Who it’s for · CIOs and AI governance teams
A board asking for a position on AI is not an audit of your programme. It is the direction from the top that your programme has been working without. AI Board Direction starts from your inventory, your policies and your thresholds, records what the board wants in its own words, and hands back what the CEO can approve alone, the measures the board will ask for, and a board-backed 90-day list.
Not legal advice. Triodian records positions and states what documents show. Whether anything meets a legal obligation, and what your duties require, are questions for your counsel.
What the board decides
The ten steps ask the board for positions, each in its own words. None of them chooses a tool, a model or a control.
The board decides
The board does not decide
Where each step starts
These are the starting points written into the app. The board confirms or changes each one; it does not begin from a blank page.
| Step | Starts from | Then |
|---|---|---|
| Where AI is used | Your inventory: 10 to 20 lines, each with its authority level | Every later position is tested against it |
| Posture | The posture that matches the highest authority your inventory records in each area | The board confirms or changes it |
| Confidential information | What your existing confidentiality, privacy and acceptable-use policies already say | Only the cells no policy covers are left for the session |
| Harm the board will not tolerate | Your existing incident, loss and complaint thresholds, unchanged | A new threshold is set only where none exists |
| What the board expects to hear | Five measures and four kinds of event | Limits, owners and times are settled in the session |
| Who is accountable | The existing committee charter and delegations | The board names an owner for the whole and for each area |
Already past a position?
Some lines in your inventory may already go past a position the board sets. The app’s own wording is that they are not failures: each one becomes an action on the 90-day list, so the board takes its positions knowing what they mean today. The board confirms or changes the posture in each area, so it may not confirm everything in place today. What it does not do is pass judgment on decisions made before it had a position.
What you get back
“Is the board comfortable with this?” becomes a written posture for each area, and a proposal can be checked against it before it is built.
The board lists the events that come back to it. What is not on that list is management’s to decide, and that is now in writing.
What the board expects to hear is agreed in advance, in place of open-ended questions at each meeting.
For the whole and for each area. Accountability is shared with the board that set the position.
The actions that follow are the board’s own, recorded in its minute, and owned by the CEO or the accountable executive.
The app is open source under Apache 2.0. Read every check, run it in your own account, and see the terms and support or how to contribute.
Before the workshop
01
The board adviser, the general counsel and Triodian meet whoever runs AI in the company before the directors’ briefing goes out: what the board will decide, what it will not, and how your inventory is used.
02
You and the owners of each business area supply the lines for the list of AI in use, each with the authority the AI holds today.
03
We ask you to draft the limits, owners and times for what the board will hear. A director or the CEO proposes them in the room.
In the room, positions are proposed by directors, the chair or the CEO, and in a regulated entity the CRO. You take part as the owner of an area or as the accountable executive.
Your roles in the apps
The technology owner is one person, usually the CIO. The AI governance team is as many people as you have. A company with neither runs the engagements as before, with the CEO supplying the inventory.
| App | Technology owner | AI governance team |
|---|---|---|
| AI Board Direction | Takes the management briefing. Confirms each inventory line and each draft measure. | Take the management briefing. Enter and keep the inventory. Draft the measures the board will receive; a director or the CEO proposes them. |
| AI Use Assessment | Supplies the hand-over and confirms it complete. Reads counsel’s updates, can contest a point and ask for a consultation. | The same: supply the hand-over, read the updates, contest a point, ask for a consultation, confirm facts counsel names. |
| AI Risk Appetite | No separate role. | Sit in the risk or AI governance function, which proposes positions with the CRO. |
Neither role proposes or records a board position. AI Board Direction also produces a framework crosswalk for you: for each step, what the board recorded beside the ISO/IEC 42001 clause and the NIST AI RMF subcategory it bears on. It states what is recorded; it is not a statement of conformity.
In a use assessment
Regulated entities follow the board’s direction with a risk appetite and then an AI Use Assessment, which is prepared for counsel. From the hand-over on, each AI use is classified independently of the teams that run it. What the law requires is for counsel to determine.
| Stage | What you do | What comes back |
|---|---|---|
| Hand-over | List the inventory of AI in use, the evidence for each arrangement and what existing assurance already covers: what each item is and where it is held. Confirm it complete. | After that you change nothing, unless counsel or Triodian reopens it with the reason. |
| Updates | Read each update: the authority tier, the failure consequence and the evidence rungs for each entry, and where evidence is not yet known. | Counsel releases each update and decides what it carries. It holds no legal determination unless counsel chose to include one. |
| Contested points | Contest any point in an update, with your reason and the evidence it rests on. | An assessor accepts it and revises, or keeps the position and says why. Both stay on the record and go to the independent reviewer. |
| Consultations | Ask for a session with counsel and Triodian. | It is recorded once held, with its outcome. |
| Facts to confirm | Answer each fact counsel names as correct or not correct, with the correction. | You see those facts only. |
| At close | Nothing further. | Any AI use found that was not on the inventory goes to the arrangement owners in the hand-back list. |
You see your hand-over and what counsel has released, not the register or the questions to counsel. Whoever supplies the hand-over is not the independent reviewer.