The AI Board Briefing Checklist

The board’s job, in one sentence

The board does not need an AI tutorial. It needs to approve or endorse the risk envelope, confirm the data line, assign accountable oversight, authorize management to run one controlled pilot where appropriate, and receive evidence next quarter. Run the briefing as four decisions, not a status update.

Before the briefing: four facts

Ground the room before asking for decisions. Put these four facts on one slide or in the first paragraph of the memo.

• [ ] Readiness baseline - "Our AI readiness score is [X/48]; the biggest gap is [governance / data handling / vendor oversight]." If no score exists, take the 10-minute AI Readiness Scorecard before the meeting and use it as the baseline.
• [ ] Peer context - "Industry surveys suggest many organizations are still formalizing AI governance; this briefing moves us from informal exploration to documented oversight." Use only size-segmented statistics if you can cite the exact source in the board packet.
• [ ] Regulatory and control lenses - current model-risk guidance where AI informs quantitative or customer-impacting decisions; Interagency Third-Party Risk Management for AI vendors; GLBA/customer-information safeguards for data handling; ECOA / Regulation B for credit and adverse-action use cases; BSA/AML and SAR confidentiality for financial-crime workflows; Treasury/FSSCC AI terminology and risk-management resources.
• [ ] Already approved - what the board has already signed that touches AI: tech budget, vendor list, risk-appetite statement, information-security program, model-risk framework, or digital strategy. Build on the record; do not reopen it.

During the briefing: four motions

Bring motions with a recommended position, not open questions. The defaults below establish a conservative starting envelope; adapt them to the institution’s charter, authority matrix, risk appetite, and vendor stack.

• [ ] Scope motion - approve AI for internal drafting, research, summarization, and workflow support inside approved tools; keep customer-facing, credit, fraud, BSA/AML, sanctions, regulatory reporting, and adverse-action use cases out of scope pending dedicated review.
• [ ] Data-line motion - "No customer NPI, account data, examination-sensitive information, SAR/AML information, privileged material, or security-control data may be entered into public AI tools. Confidential institution data may be used only in approved enterprise AI tools, for approved use cases, under contract terms covering data use, model training, retention/deletion, access controls, logging, subcontractors, breach notice, audit rights, and ongoing monitoring."
• [ ] Ownership motion - designate one accountable executive to own the AI use-case inventory, exceptions log, policy review cycle, and board reporting cadence. A committee can govern, but a named person owns the record.
• [ ] Controlled-pilot motion - authorize management to run one controlled pilot within delegated authority, or approve funding/authorization where board approval is required. One department, one use case, one success metric, named reviewer, and next-quarter evidence.

Copy-paste: the one-page board memo

Drop this into your board packet and fill the brackets. Six lines is enough for most community-institution boards.

1. Position: "[Institution] is adopting AI deliberately. Today we use it for [internal drafting / research]; we do not use it for [credit decisions / customer messaging]."
2. Decision requested: approve or endorse the four motions above - scope, data line, ownership, and controlled pilot.
3. Risk posture: “All AI output is draft work; a named human reviews anything that reaches a customer, examiner, or regulated process (human-in-the-loop).”
4. Credit control: "AI will not be used to make, explain, or rubber-stamp credit or adverse-action decisions unless Compliance confirms the reasons are specific, accurate, and traceable to factors actually considered."
5. Oversight: "[Owner] maintains the AI use-case inventory and reports quarterly - tools in use, incidents, training completion, vendor status, and progress against our readiness baseline."
6. The ask: a motion to adopt or update the AI Use Policy, approve the data line, and authorize the controlled pilot within the approved risk envelope.

After the briefing: four evidence items

Tell the board now what you will show them next time, so oversight is a habit, not a fire drill.

• [ ] AI use-case inventory - what we run, who owns each use case, its risk tier, tool/vendor, data class, reviewer, approval date, and next review date.
• [ ] Incident and exception log - anything flagged since the last briefing, including attempted public-tool use with restricted data; "none" is still an evidence point if the monitoring process exists.
• [ ] Exam-readiness packet - current AI policy, inventory, data-line guidance, vendor reviews, training records, model-risk or human-review evidence where applicable, and board reporting trail.
• [ ] Scorecard progress - readiness baseline, what moved, what did not, overdue actions, and the next quarter’s control priorities.

What good looks like — and the three mistakes to avoid

A strong AI board decision is specific. Watch for these failure patterns:

• Don’t approve “explore AI” with no scope — that is the decision examiners read as “no governance.”
• Don’t leave the owner as a committee — name a person, with quarterly reporting.
• Don’t skip the data line — staff pasting customer data into public tools is the highest-risk gap; the board should prohibit it in writing.
• Don’t present model-risk guidance as a blanket answer for generative AI. Map generative AI governance to data controls, third-party oversight, human review, risk appetite, and use-case-specific model-risk principles where applicable.

Next step: AI Board Briefing Prep Session

Use this checklist to prepare a 30-minute board-ready AI rollout memo, define the AI data line, choose one controlled pilot, and set the evidence package for next quarter.

• Before the session: complete the AI Readiness Scorecard or bring the current readiness baseline.
• During the session: draft the board memo, select the pilot, and confirm the owner, reviewer, data boundary, and reporting cadence.
• After the session: package the board memo, four motions, pilot charter, AI use-case inventory row, and next-quarter evidence list.