The fix isn’t a longer report. It’s a different one page.

What follows is a worked example: not a template to fill in blindly, but a guide to what a genuine AI strategy dashboard should contain, and — just as importantly — what each line is actually testing for. It’s built around eight baskets that map onto the Four-Domain Frame this publication uses to keep board AI oversight honest — Strategy & Innovation, Risk & Resilience, Governance & Accountability, Capability & Culture — plus the one basket most dashboards miss entirely: portfolio discipline and value realisation.

Companion piece to “Somewhere, a Start-Up Is Already Pricing the Gap”

The figures are illustrative, built for a fictional composite board. Swap in your own and the exercise becomes real.

Reading it basket by basket

Financial impact and strategic outcomes (1–2) are the pair a CFO and a strategy committee should already recognise: revenue uplift, cost-to-serve, retention, speed to market. They convert AI from experiment into capital allocation, and from internal productivity theatre into a genuine competitive-position test.

Workflow economics and adoption & trust (3–4) are the reality check underneath. A workflow that’s been “redesigned” but shows no cycle-time or cost-per-decision movement hasn’t been redesigned — it’s been decorated. And AI that’s licensed but not used, or used but constantly overridden, isn’t transformation; it’s shelfware with a subscription fee.

Technical reliability and strategic control (5–6) are the two baskets a risk committee should own outright: is the system safe enough to keep scaling, and is the company dangerously dependent on one vendor, one model, or a pile of “high-risk” use cases still sitting outside the regulatory taxonomy.

Capability & culture (7) is the basket most AI dashboards skip completely — and the one this publication’s Four-Domain Frame won’t let us skip. A board and a workforce that can’t use AI competently can’t govern it competently either. That’s not an abstract governance point: it’s the same gap the Diligent Institute found at board level (82% of directors already using AI; just 6% with a policy) showing up one layer down, in the workforce whose output the board is ultimately accountable for. Track training completion, reskilling against roles actually flagged for redesign, and how thin the organisation’s own AI talent bench is against AI-native peers — because that gap is exactly what an AI-native rival is resourced not to have.

Which line actually matters most

The instinctive answer is basket 8’s first metric family: pilots killed. If nothing’s been stopped, nothing’s being actively managed — that’s a fair diagnostic, and it’s the one most commonly cited as the single most important line on an AI dashboard.

Sat in front of a real board, I’d push back on that instinct. Killed pilots tell you management is being disciplined about process. They don’t tell you whether the portfolio is actually working. The number that should worry a chair more sits right next to it: benefits realised versus promised. Sixty-one per cent means more than a third of the value the board approved capital for hasn’t shown up — and that gap is precisely what the BCG and McKinsey data in this week’s Frame piece warns about: high activity, thin evidence, most of the value concentrated in a small minority of companies that can prove it lands. Killed pilots explain the mechanism. Benefits realised is the verdict. Put the verdict first.

How to use this

• Don’t copy the eight baskets wholesale — reweight them for your sector. A regulated financial-services board will lean harder on strategic control; a consumer business will lean harder on strategic outcomes and adoption.

• Ask management to bring the red and amber lines to committee, not the green ones. A dashboard that’s all green is a dashboard nobody has stress-tested.

• Revisit quarterly. The individual reading matters less than the trend — a portfolio-discipline number moving from 40% to 61% is a very different conversation to one stuck at 61% for a year.

• If management can’t populate a line, that’s data too. A blank cell on “AI unit economics by use case” is more informative than a confident-looking pilot count.

Every week in TheDirectorBrief.

## 🎯 The Frame — one topical AI conversation relevant to Boards. Designed to encourage debate and action. Covering 4 domaines: Strategy & innovation; risk & resilience; governance & accountability; capability & culture.

## ❓Five for the Chair — five board-ready questions anchored in this week’s Frame, screenshot-able into next Monday’s agenda. What should the board actually debate?

## 📡 The Signal — five Board relevant AI developments you need to know about this week. Plus the STAT and CHART of the week. What changed — and what should we do?

## 📚 The Library — “AI academy”: the manual: primers, tools, templates, checklists, plus the Monday-Morning build (one tool to test, one prompt that earns its place). Do we have the literacy to govern this?

One read. Thirty minutes. Before your next board deck

Subscribe free at TheDirectorBrief.com

To help me make this better please feel free to send me any comments, feedback or suggestions to hello@thedirectorsbrief.com. Thank you for reading.

Disclaimer: These are my personal views, shaped in a fast-moving environment and open to revision. They should not be taken as representing the perspectives of any boards or advisory roles, past or present.

Governance sounds like a compliance checklist. In practice it’s the set of rules that determine what an agent can do, what it can’t and who owns the output. Without it agents can make decisions no one asked it to do and no one will know until something bad has happened. Mckinsey’s research suggests that governance frameworks integrated with business processes are what separates successful agent deployments vs failed ones. Do this before a single deployment or API call.

Most boards do the easy half: set a posture, build a partial inventory, then quietly stop before naming an owner, hard-wiring the controls, or running the loop that would expose whether any of it is real — because this iterative feedback loop is what creates personal accountability, not just paperwork. Here’s the whole loop, a set of metrics to measure and the move your board is most likely avoiding.

1. Set your AI posture. Before ‘how much risk?’, answer ‘how much agency?’. Decide where AI may act autonomously, where it may only recommend, and where it is prohibited — by decision type, not department (e.g. screening CVs, responding to customer support queries, managing refunds or payments, credit checking, procurement etc). What is prohibited vs with clear limits? To what standards and ethical guardrails? This is an Executive team call validated with the board, made explicitly and minuted, not something inherited from whatever the tools default to. Everything else hangs off it.

2. See everything. Build the inventory before the policy. A live register of every material AI system and agent: what it does, what data it touches, which vendor sits underneath. Don’t forget the AI staff use without IT’s knowledge, sometimes called ‘shadow AI’: one governance vendor, governr.ai, puts it at 60–70% of what’s actually deployed inside the average regulated firm. At minimum start with your high risk known cases. Ideally classify each use case by strategic value and risk. If you can’t produce the inventory inside 48 hours, the policy is theatre.

3. Name the owner. Every material AI system carries a named human owner (management and board committee) — for the decision, the data and the vendor relationship. Accountability can never transfer to the machine. Diffuse accountability is what produces the regulator’s letter.

4. Embed the controls. Move from detective to preventive. Hard limits, approval thresholds and a tested kill switch built into the system itself (hard coded upfront with outputs validated) — not a quarterly review that catches the failure after a million decisions. Human sign-off stays mandatory for money movement, code deployment and customer commitments.

5. Monitor, and close the loop. Fund a small number of strategic bets and stop weak pilots. In addition to model releases, vendor moves, incidents - track ROI, token cost, workforce effects & provider concentration. Realtime metrics, not adjectives (see below). As things change test the feedback loop. Refresh board education & scenario testing.

Run it well and this isn’t just defence — it’s how you move faster with more confidence than a rival who’s flying blind. Five moves. Most boards have done one or two and are resisting the rest.

Posture, inventory, owner, controls, monitor & loop. Simple to describe, revealing to run — because each move exposes whether the previous one was real.

The board dashboard: what directors should see quarterly, with a weekly pulse

As an example, I would split Board metrics into five groups:

What does good look like? Example of an AI dashboard click here

A board should not accept a dashboard that says: “we have 150 AI use cases.” That is usually a symptom of weak strategy. The better answer is: “we have 8 scaled AI workflows, 4 material strategic bets, 3 stopped initiatives, £X realised value, Y% provider concentration, Z unresolved risks.”

Standing topic, or system?

Who’s asked who owned the AI agenda at executive level, how much agency had been delegated to which agents, what guiderails we had hard coded or who was responsible for each? What the board would see on the dashboard next quarter? How are we tracking this realtime givemn agents are making decsions on our behalf and each model updates creates different outcomes? If like many, you haven’t, then this gap is what this manual page is built to close.

Most boards now treat AI as a standing topic. Far fewer treat it as a system. And the system you need now must govern a non-human actor at machine speed — not a person at quarterly cadence.

Standing topic produces an update. System produces evidence (real time).

The Stat This Week
65% of organisations now use generative AI in at least one business function. Three in four are running agentic AI in their systems. Fewer than one in five has a defined AI governance operating model that names who is accountable for each agent. Adoption up, agency unowned, evidence flat.

The shorthand

Strip the leading frameworks back. OECD’s updated 2024 principles set the values — human-centred, transparent, accountable. NIST’s AI Risk Management Framework reframes them as an operating loop — Govern, Map, Measure, Manage. The EU AI Act bolts on legal obligation, phased: prohibited practices live since February 2025, general-purpose AI obligations since August 2025, high-risk system obligations from August 2026. The UK’s principles-led approach leaves more discretion but demands the same outcomes. McKinsey, KPMG/INSEAD, the WEF AI Governance Alliance and the Harvard Law School Forum on Corporate Governance translate the same idea into board-level decisions: align posture, allocate capital, classify risk, govern the lifecycle, evidence the controls.

AI governance is value + risk + trust, governed as one system. The first-order board question is no longer “how much risk?” It is “how much agency?”

What changes when the actor isn’t a person

Every board operating model in use today rests on a hidden assumption: the actor executing a decision is a human who can be instructed, supervised, slowed down and held to account. Once decisions and actions are delegated to autonomous agents — pricing engines, customer-routing models, refund bots, credit-check agents — that assumption breaks. This is not a new agenda item. It changes the substance of nearly every board responsibility.

AI doesn’t replace the board’s duties. It raises the metabolic rate at which they must be discharged.

The Frame this week works through the structural break; this Library page operationalises the response.

The Four-Domain Frame, working as a system

The Manifesto introduces the Four-Domain Frame as the navigation grammar of this publication. The Library makes it operational — the same four domains, the same map, applied as a connected system rather than a list.

The Four-Domain Frame · the navigation grammar of TheDirectorBrief. Cross-cutting: 6-dimension scorecard (Value · Adoption · Risk · Compliance · Capability · Trust), 10 building blocks, 6-month implementation arc.

The board’s job is not to approve every tool or model. It is to ensure four things, one for each domain:

• Strategic intent — AI is linked to value, not pilot proliferation. (Strategy & Innovation.)

• Risk discipline — use cases classified, agency assigned explicitly, controls embedded before deployed. (Risk & Resilience.)

• Agency and accountability — every material agent has a named human owner; agency appetite (autonomous / recommend-only / prohibited) decided in advance; accountability never transfers to the agent. (Governance & Accountability.)

• Capability and trust — AI is explainable, fair, secure, lawful and defensible — and the board itself has the literacy to test that. (Capability & Culture, with Governance.)

A board doing only the first will be blindsided. A board doing only the third will miss the upside. The board that does all four turns AI from a risk to be contained into a capability to be governed.

Caremark exposure is not theoretical. Since Marchand v. Barnhill (2019) confirmed that boards owe an oversight duty for mission-critical risks, AI has steadily moved into the centre of that line. ISS and Glass Lewis both updated 2024 stewardship guidance to reference AI oversight and disclosure. If your minutes do not show evidence-based AI oversight — including who owns each material agent — the question is not whether you should worry. It is when.

The six questions that test whether your governance is real

The full Primer carries twenty questions, five per domain. Six are load-bearing. Use these in your next committee. If any of them produces a fluent description rather than a piece of evidence, you have governance theatre.

1. Where does AI create the most value in our business — and where could it destroy the most value?

Tests whether AI is integrated into strategy or banished to the cost line. (Strategy & Innovation.)

2. Do we have a complete live inventory of AI use cases — including GenAI, agents, copilots, shadow agents and vendor-embedded AI?

Tests whether the board has visibility — or only the slice management chooses to show. (Risk & Resilience.)

3. Are there AI uses we should prohibit because they are unethical, unlawful or inconsistent with our values?

Tests whether the board has set a floor. (Governance & Accountability.)

4. How much agency have we delegated to each material AI use case — autonomous, recommend-only or prohibited — and is a named human accountable for each?

Tests whether the operating model is defined or improvised. The new first-order question. (Governance & Accountability.)

5. Can we explain and defend AI-driven decisions to customers, regulators, courts or the media — and would the logs survive disclosure?

Tests whether you are defensible. (Risk & Resilience + Governance.)

6. What is the one AI failure scenario that could cause the most reputational harm — and have we imagined it concretely enough to plan for it?

Tests whether the board has imagined its worst day in enough detail to act. (Risk & Resilience + Capability & Culture.)

Watch, ask, decide

• Watch. The gap between the board’s confidence and management’s evidence. If the dashboard contains adjectives, not metrics, the gap is wide. If you cannot name who owns each material agent, the gap is wider.

• Ask. The chair and the SID — separately — who owns AI at executive level, which committee owns which risks, and when the board last received an end-to-end view rather than a topic-by-topic update. Inconsistent answers are the signal.

• Decide. Before the next cycle, that the board will receive a single integrated AI dashboard, that the AI inventory will be presented live (not quarterly), and that every material agent will carry a named owner, a documented agency appetite and a tested kill switch.

Next week

Ten ways AI can blow up your business — and the control architecture that catches them. The eight risk families tagged to the Four-Domain Frame, the agentic overlay (what changes when the actor is a machine), the ownership map updated for agency, three lines of defence, and the six-dimension scorecard.

TheDirectorBrief - What you get. Free, each week. Thirty minutes:

• A practical discussion of an AI related topic, centered on strategy, risk, governance & capability. A decision useful take - with examples, facts, useful frameworks and key questions to ask. Exposes common misconceptions and cuts through the hype (The Frame)

• Five board-ready questions for your next meeting (Five for the Chair)

• Curated decision ready AI news. What you need to know, why it matters and how you might factor into decision making (The Signal)

• Practical tools, how to guides, primers and prompts ready to (customise &) use in your business. (The Library)

• AI education for board directors What to play with, build, read, watch or listen to. Not one off. Building AI fluency on going. (Monday morning)

  Signal, not noise. Judgement, not updates.

Subscribe free at TheDirectorBrief.com — or reply to this email. I read every response.

Sources

1. McKinsey, State of AI 2024 — generative AI adoption by function. [Primary.]

2. Grant Thornton, 2026 AI Impact Survey — agentic AI deployment and incident response. [Primary.]

3. NACD, 2024 Public Company Governance Survey — AI in the top three director risks. [Primary.]

4. Stanford HAI, AI Index Report 2024 — regulatory mentions across major jurisdictions. [Primary.]

5. Marchand v. Barnhill (Del. 2019) — board oversight duty for mission-critical risks. [Primary.]

6. ISS and Glass Lewis, 2024 stewardship guidance updates. [Primary.]

7. Working paper: Governing AI Agents in the Enterprise (May 2026) — the 6-dimension shift and 8-phase continuous loop drawn from internal research; full table sits in The Watch (this week) and the Primer Section B.

Frameworks referenced: OECD AI Principles (updated 2024); NIST AI RMF 1.0 (2023); EU AI Act 2024/1689; UK DSIT principles; KPMG/INSEAD Global AI Governance Principles 2026; WEF AI Governance Alliance 2024–25; Harvard Law School Forum on Corporate Governance. [Primary, all.]