The three questions every board should ask before investing in AI

Before your board approves another AI investment, it should be able to answer three questions, and most boards cannot answer any of them with confidence. Not because directors lack capability, but because the questions are about the organisation's own readiness rather than the technology, and that is the part no vendor deck covers. The board's job now is not to pick the right tool. It is to know whether the organisation underneath the tool can actually hold it. That job belongs to what I call Phase Three. Phase One was the Age of Effort: work hard, get a little more, linear growth. Phase Two was the Age of Scale: build once, sell to millions, exponential growth. Phase Three is the Age of Acceleration: output decoupled from human effort almost entirely, the phase AI unlocks. In that phase, the constraint moves from the machine to the people governing it.

I sit in these rooms. The mood is rarely complacency. It is a quiet, capable anxiety: directors who built their careers on judgement, now governing a technology that moves faster than their forecasting horizon. The candid ones say it plainly. We are approving things we do not fully understand. These three questions are how a board closes that gap.

Question one: do we actually know where AI is already being used?

Start here, because this is the question that exposes the real risk. Most boards are looking forward, at the next platform, the next pilot, while AI is already woven through their operations, unmonitored. Only 37% of boards have audited how their employees are actually using AI, according to the 2025 Diligent Institute and Governance Institute of Australia survey (Diligent Institute is the research arm of the board-software firm Diligent; the Governance Institute represents company secretaries and governance professionals). Which means roughly two in three boards are governing an AI footprint they cannot see.

And the footprint runs higher up the building than most directors assume. In UpGuard's State of Shadow AI 2025 report, more than 80% of workers said they use AI tools their employer has not approved, and it was executives who showed the highest levels of regular use (shadow AI is the term for AI tools adopted by staff without IT or board sign-off). This is the inversion most directors miss. The exposure is not in the formal initiative with the steering committee and the risk register. It is in the marketing manager pasting customer data into a consumer chatbot, the analyst shipping a model's output into a board paper unchecked, the quiet accretion of tools no one approved. You cannot govern what you have not mapped. Before you fund the next thing, commission an honest audit of the AI already in the building, and the risk that travels with it. Most boards discover they sit further in, and more exposed, than they had assumed.

Question two: do we have the literacy to oversee this, or are we governing by restriction?

A board cannot oversee what it does not understand, and the literacy numbers are stark. Only 13% of Australian boards have appointed a director with AI expertise, and just 21% require directors to undergo AI training. Compare that with Asian boards, which prove more than twice as likely to recruit an AI-skilled director (28%). The capability is not yet on most Australian boards.

And here is the reflex that gives the gap away. Australian boards are more than twice as likely as their Asian counterparts to restrict employee AI use: 61% versus 30%. When a board does not understand a technology, it reaches for the lever it knows, which is control. It bans. But restriction is not governance; it is the absence of governance. It drives AI use underground, beyond sight and beyond management, and it forfeits the upside to competitors who chose to build capability instead. Governing AI by banning it is like governing the internet in 1998 by blocking it. Literacy is also becoming a legal duty, not only a good idea: under Article 4 of the European Union's AI Act, in force since February 2025, every organisation that deploys AI must ensure its staff reach a sufficient level of AI literacy (the AI Act is the EU's landmark law regulating artificial intelligence). The question is not whether to allow AI. It is whether your board holds the literacy to oversee it well, and if not, how fast you intend to build that literacy.

Question three: is our AI governance continuous, or a one-off policy?

The third question is about cadence. Most organisations that have addressed AI governance did it once, a policy, a sign-off, a box ticked, and then moved on. But AI does not hold still. The models change monthly, the risk surface shifts, the regulatory ground moves beneath the board. Governance built as a one-time compliance exercise turns obsolete within a quarter.

This is why, in November 2025, the US National Association of Corporate Directors (NACD, the main professional body for American company directors) called on boards to overhaul legacy governance structures and treat AI oversight as a continuous board-level function rather than a one-time event. Engagement is rising: more than 62% of public-company directors now set aside dedicated full-board agenda time for AI. But agenda time is not the same as oversight capability, and a single policy is not the same as a living governance rhythm. Ask your board two questions: when did we last revisit this, and when do we next? If the candid answer is "we wrote the policy last year," you do not have AI governance. You hold an artefact.

Why these three, and why now?

Because they move the board's attention from the seductive question to the consequential one. The seductive question is "which AI should we buy?" The consequential questions are "what are we already running, can we oversee it, and are we governing it as a living thing?" The Australian Institute of Company Directors (AICD, the country's professional body for directors) now frames AI as a core governance responsibility and warns of a literacy gap across directors. The boards that take that warning seriously will not be the ones with the flashiest AI strategy. They will be the ones who did the unglamorous work of seeing clearly, building capability, and governing on a continuous rhythm.

There is a deeper pattern underneath all three. Each question is really about the same thing: the human system governing the technology, not the technology itself. The bottleneck is no longer the AI. It is whether the people in the room understand what they are stewarding. That holds in the boardroom exactly as it holds everywhere else in Phase Three, and it is, finally, a problem a board can actually do something about.

What good looks like

A board that can answer these three has done four things. It has mapped its real AI footprint and the risk that comes with it. It has built genuine literacy, through a director who knows the domain, mandated training, or both, rather than defaulting to bans. It has made AI a standing, continuous item with a clear owner, not a once-a-year policy review. And it has stopped pretending that approving AI spend is the same as governing AI. Do those four, and the next investment decision is made from understanding rather than hope. Skip them, and you are approving things you cannot see, cannot oversee, and cannot keep current, which is not governance at all.

About the author

Thomas Green

British technology futurist, AI keynote speaker and advisor. Thirty years across enterprise technology and AI strategy, helping leaders navigate the future of work. The futurist who died.