How to report AI security to the board
The board asks one question: is our AI safe? Here is how to answer it on one page.
The one-page board report. The answer at the top, three board lines, the top three gaps, and a six-row evidence table with dates and owners. A4, prints without scaling.
Download the one-page PDF
Yes or no is the wrong answer
Boards do not speak model architecture. They speak material risk, regulatory exposure and whether the business can use AI without ending up on the front page. Lead with prompt injection and data poisoning and you can lose the room quickly.
Not yes or no. Evidence you can defend, with a date and an owner.
Answer first, then three pillars
Put the answer at the top, Pyramid Principle style: we are enabling AI safely; we can see our AI; we control what it can expose; we can show how fast we act. Three pillars hold it up.
- Visibility. Sanctioned against shadow AI. Two pieces of evidence: Listed (the inventory row from Day 1) and Told (the one-page rules from Day 15, plus tools people declared last month).
- Exposure. What data can leave. Allowed (the signed permission set from Day 30) and Watched (the last detection drill from Day 60: did the alert fire, who acknowledged it, how long it took).
- Defensibility. Timed (the six clocks from Day 45: how fast you can revoke, and whether stop has been tested), with each applicable framework mapped to evidence, not intentions.
Three lines and three gaps
- How many AI uses are listed with an owner.
- How many live agents have a signed permission set and a tested stop.
- What the last drill found.
Then the top three gaps, each with an owner and a date.
A gap is allowed. An undated gap is not.
Not the headline
Counts of policies, training completion, tools bought and the volume of data your DLP blocked may all matter. They show activity, not control, so keep them as supporting detail.
What I would do this week
- Pick one agent that is already live.
- Fill in the five pieces of evidence and the framework row.
- Put a date on every gap.
- Take the page to your next leadership meeting.
What this page is not
It is not legal advice or a compliance assessment. Whether the EU AI Act or other rules apply to you is a question for your legal and compliance teams. The page is a CompoundTrust starting framework, not a standard.
The same material, narrated: Day 90, the Season 2 finale of The First 90 Days, on the CompoundTrust channel.