Before the briefing — context
Four items the board needs to understand the room you’re in.
- Where the institution stands on AI readiness today (named score or qualitative read).
- How peer institutions are positioned (sourced — FDIC bank-find, peer-cohort data).
- Which regulators apply (SR 11-7, ECOA / Reg B, Interagency TPRM, BSA/AML, applicable state guidance).
- What the board has already approved that may touch AI (tech budget, vendor list, risk appetite statement).
During the briefing — the decisions
Four items framed as decisions, not status updates.
- Scope: what use cases are in (named) and what use cases are explicitly out.
- Risk tolerance: what classes of data are allowed through AI tools, signed off by the board.
- Governance: who owns the AI use case inventory, who chairs the AI review forum, what cadence.
- Investment: what is being funded this cycle, what is being deferred.
After the briefing — evidence
Four items the board should expect to see at the next briefing.
- The AI use case inventory — what we are running, who owns each, what tier of risk.
- Incident log — anything flagged since the last briefing.
- Compliance review readiness — what we can show an examiner today.
- A scorecard against the AI readiness baseline — what moved, what didn’t.