Insights · Framework
Board questions on AI visibility and security
Boards are asked to oversee two things they rarely see: how the organization is found and described by AI systems, and how AI and security risk are governed. These questions give directors a structured way to ask, and management a standard for what a credible answer looks like.
How to use it
Before the first step.
- Ask the questions on a cycle; the answers should improve and the evidence should accumulate.
- An answer without evidence is a topic for the next meeting.
Steps
Each one owned and evidenced.
| # | Step | Owner | Evidence |
|---|---|---|---|
| 01 | How do answer engines describe us today, and is it accurate? | Marketing lead | Baseline audit and share-of-voice report |
| 02 | For the questions our buyers ask, who is cited, and are we among them? | Marketing lead | Competitor citation benchmark |
| 03 | What proportion of our demand would continue if paid spend stopped? | Marketing lead | Source analysis and earned-demand share |
| 04 | Who signs the content we publish, and how are claims verified? | Editorial lead | Editorial standards and verification records |
| 05 | Where is AI in use across the organization, and who is accountable for each use? | Governance lead | AI use register |
| 06 | Which AI uses could cause consequential harm, and what assessment and oversight apply? | Governance lead | Impact assessments |
| 07 | What do our AI vendors do with our data, and have we verified it? | Governance lead | Vendor and model risk reviews |
| 08 | What is our security posture against the frameworks our customers and insurers expect, and who verified it independently? | Security lead | Independent assessment report |
| 09 | Could we recover critical services from a ransomware attack without paying, and when did we last prove it? | IT lead | Restore test and readiness review records |
| 10 | When did leadership last exercise an incident, and what did it change? | Security lead | Exercise report |
| 11 | Which risks have we formally accepted, who accepted them and when do they expire? | Security lead | Risk acceptance register |
| 12 | What evidence could we produce tomorrow for a regulator, customer or insurer, and what could we not? | Compliance lead | Evidence pack index and gap list |
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days