Control · C-053 · Strategy & Risk Appetite

AI risk reporting to the board

Key risk indicators, incidents, exceptions and the state of the inventory are reported to the board or its committee on a set cycle, in a form that supports challenge.

Control type: Detective
Family: 01 Strategy & Risk Appetite
Risks addressed: 6
Audience: Board · Heads-of
Frameworks: Clause 9 · GOVERN 2 · Principle 2
Responsible AI domain: 01 Strategy & Risk Appetite
11 Monitoring, Assurance & Incidents
Lifecycle stage: 7 Operate & monitor
Reviewed: 2026-11-10

What it does

It gives the board the information it needs to oversee AI. A regular report shows the position against risk appetite limits, the highest-risk systems, incidents and near misses, open exceptions, overdue reviews and significant regulatory change. The chief risk officer, or equivalent, owns the report. It is produced on a set cycle, usually quarterly, with urgent matters escalated between cycles.

How to implement it

Agree with the board which indicators it wants and what each is for.
Report against the limits in the risk appetite statement.
Include incidents, exceptions, audit findings and overdue actions, and not only activity.
Name the highest-risk uses and any change in them.
Give an independent second-line view alongside management's.
Keep it short enough to be read, with detail available on request.

Evidence it operates

Design: a reporting template and calendar agreed with the board or its committee. Operation: the reports themselves; minutes showing questions asked and actions set; evidence that an action raised by the board was completed.

Where it fits

Runs throughout operation and closes the loop from systems back to strategy. It is the primary control for inadequate board oversight of AI, reports against the AI risk appetite statement, and draws its data from the AI inventory and the AI governance forum.

Limits

A report informs only a board able to interpret it, so it depends on directors' own understanding. Indicators that are always green teach nothing and should be questioned. Management chooses what to include, which is why an independent view belongs in the pack. Reporting describes the past and is no substitute for escalation when something serious happens.

Risks this mitigates

Primary mappings

Inadequate board oversight of AI High: Gives the board regular, decision-ready information on AI risk. The board and senior management lack the information, expertise or forum to challenge AI risk, and approve what they cannot evaluate.

Supporting mappings

AI monitoring and alerting gap High: Aggregates indicators for oversight. A system's behaviour in production is not measured against thresholds that trigger action, so degradation, misuse and harm are noticed late or by accident.
AI-accelerated cyber threat High: Keeps the changed threat in front of the board. Advanced models lower the cost and skill needed to find and exploit vulnerabilities, so attacks become faster, more numerous and harder to distinguish from legitimate activity.
Disparate impact monitoring gap High: Puts fairness indicators in front of the board. Once an AI system is in use, nothing measures whether its outcomes differ between groups, so discrimination that emerges after launch goes undetected.
Model monoculture and herding High: Reports concentration to the board. Many organisations rely on the same few models, providers and data, so they make the same errors, react in the same way and fail at the same time.
Undefined AI risk appetite Medium: Reports the position against those limits. No statement exists of how much AI risk the organisation will accept, so approvals are inconsistent and nothing triggers escalation.

Framework and clause references

Framework	Clause	Title
ISO/IEC 42001:2023	Clause 9	Performance evaluation Management review.
NIST AI Risk Management Framework (AI RMF 1.0)	GOVERN 2	Accountability structures and trained, empowered teams Executive oversight.
SS1/23: Model Risk Management Principles for Banks	Principle 2	Model risk governance Board reporting on model risk.

Related terms

How to cite

Axiom Verity (2026). AI risk reporting to the board. Reference Library, C-053. https://axiom-verity.com/controls/ai-risk-reporting-to-the-board. Reviewed 2026-11-10.

Found an error or a better source? Report a correction.