The board's assurance is only as good as the report behind it.
Evidence for the minutes, not a slide of good intentions.
You are accountable for how the business uses AI whether or not you can see it. The question is not whether to govern it. It is what you would show a regulator, an insurer or an auditor if they asked today.
of boards have limited or no knowledge of AI, and 31% do not have it on the agenda.
Deloitte, Governance of AI, 2025the date from which listed companies must declare how effective their material controls are, under Provision 29 of the UK Corporate Governance Code.
Financial Reporting Council, 2024 Codeof organisations whose boards discuss AI at every meeting are high-return, against organisations that rarely do (consultancy survey: an association, not proof).
Protiviti, 2026Six things a director is accountable for and finds hard to see.
of boards have limited or no knowledge of AI, according to Deloitte's 2025 research.
Deloitte, Governance of AI, 2025Reports describe intent, not behaviour. What it costs you: you cannot test the assurance you are relying on.
Directors are not expected to be technical. They are expected to ask. What it costs you: a discussion that stays at the level of enthusiasm or fear.
A strategy page with nothing behind it fails at the first follow-up. What it costs you: an answer that falls apart when a regulator or insurer asks further.
Listed companies must now declare the effectiveness of controls that matter most to long-term sustainability, and say where they failed. Others increasingly follow this as good practice. What it costs you: a declaration you cannot support for the AI you use.
Insurers have started to ask for an AI policy, framework, training and monitoring evidence (Lockton, reported in Legal Futures, March 2026). What it costs you: terms, price or cover.
56% of chief executives report no significant financial benefit from AI (PwC, 2026). What it costs you: investment approved on hope, with no measure to stop or scale it.
The board does not govern the technology. It governs five questions, asked regularly.
What AI is in use? Who owns each use? What does it cost and return? Which rules apply, and are they followed? What evidence exists? A board that asks these five questions every quarter, and receives the same one-page answer each time, is doing the job. The document matters less than the rhythm. Boards that discuss AI regularly are associated with better returns, though that is an association, not proof. The practical aim is a report that management can produce without a project each time.
Association from Protiviti (2026, consultancy survey). Not proof of cause.
Six things that give a board a report it can rely on.
Board Report, Usage Insight, Register and Value Register are in early access. Evidence Packs and Compliance Mapping are available. We confirm in writing what you receive.
Board Report brings usage, spend, issues and value onto one page on a regular cycle, drawn from the record, so nobody assembles it by hand.
About Board ReportThe AI Effectiveness Index scores adoption, control, efficiency and return from your own answers and data. The method is explained in the audit, so the board can test it. It is a management tool, not an assurance.
Register shows the tools, accounts and agents in use and who owns each.
About RegisterWhat AI returnsValue Register records benefit and cost side by side for each use, using figures your teams record.
About Value RegisterEvidence for the minutesEvidence Packs produce the register, data-flow map, control matrix and exception log for any period.
About Evidence PacksControls mapped to standardsCompliance Mapping maps controls to ISO/IEC 42001, UK GDPR and the 2025 Act, SOC 2 and Cyber Essentials and names the gaps. We prepare the evidence; accredited bodies issue certification.
About Compliance MappingThree moves for the chair and the audit and risk committee.
Three routes, matched to what a board commissions.
AI Strategy and Planning with your board, and an independent audit that gives non-executives a view not filtered through management.
See advisoryProductBoard Report and Evidence Packs keep the board's view current. Hosted in your AWS or Azure account, or by GenWA on AWS as agreed.
See Board ReportIncubatorIf the board backs an AI-run function, we define, build and run it with a named owner and a record, and you can take it back.
See the IncubatorThe three executives the board will rely on.
Owns the answer to the five questions and the pace of adoption.
For the CEOChief financial officerOwns the cost and return view, and the material-controls declaration where it applies.
For the CFOCompliance and General CounselOwns the rules, the record and the evidence for a regulator or insurer.
For Compliance and General CounselA leisure operator was told to stop using facial recognition to monitor staff.
In 2024 the Information Commissioner's Office ordered Serco Leisure and related companies to stop using facial recognition and fingerprint scanning to monitor the attendance of more than 2,000 staff, and to delete the data. There was no AI-specific fine. The point for directors is that the risk needed to be assessed before the system was switched on, and the board could have asked for that assessment.
ICO enforcement notice, February 2024. Public regulator action. GenWA had no involvement.
Want to see the board view?
Book a demo and we will walk through a board report built from example data.
Keep reading
Straight answers.
What should a board ask about AI?
Ask what AI is in use, who owns each use, what it costs and returns, which rules apply and whether they are followed, and what evidence exists. Ask for the same one-page answer each time so movement is visible. Board Report is built to produce that page on a regular cycle.
What is the AI Effectiveness Index?
A score across adoption, control, efficiency and return, calculated from your own answers and data. The method is explained in the audit so the board can test it against its own questions. It is a management tool, not a certification or an assurance.
Is AI governance a board matter or a management matter?
Management runs it. The board decides what to ask for and how often. Deloitte's 2025 research found 66% of boards have limited or no AI knowledge, so a short, regular report helps directors do their part without becoming technical experts.
Does Provision 29 of the Corporate Governance Code apply to AI?
Provision 29 applies to listed companies for financial years starting on or after 1 January 2026. It requires a declaration on the effectiveness of material controls. Whether AI controls are material is the board's judgement. Other organisations often use it as good practice. Take legal advice.
Can we trust a vendor's own index?
It is calculated from your answers and data, and the method is explained so you can test it. It is not a certification. For independent assurance on your controls, use accredited bodies. We prepare evidence; certification is issued by accredited bodies.
What evidence can the board show an insurer or regulator?
Evidence Packs contain the register, data-flow map, control matrix and exception log, control-mapped to ISO/IEC 42001, UK GDPR and the 2025 Act, SOC 2 and Cyber Essentials. The insurer or regulator decides what is sufficient. This supports compliance and is not legal advice.
How does a board get started?
Ask management to run the AI health check, using the questionnaire, a usage-export check or a visit. The board then sees one summary of use, cost, control and next steps. Advice, product or an agent function we run for you can follow, if the board chooses.
Ask for the five answers.
First step: the AI health check. Indicative audit fees exclude VAT and are confirmed in writing.