Board Questions to Ask Management About AI Risk

1. What’s Our Definition of “High-Risk AI,” and Where Are We Using It?

Most boards discover their AI exposure by accident. Management deploys models in customer-facing systems, hiring, credit decisions, or supply-chain optimization without a formal definition of what constitutes high-risk use.

What to listen for:

• A clear taxonomy (not “we avoid risky AI” but “we classify AI by impact: customer-facing, employee-facing, financial, regulatory”)
• Specific examples: “We use AI for resume screening in hiring, so that’s flagged as high-risk due to discrimination liability”
• A registry or inventory, not a vague sense

Red flag: “We don’t really have high-risk AI” or “Our data scientists handle that.” If management can’t articulate it, they haven’t governed it.

Why this matters: Regulators (MAS, SGX, PIC) are moving toward AI governance requirements. Boards that can’t name their high-risk AI can’t demonstrate due diligence. Liability and reputational risk follow.

2. How Do We Test AI Models for Bias, and Who’s Accountable?

AI bias isn’t a technical problem it’s a governance problem. Biased hiring models, discriminatory pricing, or unfair lending decisions create legal and regulatory exposure.

What to listen for:

• Who owns bias testing (Data Science, Compliance, Risk, or all three?)
• What does testing actually cover (disparate impact, protected classes, fairness metrics)?
• How often (before deployment, quarterly, continuously)?
• What’s the escalation path if bias is found?

Red flag: “Our data scientists test it” or “We use a third-party tool.” Without clear ownership and a defined process, testing doesn’t happen consistently.

Why this matters: Regulators in Singapore, Malaysia, and globally are enforcing AI fairness. Litigation over algorithmic discrimination is rising. A board that can’t describe bias controls can’t defend the decision to deploy.

3. If an AI Decision Goes Wrong, How Do We Explain It?

Explainability is both a regulatory requirement and a business risk. Imagine a customer lawsuit over a credit decision, a hiring discrimination claim, or a regulatory investigation. Can management explain why the AI said no?

What to listen for:

• A distinction between explainability (can we explain it?) and interpretability (can we understand why it decided that?)
• For high-risk models: a human-in-the-loop process or override capability
• Documentation: audit trails, model cards, decision logs
• Third-party audit or model governance

Red flag: “It’s a black box, but it works.” Or “We’re still figuring that out.”

Why this matters: Upcoming AI Act-style regulations (Singapore’s AI governance framework, PDPA amendments) will require explainability for high-impact decisions. Courts and regulators already expect it. A board without explainability controls owns the reputational and legal fallout.

4. What’s Our Process for Retiring or Updating AI Models?

Most conversations focus on deploying AI. Boards should focus on what happens when the model becomes obsolete, underperforms, or is found to be biased.

What to listen for:

• A sunset timeline (e.g., “we review high-risk models annually”)
• What triggers a model review (performance drop, regulatory change, new bias discovery)
• A decommissioning plan (not just “turn it off” but “how do we migrate customers, update decisions made under the old model”)
• Ownership (who decides to retire a model?)

Red flag: “We haven’t thought about that” or “The models just keep running.”

Why this matters: Legacy AI systems create compounding liability. A model that’s 3 years old and no longer audited is a governance failure. Regulators see this as negligence.

5. How Do We Ensure Our Third-Party AI Vendors Comply With Our Governance Standards?

Most high-risk AI isn’t built in-house—it’s embedded in third-party platforms: cloud AI services, vendor models, APIs, or outsourced ML operations.

What to listen for:

• A vendor risk assessment for AI specifically (not just general vendor management)
• Contractual clauses covering bias testing, explainability, data handling, audit rights
• Periodic audits or assessments
• A backup or exit plan if a vendor fails to meet standards

Red flag: “We trust the vendor” or “They’re SOC 2 certified, so we’re fine.” SOC 2 doesn’t cover AI governance or bias.

Why this matters: Third-party AI risk is regulatory risk. MAS and SGX guidance expect boards to oversee outsourced AI. A board that can’t describe its vendor controls can’t demonstrate due diligence.

FAQ Section

Q: Aren’t these questions too technical for a board?
A: No. A CEO or CFO should be able to answer these. If they can’t, that’s a governance gap. You’re not asking how the model works—you’re asking how it’s governed.

Q: We use AI, but it’s not high-risk. Do we still need these controls?
A: Start with high-risk models. But regulators and courts are moving toward “all AI” governance, so build the habit now.

Q: Our data scientists already handle this. Why involve the board?
A: Data scientists own implementation; boards own risk and accountability. These are different jobs. Both are necessary.