AI for CXOs: 10 Board Questions on AI — Answered With Data (2026)

Q: What are the most important questions boards ask about AI?

The ten questions that boards most consistently ask cover AI strategy and business alignment, cost and expected return, risk management, regulatory compliance, competitive positioning, talent and capability, data protection, timeline to measurable impact, AI governance and decision-making accountability, and the cost of inaction. Each question tests a different dimension of management credibility — strategic clarity, financial rigour, risk awareness, and execution capability. The strongest board presentations address all ten proactively rather than waiting for them to be asked.

Q: How should a CTO present AI strategy to the board?

Lead with the business case, not the technology. Present AI initiatives as business investments that use AI, not as technology projects. Use a risk/opportunity matrix to show the portfolio of initiatives mapped against impact and risk. Provide phased investment profiles with ranges rather than point estimates. Include specific decision points where the board can evaluate progress. Keep the main presentation to six slides covering business case, risk/opportunity matrix, investment profile, risk management framework, timeline with milestones, and competitive context. Put technical detail in the appendix for reference during questions.

Q: How much should a company invest in AI in Year 1?

Industry benchmarks suggest that a well-scoped Year 1 AI programme covering two to three production use cases, shared infrastructure, and evaluation frameworks costs £150,000 to £400,000 for a mid-market company. A useful rule of thumb is £100 to £300 per employee for companies pursuing a measured initial programme. Organisations spending below £100,000 almost universally report failure due to insufficient infrastructure and capability investment. Those exceeding £1 million in Year 1 at mid-market scale frequently report waste from building platform capabilities before they have enough use cases to justify them.

Q: What AI risks should boards be aware of?

AI risks fall into four domains that boards should evaluate: technical risk (model hallucination, accuracy degradation, system reliability), data risk (privacy violations, bias in training data, data quality issues), regulatory risk (EU AI Act non-compliance, sector-specific regulation, cross-border data transfer), and operational risk (vendor dependency on a single AI provider, talent concentration in key individuals, integration fragility). Each domain requires specific controls — output guardrails for technical risk, data classification for data risk, compliance registers for regulatory risk, and multi-provider architecture for operational risk.

Q: How do you measure AI ROI for a board presentation?

AI ROI should be presented as a range with explicitly stated assumptions, not as a single number. The most credible metrics for board presentations are cost reduction (hours saved multiplied by fully loaded labour cost), revenue impact (measurable increase in conversion, customer retention, or capacity), risk reduction (quantified reduction in error rates, compliance violations, or security incidents), and speed improvement (reduction in cycle time for key business processes). Connect each AI initiative to one primary metric, measure it before deployment to establish the baseline, and report against it consistently. Boards respond to demonstrated measurement discipline more than to impressive numbers.

Q: Is AI regulation a board-level concern?

Yes. The EU AI Act carries fines of up to €35 million or 7 percent of global turnover for non-compliance. Boards have fiduciary responsibility to ensure the company understands which AI regulations apply, which AI systems fall under which risk categories, and what compliance measures are in place. Companies should maintain an AI register cataloguing all AI systems, their risk classifications, and their compliance status. Boards do not need to see the register in detail, but knowing it exists and is actively maintained is a governance signal that directly addresses their fiduciary obligations.

Q: What happens if a company does not invest in AI?

The cost of inaction operates across three time horizons. In the next 12 months, the primary risk is operational cost disadvantage as competitors deploying AI for document processing, customer service, and internal operations achieve 15 to 25 percent cost reductions in those functions. In 12 to 24 months, customer experience expectations shift as AI-powered interactions become baseline. In 24 to 36 months, strategic decision-making quality diverges as companies with AI-driven analytics make faster, more accurate market and product decisions. The strategic window for building AI capability at a reasonable cost is 2025 to 2027 — after that, catching up becomes progressively more expensive.

Q: How should AI governance integrate with existing board governance?

AI governance should be an extension of existing risk management and compliance frameworks, not a parallel structure. If the board already oversees technology risk, data governance, and regulatory compliance through established committees, AI governance should integrate into those structures with AI-specific additions. The operational governance model should be risk-tiered: low-impact high-confidence AI decisions proceed automatically with monitoring, medium-impact decisions receive sampling-based human review, and high-impact decisions require human approval. Each AI system should have a named individual accountable for its outputs, and all AI decisions should be logged for audit purposes.