisons you cannot source. And anything that implies the board should approve individual tools — that is management's job, under a policy the board approves.

The quarterly update

After the first briefing, keep it to half a page:

Changes to the AI inventory since last quarter
New tools or uses approved, and anything declined
Incidents, complaints, or near misses involving AI
Policy exceptions granted
Training completed
Anything regulators said or asked about AI

If nothing changed, say so in one line. Consistency matters more than length; a governance trail is built from short, regular entries.

Why examiners will care

The CSBS AI Supervisory Framework gives state examiners procedures for governance and oversight of AI. Board minutes that show directors were briefed, asked questions, and approved the policy are part of the evidence of that oversight. Our board briefing checklist gives you the facts to gather, the motions to put to the board, and the evidence to keep after the first briefing. The CSBS framework is written for state-chartered banks; federally chartered banks and credit unions should expect similar governance questions from their own examiners.

Questions directors should be asking

Share these with your board so they know what good oversight sounds like:

What AI do we use, and how do we know the list is complete?
What customer or member information does it touch?
Who reviews AI output before it reaches a customer or member?
Which vendors provide our AI, and what did we learn in diligence?
How do we know employees follow the policy?
What would we do if an AI tool failed or produced something harmful?

A management team that can answer these crisply is in good shape. One that cannot has its next quarter's work plan.

Common questions

Does the board need to approve AI use?: The board typically approves the policy that governs AI, not each tool. Management approves individual tools and uses under that policy and reports to the board on what is in use, the risks, and any issues.
How often should the board hear about AI?: A substantive first briefing, then a short update at the cadence your board uses for other technology and risk topics — often quarterly — plus prompt notice of any significant AI-related incident.
Should directors receive AI training?: A short education session helps directors ask good questions: what generative AI does well and badly, where the institution uses it, and what can go wrong. Directors do not need technical depth, but they do need enough to challenge management.
What questions should directors ask management about AI?: What AI do we use and who owns it? What customer or member data does it touch? How do we review its output? Which vendors provide it? What would we do if it failed? How do we know staff follow the policy?