Governance Toolkit / AI and technology oversight
AI and technology oversight · Editable Word document · FreeAI Use Policy: Board Questions (Word)
Questions directors can ask when management presents an AI use policy: inventory, ownership, limits, compliance, vendors and incidents.
Version 1.0 · Last updated
What it is
Questions directors can ask when management presents an AI use policy: inventory, ownership, limits, compliance, vendors and incidents. It is a plain Word file you can edit, brand and adapt.
Who it's for
Chairs, founders.
When to use it
Use it when management brings an AI use policy to the board for review, or when the board first takes up AI oversight. Use these questions when management brings an AI use policy to the board for review, and at least once a year after that. They are designed to test whether the policy is understood, owned and working, not to have the board write the policy itself. Choose the questions that fit your organization; not every board needs all of them.
How to use it
- Work through each section before the meeting or event the checklist covers.
- Mark what is in place and assign an owner and date to anything that is not.
- Keep the completed checklist with the board's records and revisit it at the next review.
Preview of contents
- 1. Inventory and scope: Where do we use AI today, including in tools and vendor products we buy? How was that inventory compiled, and how is…
- 2. Ownership and accountability: Which executive owns the AI use policy, and how do they report to the board?
- 3. What the policy permits and prohibits: Which uses are permitted, which need approval, and which are prohibited? Can management give examples of each?
- 4. Risk and compliance: Which laws and regulations apply to our AI use, including privacy law, sector rules, state laws and, where relevant, the EU AI…
- 5. Vendors and third parties: How do we assess AI built into vendor products, and what do our contracts say about data use, training and liability?
- 6. Incidents and escalation: What counts as an AI incident, such as a harmful output, data leakage or a model failure?
- 7. Value and strategy: How does our AI use connect to strategy, and how do we measure whether it delivers the expected value?
- 8. Training and culture: How are employees trained on the policy, and how do we know they follow it?
Get the template
Download the templateWord (.docx), 37 KB
Check your inbox for the download link.
Review with counsel before adoption. Templates are general resources, not legal advice.