Key takeaways
- Boards are not asked to understand AI technology. They are asked to satisfy themselves that the company can account for what its AI does — the same oversight duty that already covers payments and financial controls.
- AI agents have crossed a line that makes this a board matter: they now take actions previously reserved for employees, including payments, data handling, and external commitments.
- Five questions let a director test any AI governance program without technical depth. If management cannot answer them, the program is not real yet.
- Most AI reporting boards receive is activity reporting, not accountability reporting. Four red flags separate the two.
The one-sentence summary
The board’s AI duty is not to understand the models — it is to ensure the company can answer, with evidence, what its agents did and who approved it; these five questions test whether it can.
Why this is now a board matter
Directors did not need a briefing on software deployments, because software did not act. It processed, calculated, and stored. AI agents act: they pay invoices, move customer data, draft and send external communications, and write to systems of record. Every one of those actions was, until recently, something a named employee did — which meant accountability had a human shape: the employee, the manager who approved, the record of both.
Agents break that shape unless the company rebuilds it deliberately. An agent that pays an invoice is not an employee and not a vendor, but it is doing something that requires both attribution and approval. If the company cannot say which agent acted, on whose behalf, under which approval, then an action the board would have treated as a controlled process is happening outside anyone’s control.
The fiduciary framing follows directly. Directors are already expected to satisfy themselves that material operational risks have owners, controls, and evidence — that is the logic behind audit committees, compensation governance, and cybersecurity oversight. Agents reach materiality the same way: through actions with financial, legal, and regulatory consequence. The board question is therefore not “how does AI work” but “can this company account for what its AI does, and could it prove that to a regulator or a counterparty.”
The five questions directors should ask
Each is answerable in a board session, none requires technical depth, and each has a version of “we don’t know” that should end the discussion until it is fixed.
1. How many AI agents act in our business, and who owns each one? Not pilots, not experiments — agents taking actions. The answer should be a number with names attached. “Several initiatives” is the sound of an ungoverned program.
2. Can we show, within an hour, what any agent did last week and who approved it? This is the reconstructability test, and it is the question regulators now ask first. The honest answers are “yes, here is the record” or “no, not yet” — and the second answer defines the work.
3. Which of their actions are irreversible, and what human approval do those require? Payments, deletions, external commitments, personal-data handling. The answer should name the action classes and the approval gates on each. If approval gates are described as “guidelines the agents follow,” they are not gates.
4. If an agent acts wrongly, who can stop it and how fast — and when was that last tested? A stop control that has never been tested is a hypothesis. The answer should include a date and a record of the test.
5. What would a regulator, auditor, or major customer see if they asked for evidence today? This is the composite question, and it is where the other four land. The answer is either a set of records or a set of documents, and the difference is the difference between governed and described.
The four red flags in AI governance reporting
Boards receive AI updates as a matter of course now. Most of them are activity reports, not accountability reports. Four markers tell the difference:
- Adoption numbers with no owner names. “12 agents in production” means nothing without 12 owners. Agents counted but not owned are the company’s fastest-growing unpriced liability.
- “Policy approved” as evidence. A policy document establishes intent. Only records establish execution. A report that cites the policy but contains no records is describing aspiration.
- Pilot-to-production metrics with no governance gate. “8 pilots moving to production” is only good news if the move passed a review that asked who approves what. Metrics that celebrate velocity past the gate are reporting around the control, not through it.
- No incident or drill record. If nothing has ever gone wrong and nothing has ever been tested, the reporting is describing a program that has not yet met reality.
A report with none of these red flags — inventories with owners, records as evidence, gates in the metrics, and drill dates — describes a governed program. That report is worth asking for by name.
What “good” looks like at board level
The boards handling this well have made three structural choices:
- AI accountability has a named owner at executive level, and it appears in the risk committee’s standing agenda — not as a special topic after an incident.
- The board sees evidence metrics, not activity metrics: agents in production with owners, approvals completed, records produced, stop drills passed, exceptions granted and by whom.
- The governance gate is the metric. Programs move to production when they can evidence attribution, approval, stop control, and record — and the reporting shows the gate working, including what it slowed down.
None of this requires the board to evaluate technology. It requires the board to insist that the company’s reporting about AI is the same kind of reporting it already requires about money: attributable, approved, and evidenced.
Where to go deeper
- The five questions above map directly to the four controls that regulators and frameworks expect — the frameworks comparison shows the mapping.
- If management needs the investment case structured, the business case one-pager is written to be forwarded to a board unchanged.
- What Moring does shows the control layer that produces the evidence those questions ask for.
- For the regulatory pressure behind this, what FFIEC examiners ask and the NAIC AI model audit cover the two sectors where boards are feeling it first.
- For the technical layer beneath the reporting, multi-agent governance explains the four controls that make the evidence possible, and what ungoverned agents cost prices the exposure the reporting should be measuring.
Frequently asked questions
What is the board's role in AI governance?
The board does not govern AI systems operationally — it governs whether the company can account for them. That means satisfying itself that AI acting inside the company is attributable, that consequential actions carry human approval, that stop controls exist and are tested, and that the company could evidence all of this to a regulator, auditor, or counterparty. It is the same oversight duty the board holds for payments and financial controls, applied to a new class of actor.
What questions should a board ask about AI agents?
Five, all answerable without technical depth: How many AI agents act in our business, and who owns each one? Can we show, within an hour, what any of them did last week and who approved it? Which of their actions are irreversible, and what human approval do those require? If an agent acts wrongly, who can stop it and how fast — and when was that last tested? What would a regulator, auditor, or major customer see if they asked for evidence today?
Do boards have fiduciary exposure to AI agent actions?
The exposure follows the same logic as any operational risk: directors are expected to satisfy themselves that material risks have owners, controls, and evidence. AI agents now take actions that were previously reserved for employees — payments, data handling, external commitments — so the duty-of-oversight question reaches them. The practical risk is not that the board must understand the technology; it is being unable to answer whether the company can account for what its systems did.
What AI governance red flags should a board watch for?
Four, in reports: adoption numbers with no owner names (agents counted but nobody accountable); 'policy approved' cited as evidence (documents are intent, not execution); pilot-to-production metrics with no governance gate mentioned (programs moving without the review that asks who approved what); and no incident or drill record anywhere in the reporting. Each one says the company is tracking enthusiasm, not accountability.
What should a board require in an AI governance report?
Three things per report: the production agent inventory with named owners; evidence metrics rather than activity metrics — records produced, approvals completed, stop drills passed; and the exceptions log, which shows where governance was overridden and by whom. A report containing all three is describing a governed program; a report containing none is describing a marketing program.
Governing Autonomous AI Agents in Production
Moring provides the runtime control layer, identity verification, human-in-the-loop approvals, and audit records needed to deploy production-grade AI agents safely.
About the author
Balaji Nagaraj KumarChief AI Officer, Moring AI, Moring AISweden
Leads platform and delivery engineering at Moring AI, turning each engagement into a substrate the customer’s own team operates at handoff. His background spans developer-platform leadership at Volvo Cars and engineering at CERN. He writes about governance for agents that take actions in production systems.
LinkedIn profile
