Quaintitative

For boards and directors

AI risk management for boards

You do not need to run AI yourself. You need to oversee it, and to show a supervisor that you do.

A board faces the whole AI question at once: strategy, value, talent, resilience, governance. There are broad and generous maps of it, such as the Singapore Institute of Directors' AI Guide for Boards, and they are a good place to start. But the financial sector's risk-management discipline, built over decades and paid for in real losses, has its own demands. Where the broad guides reach into finance, they tend to reach for the FEAT principles: fairness, ethics, accountability and transparency. Good principles, but principles are all they are. They tell you what a good outcome looks like, not how to get there.

This page answers a question a director once put to me, what do I actually need to know, through a financial-sector lens, by connecting the board's view to the MAS AI Risk Management Guidelines (AIRG), which I developed. It starts with the five core areas the AIRG makes a board responsible for, read as plain questions. The areas are the MAS'; the interpretation is mine, and is not regulatory guidance.

Under the MAS AI Risk Management Guidelines (AIRG), AI risk is a board responsibility, not only a technical one. The board approves and regularly reviews the strategic direction for the firm's use of AI, makes sure the risks from AI use sit inside the risk appetite framework, sets clear accountability for who manages those risks, and keeps enough understanding of AI to challenge what it is told. You do not sign off on models; you make sure someone competent and independent does, and that the firm can account for every material use.

The practical test is whether you can answer a few questions about your firm's AI: where it is used, how material each use is, who is accountable, and what happens when something goes wrong.

The five questions I would start with

These are the board's oversight duties from the AIRG, read as plain questions. For each, the common question I hear, and the question I would put instead.

Approve the approach

"Should AI sit in a central team, a hub-and-spoke, or be decentralised to every department?"

The operating model matters, but it is the firm's to choose, shaped by its constraints and strengths, and it need not be binary. The core risk-management question is different: is there one approach that governs AI risk consistently across the whole firm? I call that the spine. Approve the spine, and leave the shape to the firm.

Set the risk appetite

"Does AI need a risk appetite of its own?"

Usually not, unless the firm is starting from a blank slate. Most firms already have a risk appetite, and AI is not a separate new thing; it is used across many areas and touches many risks, so the existing appetites almost certainly apply. Drawing a hard line around an 'AI risk appetite' can be counter-productive. Better to find the deltas AI brings that the existing appetite does not cover, and make someone sensible accountable for each. The useful question is whether your current risk appetite can interlock, as one system, with the new risk deltas AI brings.

Get the roles clear

"Who is the one person who should own AI?"

A single owner is clean on paper and a trap in practice. Hand the champion of AI's value the job of being the final arbiter of its risk, and in the short run incentives win. Hand one person accountability for all of AI and they may still not hold the levers, because the real controls sit in functions they do not run: responsible for everything, able to move nothing. The financial sector settled this long ago with the three lines of defence: the business owns the risk, an independent function challenges it, and audit checks both did their job. AI slots into that structure. The question is whether the spine, and the system of controls around it, make accountability clear across the three lines.

Understand enough to challenge

"Is the board technical enough to understand AI?"

Usually, yes. A board's job is to challenge, not to build. Boards challenge credit and market-risk models all the time without anyone in the room having built one, because the reporting, the validation and the limits are laid out in a form they can interrogate. AI is the same. The failure is rarely that directors cannot understand; it is that they are handed a polished demo instead of something they can interrogate: an inventory, a risk-materiality rating, and evidence that someone competent checked the work. The question that matters is whether the spine and the system, with the inventory as your watchtower and the ratings, checks and monitoring hanging off it, actually let you challenge what management brings.

Review the approach

"How does governance keep up with a technology that changes every few months?"

The instinct is to chase the technology with a new policy for every model. But the task does not change: fraud detection is fraud detection whether it runs on a rule, a regression, or last week's model, and the task is what defines a good answer and a bad one. Fix 'good enough' to the task and the standard outlives the next model. Review then stops being 'are we keeping up' and becomes a routine check: does each system still clear the bar you set, and has anyone looked lately, since a system can drift past the bar without a line of its code changing? The lasting question is whether there is a clear view of what 'good enough' means for each unit you govern.

These five areas are where a board starts. The deeper version of each question, and where boards get it wrong, is in the book: Boring Questions on AI Risk Management for Directors.

Where to start

I developed the AIRG while leading AI risk supervision at MAS, and now advise boards and their directors independently. I am publishing more on AI risk management; subscribe to get it, and future updates on the AIRG.

Subscribe for updates