AI Governance

AI Governance: Seven Questions Every Board Should Ask

Artificial intelligence is no longer a technology initiative that boards can leave entirely to the IT function. AI systems are increasingly embedded in decisions involving customers, employees, pricing, risk, financial analysis, cybersecurity, content creation, and even the information presented to senior management itself.

As adoption expands, the question facing the board changes. It is no longer simply: Should we use artificial intelligence? The more important questions are: Where are we using it? What value do we expect it to create? What risks are we prepared to accept? And who remains accountable when AI influences an important decision?

In Saudi Arabia, these questions are increasingly connected to the broader regulatory and institutional environment. In April 2026, the Saudi Data & AI Authority (SDAIA) issued the National AI Risk Management Framework, designed for both public- and private-sector organizations and providing a methodology for identifying, assessing, treating, and monitoring AI-related risks. SDAIA’s AI Ethics Principles also address areas including fairness, privacy and security, reliability and safety, transparency and explainability, and accountability and responsibility.

None of this means that board members need to become experts in algorithms or large language models. The requirement is different: the board needs to understand enough to ask the right questions, ensure clear accountability, and confirm that controls are proportionate to the impact of each use case.

Question One: Where Are We Actually Using Artificial Intelligence?

The answer may appear obvious, but in many organizations it is not. There may be officially approved AI projects while employees are simultaneously using external generative AI tools to draft reports, summarize meetings, analyze customer files, or support software development. Meanwhile, enterprise systems purchased for entirely different purposes may now contain AI capabilities that did not exist when they were originally procured.

The starting point for governance, therefore, is not a lengthy policy document. It is having a clear view of AI use cases across the organization. Management should know which systems are being used, who owns them internally, what data they access, which decisions or processes they influence, and whether they were developed internally or supplied by a third party.

More importantly, the board should not expect every use case to be governed in the same way. A tool that helps an employee format a presentation does not carry the same level of risk as a system that influences a hiring decision, credit assessment, or the processing of sensitive personal data. Effective governance therefore begins by classifying use cases according to their impact and risk, rather than imposing the same level of oversight on every tool.

This risk-based approach is consistent with Saudi Arabia’s National AI Risk Management Framework and with the NIST AI Risk Management Framework, both of which emphasize understanding context, assessing risk, managing it, and monitoring it throughout the lifecycle of an AI system.

Question Two: What Value Do We Expect AI to Create?

One of the most serious governance weaknesses does not appear when an organization fails to adopt AI. It appears when AI adoption accelerates without a clear understanding of the value the organization expects it to deliver.

Initiatives may proliferate simply because the technology is available, competitors are using it, or business units want to demonstrate innovation. The board, however, should expect AI investments to be connected to specific outcomes. Is the objective to improve productivity? Enhance the customer experience? Reduce the cost of a particular process? Improve decision quality? Accelerate product development? Or identify risks that traditional methods cannot detect as effectively?

It is not enough for management to report how many AI tools have been deployed or how many employees have been given access to them. These are measures of adoption, not necessarily measures of value. Management should be able to explain what has changed in performance, what has not changed, and whether the benefits achieved justify the cost and the additional risks introduced.

This becomes even more important when AI moves from improving an internal process to directly influencing high-impact decisions. At that point, financial return alone is not sufficient. A solution may be economically attractive and still exceed the level of risk the organization is prepared to accept.

Question Three: Who Is Accountable When AI Influences a Decision?

The presence of an algorithm in the decision-making process does not remove human accountability.

The system may be provided by an external vendor. The model may run on cloud infrastructure managed by another party. Employees may be using a public generative AI platform. But responsibility for how AI-generated outputs are used within the organization cannot remain suspended somewhere between the technology team, the vendor, and the end user.

Every significant AI use case should therefore have a clearly identified business owner, not merely a technical owner. That person or function should be accountable for the purpose of the system, its boundaries of use, the conditions under which its outputs may be relied upon, when human intervention is required, and the escalation process when an error or unexpected outcome occurs.

Accountability is explicitly reflected in SDAIA’s AI Ethics Principles, which emphasize identifying those responsible for the design, development, and deployment of AI systems and establishing appropriate mechanisms to prevent harm and misuse. ISO/IEC 42001 similarly treats AI governance as an organizational management system built around policies, responsibilities, processes, and continual improvement rather than as a stand-alone technical activity.

The board should therefore be able to ask a very simple question: if the organization makes a significant decision tomorrow based on an AI system and that decision proves wrong, who can explain how the decision was reached, and who had the authority to stop it?

Question Four: What Data Does the System Rely On, and Do We Have the Right to Use It?

Artificial intelligence cannot be separated from data. As AI adoption grows, so does the possibility that organizational information will flow into systems, models, and suppliers that were not part of traditional data pathways.

The issue may be as simple as an employee pasting internal text into a public generative AI tool. Or it may be far more complex, with a system relying on customer databases, employee records, or operational data to train a model or improve its outputs.

In Saudi Arabia, this question has direct legal significance whenever personal data is involved. The Personal Data Protection Law (PDPL) and its Implementing Regulations govern the processing of personal data and impose obligations on entities that determine the purposes and means of processing, including requirements relating to data-subject rights, data protection, and the conditions governing transfer and disclosure.

The board should therefore ask more than whether the organization’s data is secure. What data enters the system? Why is it being used? Who can access it? Where is it processed? Does the vendor retain it? Can the vendor use it to improve another model? And what happens to the data when the commercial relationship ends?

These are not minor contractual details. The data on which a system relies can directly affect output quality, individual privacy, the risk of bias, intellectual property, and the organization’s reputation.

Question Five: How Do We Know the System Is Reliable and Fair Enough to Use?

No AI system is entirely free from error. The issue is not acknowledging that reality. The issue is deploying a system as though its outputs were always correct.

A generative AI system may produce inaccurate information with considerable confidence. Another model may become less reliable as data or market conditions change. Bias may emerge that was not apparent during initial testing. This is why system testing cannot be treated as a one-time event completed before launch.

The organization should define an acceptable level of performance and error for each use case. In some applications, a small degree of error may be tolerable because a human will review the result before it is used. But where AI affects individual rights, financial decisions, safety, or critical operations, the required controls and testing should be substantially stronger.

SDAIA’s principles identify reliability and safety, fairness, transparency, and explainability as core elements of responsible AI. The NIST profile for generative AI similarly highlights risks that are particularly relevant to these systems and the need to manage them throughout their lifecycle rather than only at deployment.

Board members do not need to know how the model is tested technically. They do, however, need understandable answers to two questions: How do we know it is performing as expected? And how will we know when it no longer is?

Question Six: Do We Understand Vendor and Cybersecurity Risks?

An organization may use artificial intelligence without developing a single model itself. That does not reduce its exposure to risk; in some cases, it makes the chain of responsibility more complex.

A single solution may depend on an application provider, a model developed by another company, third-party cloud infrastructure, additional software components, and external data. When something goes wrong, knowing who owns what, who controls the data, and who is responsible for reporting an incident becomes critical.

AI procurement should therefore consider more than functionality and price. The organization should assess how data is protected, how access rights are managed, how information is retained, whether customer data may be used to train models, how systems are updated, how incidents are reported, whether subcontractors are involved, and whether the organization can migrate to another provider if risks or contractual terms change.

Within the Saudi environment, organizations should also consider the requirements issued by the National Cybersecurity Authority where they fall within the applicable scope for the organization and system concerned. Current frameworks include the Essential Cybersecurity Controls (ECC 2-2024) and Cloud Cybersecurity Controls (CCC 2-2024), alongside other controls depending on the nature of the systems and sectors involved.

The purpose is not to add unnecessary bureaucracy to innovation. It is to prevent the organization from discovering—only after a problem occurs—that it has become dependent on a vendor, model, or data pathway whose risks were never fully understood.

Question Seven: What Information Should Reach the Board?

An organization may have an excellent AI policy, an internal committee, a register of AI use cases, and established testing procedures. The board still needs to know whether this governance system is actually working.

That does not mean reviewing dozens of individual models or receiving highly technical reports that non-specialists struggle to interpret. The information presented to the board should instead be structured around risk and impact.

The board should understand which AI use cases carry the highest impact, which risks have exceeded approved thresholds, what material incidents or failures have occurred, whether problems have emerged involving privacy, security, fairness, or output quality, and whether there have been significant changes in the vendors or models on which the organization depends.

The board also needs to know whether management can suspend a particular use case when the risk profile changes. A governance system that can approve AI initiatives but cannot pause or modify them when problems emerge is incomplete.

This continuous view is consistent with SDAIA’s National AI Risk Management Framework, which extends beyond risk identification to assessment, treatment, and monitoring. It also aligns with the logic of ISO/IEC 42001, which is built around continual improvement of an AI management system.

Governance Does Not Mean Turning the Board Into a Technology Committee

There are two opposite risks in how boards approach artificial intelligence. The first is disengagement—treating AI as a purely technical matter. The second is becoming involved in operational detail that should remain the responsibility of management and technical specialists.

The board does not need to select models, review code, or determine system architecture. Its responsibility is to ensure that there is a strategy, clear accountability, defined risk boundaries, and sufficient information for effective oversight.

Board members should understand enough to distinguish between a system that provides a recommendation and one that takes an action, between a low-risk experiment and an application that affects individual rights or material financial outcomes, and between an error that can be corrected easily and one that may create legal, operational, or reputational consequences that are difficult to reverse.

The best AI governance is not necessarily the most complex. It is the governance model that directs the strongest oversight to the areas where the potential impact is greatest.

In Saudi Arabia: What Is Mandatory and What Is Guidance?

It is important not to place every AI-related framework under the single label of “regulatory requirement.”

The Personal Data Protection Law and its Implementing Regulations create legal obligations where their provisions apply to the processing of personal data. Likewise, National Cybersecurity Authority controls are mandatory for organizations and systems that fall within their applicable scope under the relevant frameworks.

SDAIA, meanwhile, provides national frameworks and tools that help organizations develop responsible AI practices, including the AI Ethics Principles, the AI Adoption Framework, and the National AI Risk Management Framework issued in 2026. These are important references for building governance capability, but organizations should always distinguish the nature and scope of each document rather than automatically treating all guidance as a legal obligation.

Internationally, the NIST AI Risk Management Framework is a voluntary framework for managing AI risk, while ISO/IEC 42001 is an international standard for AI management systems that organizations can use to establish governance, accountability, processes, and continual improvement.

This distinction matters to the board. Good governance does not exaggerate regulatory obligations, nor does it understate them. It begins by understanding what the organization is required to comply with and what it chooses to adopt in order to strengthen maturity, trust, and risk management.

AI Governance Is Not an Obstacle to Innovation

At first glance, governance can appear to be a collection of approvals and restrictions. When designed well, however, it does the opposite: it allows the organization to move faster because it establishes in advance what is acceptable, who has decision authority, and when a use case requires deeper review.

An organization without a clear framework may oscillate between two extremes: rapid and uncontrolled adoption, or fear of risk that prevents potentially valuable initiatives from progressing.

Mature governance makes it possible to experiment more freely in low-risk use cases, increase scrutiny as potential impact rises, and establish clear boundaries for situations in which human judgment must remain part of the decision process.

That is the balance boards should seek: not how to eliminate every risk, but how to enable the organization to innovate within a level of risk it understands and is capable of managing.

The Board Does Not Need Every Answer, but It Must Know the Questions

Artificial intelligence will continue to evolve faster than most organizational policies can keep pace with it. The strength of the board will therefore not come from trying to understand every new model or tool that enters the market.

It will come from having a governance system that can repeatedly answer seven questions: Where are we using AI? What value do we expect from it? Who is accountable? What data does it rely on? How do we test reliability and fairness? What are the vendor and cybersecurity risks? And what information reaches the board?

If management cannot provide clear answers, the problem is not necessarily that board members do not understand the technology well enough. It may be that the organization has not governed its use well enough.

The question that should remain in front of the board is not: Are we advanced in our use of artificial intelligence?

It is: Do we know where AI creates value, where it can create risk, and who remains accountable in both cases?

---

– This article has been reframed using AI.