AI Literacy for Boards: 37 Essential Questions Every Non-Executive Director Must Ask About AI
Corporate boards around the world are increasingly focused on AI. Yet, they remain uncertain about how to prioritise it on their agendas and address AI technologies as a core governance responsibility. Regulators, investors, and customers start asking pointed questions about how AI is used, audited, and controlled. Here, I present fundamental questions that any board should consider asking about how their companies address AI and Machine Learning. The goal is not to transform directors into data scientists, but to provide them with a practical starting point. Since I am based in Europe, a region that has already fallen behind in AI, I include several questions to help directors contemplate their geopolitical technology choices.
1. Data Strategy and AI Appetite
- 1.1. What is our data strategy, and how does it increase our overall competitiveness?
- 1.2. What problems do we solve with the help of ML and AI? In what business function/ product domain/ administrative task?
- 1.3. Do we understand the value of data assets in the overall valuation of our company?
- 1.4. Do we understand how digital assets affect our competitors’ valuations?
- 1.5. Did we define the ambition for the role digital assets should play in 3 to 5 years?
- 1.6. Is our data strategy aligned with our annual business objectives?
- 1.7. Where does AI fit into our overall data strategy, and are business problems clearly articulated?
- 1.8. What are initiatives to align with the rest of the industry on anything AI and ML?
2. AI, GenAI, and ML Deployment
- 2.1. How are AI and ML deployed across our organisation?
- 2.2. Do we have a testing environment/geographies/ line of businesses for piloting AI and ML pilots?
- 2.3. What percentage of completed AI projects can be successfully updated and maintained in-house?
- 2.4. Do we fully understand the costs of deploying an ML or any other AI solution?
- 2.5. What is our cost to prepare data for processing? Do we understand what drives these expenditures?
- 2.6. What capex vs opex do we plan for to increase our AI capabilities? How do we stress-test these figures?
- 2.7. What is our AI vendors’ policy?
- 2.8. Do all employees in procurement and all business unit leaders understand how to interview vendors to separate good from bad?
- 2.9. What is our policy to track vendor performance, ensure their regulatory compliance (e.g., product liability in the EU), and their IP frameworks in case of co-creation of AIs?
3. Geopolitical considerations
- 3.1. How do AI trends in the US vs China affect our competitive positioning, supply chain, and ability to operate across global markets?
- 3.2. To what extent are we dependent on US and/or Chinese technology, data infrastructure, and tools?
- 3.3. What are our capex costs if we are required to remove Chinese technologies from our networks, e.g., Huawei technology from the networks of the European telcos
- 3.4. What are the risks and benefits of aligning with US-led vs. China-led tech. stacks?
- 3.5. Are we cultivating board-level geopolitical expertise and ensuring ongoing director education to keep pace with the changing landscape of AI development, deployment, and regulation in the US vs. China (incl. the role of tariffs on old semiconductors for pricing of automotive products, as an example)?
- 3.6. Have we mapped all AI systems in use and development to ensure compliance with regulation, e.g., EU AI Act?
- 3.7. What are our lobbying efforts around digital technologies in Brussels vs. Washington DC, if any?
4. Cybersecurity
- 4.1. Do we understand how AI and ML affect our cybersecurity defences?
- 4.2. Do we understand how our vendors and partners address AI when it comes to optimising their cybersecurity risk scores?
- 4.3. Do we understand how GenAI enables cybercriminals to attack, and is our organisation educated on the impact of LLMs in attacks?
5. AI and Workforce
- 5.1. What portion of our AI projects and initiatives are led by internal teams vs external consultants?
- 5.2. How do we decide which AI tasks are outsourced to consultants, and which are retained in-house?
- 5.3. Do we have a formal policy and strategy guiding our use of AI consultants vs building internal capabilities?
- 5.4. How do we ensure our internal teams upskill to become more data-driven and enable them to formulate hypotheses for automation and the use of AI?
- 5.5. What new job families did we introduce in businesses to accommodate the utilisation of AI and ML technologies?
- 5.6. What steps are we taking to grow our AI talent?
- 5.7. What percentage of the workforce do we need to replace with automation and AI due to retirement and the age structure of the workforce, if any? Do we understand the demographic profile of our business three, five, and ten years from now?
- 5.8. How do we ensure our industrial domain expertise grows while we digitise and work on prospective AI solutions?
6. AI Literacy and trainings
- 6.1. What is the AI Literacy roadmap in our company to educate employees about AI? (example, Munich Re)
- 6.2. How do we cluster AI literacy initiatives for different groups of our employees (and, possibly, vendors and partners)? What are the basics for everyone, and what are the deviations depending on the domain and function?
- 6.3. What is our policy for the entry-level jobs, and how do we address the knowledge gap of the out-of-school or out-of-university employees, in case entry-level tasks get transferred to generative AI?
- 6.4. What is our AI Literacy roadmap to ensure there is no knowledge gap due to the retiring workforce, and how do HR roadmaps and AI/Automation roadmaps align to manage knowledge, re-engineer processes to increase productivity, and keep operations going on despite the retirement of skilled people