Skip to main content
AI-Si.com
RiskGovernance

Board-Level AI Risk Reporting: What to Put in Front of Directors Every Quarter

Board-Level AI Risk Reporting: What to Put in Front of Directors Every Quarter
Published 18 August 2026Last reviewed 18 August 20266 min readBy Simon Steggles· Fractional AI Director
Who this is for:UK SME and public sector boards and directors setting up AI risk oversight.

TL;DR

Most boards get an AI slide once a quarter that tells them nothing they can act on. Grant Thornton's 2026 AI Impact Survey found barely one in ten boards meet the threshold for strong AI oversight. Here's what belongs in a quarterly AI risk report, and who should own it.

Key takeaways

  • A quarterly AI report should track a live inventory, not a snapshot taken the week before the meeting.
  • Five items belong in every pack: system inventory, risk classification, quantified metrics, escalation triggers, independent assurance.
  • Nearly three quarters of boards rate their own AI expertise as moderate or limited (KPMG).
  • The Data (Use and Access) Act 2025 gives UK boards a legal reason to track automated decision-making, not just cyber risk.
  • One named owner, not IT as a department, should hold the AI risk register between meetings.

Ask most boards what they know about AI risk in the business and you get a shrug, or a slide built by IT the night before. That's not oversight. That's a formality.

Barely one in ten boards meet the threshold for strong AI oversight, per Grant Thornton's 2026 AI Impact Survey. Nearly three quarters rate their own AI expertise as moderate or limited, per KPMG's Global AI Pulse Survey. Directors aren't failing because they're careless. Nobody has told them what a proper AI risk report looks like. Here it is.

The dashboard problem

Most AI board packs are a single slide: a green status light, a line about responsible AI, and a promise everything is under control. Nobody can ask a hard question because there's nothing underneath the slide.

Grant Thornton's survey found barely one in ten boards meet the threshold for strong AI oversight. That's not because directors don't care. Most reports are written to reassure, not inform.

KPMG found nearly three quarters of boards rate their own AI expertise as moderate or limited. Give a director with limited AI expertise a vague dashboard and you get vague oversight. Give them five specific things to check every quarter and you get a board that can govern the risk.

Five things that belong in every pack

Strip out the noise and every credible board-level AI report comes back to five elements. Miss one and the board is blind on that part of the risk.

  • A live AI system inventory: every tool in use, including ones staff adopted without sign-off. Built once and left stale, it creates false confidence.
  • Risk classification for each system: what it does, what data it touches, what happens if it fails or is misused.
  • A small set of quantified, benchmarked metrics: three or four numbers tracked every quarter, not fifteen KPIs nobody reads.
  • Escalation triggers: the events that pull a report out of the quarterly cycle onto the agenda immediately, such as a vendor incident or a new automated decision affecting people.
  • Independent evidence that controls are working, not a self-assessment from the team that built the system.

None of this needs new software. It needs someone deciding these five things matter, then keeping the record current between meetings.

Cadence: quarterly reporting, event-driven escalation

Quarterly suits the board calendar, but an AI estate changes weekly. The fix is maintaining the record continuously, so the meeting reports on a live system rather than a document rebuilt from scratch each time.

Section 80 of the Data (Use and Access) Act 2025 came into force on 5 February 2026, introducing Article 22C, which gives individuals the right to transparency, human review, and to contest automated decisions made about them. If the board doesn't know where the business makes automated decisions about people, that's a live compliance gap.

Escalation triggers matter as much as cadence. A vendor breach or a new automated decision process shouldn't wait for the next scheduled meeting.

Who owns the number

Every board report needs a named owner, not a department. IT is not accountable for anything; a person is. That person holds the AI risk register and decides whether an event meets the threshold for escalation.

This matters because accountability keeps the record current. A pack built in a rush the week before the board meets is a symptom of nobody owning the number between meetings.

What to do before your next board meeting

You don't need a new system to start. You need four decisions before the next board pack goes out.

  • Ask for a current inventory of every AI system in use, including tools staff adopted without sign-off.
  • Set three or four metrics the board will track every quarter, and stick to them.
  • Name one person accountable for the AI risk register between meetings.
  • Confirm where the business makes automated decisions about people, and check it meets the Article 22C requirements under the Data (Use and Access) Act 2025.

Do these four things and your next quarterly report will tell the board something it can act on.

About the author

Simon Steggles - Fractional AI Director

Simon helps UK SMEs and councils put AI to work safely. Royal Navy 1984–90 (Cat 3 PV at the time, now superseded by DV); current NPPV3 Police vetting for public-sector work; ISACA AI Governance certified. Based in Sutton Coldfield, Birmingham. Working UK-wide, remotely or on site. £300K+ recovered for councils, 43% cost reduction in manufacturing, zero data-protection incidents across every engagement.

More about Simon

Want help applying this?

Grab the free AI Readiness Checklist or book a 30-minute strategy call with Simon - no pitch, no slide deck, just practical advice for your situation.

Free AI Readiness Checklist
Or call 07973 210 895

Use this framework next

Quarterly AI Board Report: What to Include and How to Present It

Simon writes these for UK clients every quarter. Most boards have been receiving AI updates without being asked to decide anything. The distinguishing feature of this format is the board ask that closes every report - something the board is being asked to approve, direct, or formally note. This guide explains the structure.

Open framework

Read next

AI Governance Framework for UK Organisations: What You Need
GovernanceRegulation

AI Governance Framework for UK Organisations: What You Need

Every UK organisation deploying AI needs a governance framework covering ten specific controls: AI register, ISO 42001 alignment, acceptable use policy, prompt safety, data quality, vendor contracts, training, incident response, board reporting, and annual review.

How to Audit Your AI Suppliers: A Board-Level Checklist for UK Organisations
GovernanceProcurement

How to Audit Your AI Suppliers: A Board-Level Checklist for UK Organisations

Most UK organisations have no formal process for assessing the AI systems embedded in their supplier tools. This is a governance gap with legal, reputational, and operational consequences. Here is how to close it.

What to Include in Your Organisation's AI Policy: A Board-Level Guide
GovernancePolicy

What to Include in Your Organisation's AI Policy: A Board-Level Guide

An AI policy is not a document you write once and file. It is a governance instrument that defines accountability, manages risk, and protects your organisation. Here is what it must contain to do that job properly.

Find Out Where AI Can Save or Generate Money in Your Organisation

Book a free 30-minute call with Simon. Bring a real problem - staff time, governance worry, vendor proposal, failing pilot - and leave with a concrete first step you can take next week.

07973 210 895
Call