Talking to your board or investors about AI

What a board actually needs to hear about AI, how to present progress without hype, and the questions to be ready for.

3 minread 755words last updated

The short answer

A board or an investor group needs three things on AI, and almost every question they ask is a version of one of them. Where is it being used in this business, by whom, and on what data. What has it returned, measured against a baseline, and what has it cost. And what could go wrong, with what mitigations. Presenting those three in one page each quarter prevents both failure modes: the hype deck that promises transformation and creates expectations nobody can meet, and the silence that suggests management is not paying attention to something the board reads about constantly. Numbers carry the discussion better than narrative, so bring hours saved, cost per task, error rates and cycle times with the baseline and the method stated, including the ones that did not move. And have the risk answers prepared, because the questions about data, dependency, compliance and vendor behaviour will come, and hesitating on them is what turns a routine update into an agenda item.

The one-page update

SectionWhat it containsLength
Where AI is usedThe register: process, owner, data touched, whether it affects peopleA short table
ResultsMeasure, baseline, current, change, for each use, including the flat onesA short table
SpendSubscriptions, usage, project cost, against budgetTwo lines
RisksTop three with mitigation and owner; any incidents since last timeThree lines
GovernanceAI Act classification where relevant, data decisions, policy changesTwo lines
Next quarterWhat is planned, why that, expected measureThree lines
Deliberately not doingWhat you have decided to skip and whyTwo lines

Preparing the conversation

  1. Keep the register current so the first question is answered before it is asked.
  2. Measure baselines before projects, and report the misses alongside the hits.
  3. Know your spend by line, including the AI features bundled into existing subscriptions.
  4. Prepare two-sentence answers to the standard risk questions.
  5. Have a competitor view based on what you can actually observe, and say where you are guessing.
  6. State what you are not doing and why; deliberate restraint reads as strategy, silence reads as drift.
  7. Escalate the real governance items early: anything touching decisions about people, significant data decisions, incidents.

When the board pushes for more ambition

Sometimes the pressure is to do more, faster, because a competitor announced something. The useful response is the sequence: here is what we automated, here is what it returned, here is the data and process work that makes the ambitious thing possible, and here is when it becomes sensible. Boards respond well to a plan with evidence behind it. If the ambition is genuinely warranted and under-resourced, say what it would take in money and people, and let the board decide with real numbers rather than pressing for enthusiasm.

What this means for you

Give your board one page each quarter: where AI is used, what it returned against baselines, what it costs, the top risks and incidents, and what is next and deliberately not next. Measure before you start, report the misses, prepare two-sentence answers to the standard risk questions, and escalate governance items early. It prevents both hype and silence, and it makes the AI conversation a routine item rather than a recurring source of anxiety.

Written by the CivSec S.M.A.R.T team

We build and run websites, software and AI systems for businesses. We write about what we see in that work, in plain language, and we update articles when things change.

Last checked . Spotted something outdated? Tell us.

Frequently asked questions

What should an AI update to the board contain?

One page: the register of where AI is used and by whom, the measured results against baselines, the current spend, the top three risks with mitigations, and what is planned next quarter with the expected measure. If there is a significant governance item, AI Act classification, a data decision, an incident, it goes on the same page. Fifteen minutes of discussion beats a thirty-slide deck.

Our board keeps asking why we do not have an AI strategy. What do we say?

Show them the register and the results, and describe the sequence: which processes are automated, what it returned, what is next and why, and what you are deliberately not doing. That is a strategy. What they usually mean by the question is that they have not been told anything, and a one-page update every quarter ends it. If the honest answer is that AI is not a priority this year because something else matters more, say that with the reasoning; boards accept deliberate choices.

What questions should we be ready for?

What are competitors doing, and how do you know. What would happen if your main AI vendor doubled prices or changed terms. Where is customer data going. What is the biggest AI risk to this business and what are we doing about it. How much are we spending and on what. Have you had any incidents. Are any decisions about people being made by machines. Prepare a two-sentence answer to each and the meeting goes well.