Ask a board what it received on AI last quarter and the answer is usually a narrative: a roadmap slide, a policy refresh, an assurance that governance is in hand. Narrative is what management says about the program; oversight requires a small set of figures the board can watch move.
Oversight law asks for a reporting system, and a narrative is not one
The legal test is older than the technology. Under Delaware’s Caremark line of cases, directors must make a good-faith effort to put reporting systems in place for the risks that matter, then respond to the red flags those systems surface. In a March 2026 analysis for Columbia Law School’s CLS Blue Sky Blog, Pierluigi Matera argues that AI does not raise that bar but changes the evidence needed to meet it: “AI does not heighten the standard. It sharpens the clarity of process.” Directors need not understand a model’s internals, but they must see that monitoring tools are designed, validated, and supervised, and they must revisit their reliance on AI and on vendors when circumstances call it into question. The evidence of good faith he lists is concrete — minutes showing substantive discussion, periodic performance reviews, documented validation, assigned responsibility, escalation protocols — and a deck of qualitative updates produces none of it.
The frameworks point the same way. The National Institute of Standards and Technology (NIST) published its AI Risk Management Framework in January 2023, and the GOVERN function opens with the observation that “Senior leadership sets the tone for risk management within an organization,” and with it the culture. Its subcategory GOVERN 1.5 requires that ongoing monitoring and periodic review of the risk management process be planned, with the frequency of review decided in advance. ISO/IEC 42001:2023, the AI management system standard, follows a Plan-Do-Check-Act cycle and specifies requirements for “establishing, implementing, maintaining, and continually improving” that system. Check is a measurement step. A board that cannot name what is being measured cannot tell whether the cycle is turning.
The commercial signal is consistent with the legal one. Protiviti’s 2026 Global Board Governance Survey of 772 board members and executives found that about 63% of boards at organizations reporting high return on investment (ROI) from AI had made it a regular agenda item, against 13% at low-ROI organizations, and that 93% of high-ROI organizations trusted their ethical AI deployment compared with 42% of the low-ROI group. Boards that look regularly, at something specific, sit on top of the companies that get value from the technology.
Each of the four numbers traces to a published requirement
Our assessment is that four figures, reported each quarter with the prior quarter alongside, satisfy what the law, the frameworks, and the better governance guidance are each asking for. Each traces to a published requirement, which is what makes the pack defensible when a regulator, auditor, or plaintiff asks why the board watched these numbers and not others.
One: AI systems in the inventory, by risk tier. NIST subcategory GOVERN 1.6 requires that “Mechanisms are in place to inventory AI systems,” resourced according to organizational risk priorities. The EqualAI AI Governance Playbook for Boards, published with WilmerHale in January 2026, tells directors to ensure there is a reliable inventory of AI use across departments, including unauthorized practices, classified by risk level, with high-risk uses in areas such as employment, housing, and health care flagged. The board figure is the total count, the count in the highest tier, and the entries added since last quarter through discovery rather than intake. That last number measures how much AI the company runs that nobody approved.
A board that cannot state how many AI systems the company runs cannot credibly claim to oversee them.
A board that cannot state how many AI systems the company runs cannot credibly claim to oversee them.
Two: the share of AI initiatives that completed a documented risk review before deployment. Protiviti’s Board Perspectives on AI oversight proposes tracking the “percentage of major AI initiatives subject to documented risk and governance review.” The NIST framework supplies the substance behind that review: MAP 1.5 requires that “Organizational risk tolerances are determined and documented,” and MEASURE 1.1 requires that the risks which will not or cannot be measured are documented as well. The board sees the percentage and the list of exceptions. An honest, incomplete percentage with named exceptions is a governance control; an asserted full coverage with no exception list is a narrative.
Three: AI incidents and user-reported problems, with severity. Protiviti’s suggested indicator is “the frequency and severity of AI-related risk issues escalated to the board.” NIST GOVERN 4.3 requires practices that enable “AI testing, identification of incidents, and information sharing,” and MEASURE 3.3 requires that feedback processes for end users and affected communities to report problems and appeal outcomes be built into evaluation metrics. Report the count, the severity distribution, and the number of appeals. Read the trend with Matera’s warning in mind: declining alert rates can signal that monitoring is failing, not that models are behaving. Zero incidents across a large inventory is a question, not a comfort.
Four: the share of deployed systems whose scheduled monitoring review happened on time. NIST MANAGE 4.1 requires that “Post-deployment AI system monitoring plans are implemented,” including mechanisms for capturing user input, appeal and override, decommissioning, incident response, and change management. The EqualAI playbook recommends formal protocols that keep the board informed on a regular schedule, such as quarterly or biannual reviews of mission-critical risks. The figure is the share of in-scope systems reviewed within their window, with the list of those that were not. It answers the Caremark question most directly, because it shows the board whether the reporting system it relies on is actually running.
Once the numbers are in, the pack shrinks to a page and the narrative moves beneath them
Four figures, each with its prior-quarter value, a threshold drawn from the documented risk tolerance, and a named executive owner. The narrative sits below the numbers and explains why they moved: which business unit added the unregistered systems, why review coverage fell, what the severe incidents were and what changed as a result. The minutes record the discussion, because the record of the board engaging with the figures is itself part of the evidence.
Two scoping decisions determine whether the numbers mean anything. First, the inventory must include third-party and embedded AI, not only systems the company built; NIST GOVERN 6.1 asks for policies addressing AI risks from third-party entities, and an inventory that omits vendor models understates every other figure. Second, thresholds are set before the numbers come in, against the board’s stated tolerance, so a breach is recognized rather than explained away.
The sequence is short. The general counsel or chief risk officer owns the pack and presents it at the next scheduled meeting, even if the first version shows review coverage well short of complete and an inventory that doubled on discovery. The AI governance lead owns the register and the review calendar. Within two quarters the board has a trend line, which is the point: a single reading proves the system exists; a trend proves it is used.
Boards do not fail the oversight test by lacking AI expertise; they fail it by accepting narrative where a reporting system was required. The four numbers are modest, traceable to published requirements, and uncomfortable in the first quarter they are reported. That discomfort is the sign the board is finally seeing the program rather than hearing about it.