Board assurance pack
Boards increasingly ask a direct question: are we governing our AI, and can we prove it? This guide produces a concise, defensible board pack that answers it from live records rather than a hand-assembled slide deck.
When to use this
Section titled “When to use this”You need to brief a board, risk committee or executive on AI governance posture, and you want a view that is concise for leadership yet traceable back to evidence.
What you will produce
Section titled “What you will produce”A board pack covering AI inventory, risk picture, evidence quality, open findings, remediation progress and readiness priorities, every figure traceable to its underlying records.
- Confirm the inventory is current. Check AI System Records is complete, running a discovery sprint first if coverage is in doubt. A board view is only as honest as the inventory beneath it.
- Confirm tiers and assessments. Make sure systems have been through intake and risk tiering and that material systems carry an assessment.
- Surface findings and remediation. Review open findings and the Remediation Roadmap, including overdue items, so the board sees real status, not a clean fiction.
- Generate the pack. In reporting, produce a Board pack or Board summary: it composes inventory, risk, estate, evidence quality, findings, decisions and roadmap into a leadership view, with agentic posture included where relevant.
- Keep it defensible. Because the pack is generated from connected records and carries run-level traceability metadata, any figure can be followed back to its evidence if challenged.
- Optionally accelerate the narrative. Use the AI Consultant’s Board Summary mode to draft executive narrative grounded in the same records.
Board quality checklist
Section titled “Board quality checklist”- Coverage denominator, unassessed estate and inventory limitations are visible.
- High and critical exposure, overdue findings and accepted risks are not averaged away.
- Trend changes distinguish scope, completion and genuine control improvement.
- Agentic runtime posture and material incidents are included where relevant.
- Each requested board decision has an owner and deadline.
- Pack ID, cutoff date, source workspace and reviewer are recorded.
Review AI-drafted narrative against the source records. Regenerate the pack after material changes; do not edit an old export into a new reporting period.
Modules and frameworks involved
Section titled “Modules and frameworks involved”reporting, AI System Records, intake & risk tiering, evidence & findings, Remediation Roadmap and the AI Consultant.
- Shadow-AI discovery sprint: make the inventory honest first.
- EU AI Act readiness: a common board-level readiness question.
- Scenario guides: the full set.