The three questions every board should ask before investing in AI

Before your board approves another AI investment, it should be able to answer three questions — and most boards cannot answer any of them with confidence. Not because directors are not capable, but because the questions are about the organisation's own readiness, not the technology, and that is the part no vendor deck covers. The board's job in Phase Three is not to pick the right tool. It is to know whether the organisation underneath the tool can actually hold it.

I sit in these rooms. The mood is rarely complacency. It is a quiet, capable anxiety — directors who built their careers on judgement, now governing a technology moving faster than their forecasting horizon. The honest ones say it plainly: we are approving things we do not fully understand. These three questions are how you close that gap.

Question one: do we actually know where AI is already being used?

Start here, because this is the question that exposes the real risk. Most boards are looking forward — at the next platform, the next pilot — while AI is already woven through their operations, unmonitored. Only 37% of boards have audited how their employees are actually using AI, according to the 2025 Diligent Institute and Governance Institute of Australia survey. Which means roughly two in three boards are governing an AI footprint they cannot see.

This is the inversion most directors miss. The exposure is not in the formal initiative with the steering committee and the risk register. It is in the marketing manager pasting customer data into a consumer chatbot, the analyst shipping a model's output into a board paper without checking it, the quiet accretion of tools no one approved. You cannot govern what you have not mapped. Before you fund the next thing, commission an honest audit of the AI already in the building — and its risk profile. Most boards discover they are further in, and more exposed, than they thought.

Question two: do we have the literacy to oversee this — or are we governing by restriction?

A board cannot oversee what it does not understand, and the literacy numbers are stark. Only 13% of Australian boards have appointed a director with AI expertise, and just 21% require directors to undergo AI training. Compare that with Asian boards, which are more than twice as likely to recruit an AI-skilled director (28%). The capability is not on most Australian boards yet.

And here is the reflex that gives the gap away. Australian boards are more than twice as likely as their Asian counterparts to restrict employee AI use — 61% versus 30%. When a board does not understand a technology, it reaches for the lever it knows: control. It bans. But restriction is not governance; it is the absence of it. It drives AI use underground, where it cannot be seen or managed, and it forfeits the upside to competitors who chose to build capability instead. Governing AI by banning it is like governing the internet in 1998 by blocking it. The question is not whether to allow AI. It is whether your board has the literacy to oversee it well — and if not, how fast you are going to build it.

Question three: is our AI governance continuous — or a one-off policy?

The third question is about cadence. Most organisations that have addressed AI governance did it once — a policy, a sign-off, a box ticked — and moved on. But AI does not hold still. The models change monthly, the risk surface shifts, the regulatory ground moves under you. Governance built as a one-time compliance exercise is obsolete within a quarter.

This is why, in November 2025, the US National Association of Corporate Directors called on boards to overhaul legacy governance structures and treat AI oversight as a continuous board-level function rather than a one-time event. Engagement is rising — more than 62% of public-company directors now set aside dedicated full-board agenda time for AI. But agenda time is not the same as oversight capability, and a single policy is not the same as a living governance rhythm. Ask your board: when did we last revisit this, and when will we next? If the honest answer is "we wrote the policy last year," you do not have AI governance. You have an artefact.

Why these three, and why now?

Because they move the board's attention from the seductive question to the consequential one. The seductive question is "which AI should we buy?" The consequential questions are "what are we already running, can we oversee it, and are we governing it as a living thing?" The Australian Institute of Company Directors now frames AI as a core governance responsibility and warns of a literacy gap among directors. The boards that take that seriously will not be the ones with the flashiest AI strategy. They will be the ones who did the unglamorous work of seeing clearly, building capability, and governing continuously.

There is a deeper pattern underneath all three. Each question is really about the same thing: the human system governing the technology, not the technology itself. The bottleneck is no longer the AI. It is whether the people in the room understand what they are stewarding. That is true in the boardroom exactly as it is true everywhere else in Phase Three — and it is, finally, a problem a board can actually do something about.

What good looks like

A board that can answer these three has done four things. It has mapped its real AI footprint and the risk that comes with it. It has built genuine literacy — through a director who knows the domain, mandated training, or both — rather than defaulting to bans. It has made AI a standing, continuous item with a clear owner, not a once-a-year policy review. And it has stopped pretending that approving AI spend is the same as governing AI. Do those four, and the next investment decision is made from understanding rather than hope. Skip them, and you are approving things you cannot see, cannot oversee, and cannot keep current — which is not governance at all.

About the author

Thomas Green

Thomas W. Green is a Technology Futurist and keynote speaker. He works with leadership teams navigating the AI transition — where the bottleneck is no longer the technology, but the human operating system itself.