AI questions your board will ask in 2026

Why board AI questions are getting more specific#

Board AI questions are getting more specific because directors have moved from asking whether the company has an AI strategy to asking what that strategy rests on. Investors, lenders, insurers and acquirers put similar questions to management, and directors want to know the answers will hold up.

For a CEO, the practical shift is from narrative to evidence. A board told that staff use AI responsibly will ask how anyone knows. A board told that the company's data could be valuable will ask which records, under what rights and approved by whom. Each group of questions below is paired with the document its answer depends on.

Questions about how the company uses AI#

Questions about internal AI use test whether management knows which tools are in use and what goes into them. The honest answer often starts with an admission that usage spread before policy did, followed by what has been done since.

If the register does not exist yet, build it before the meeting by asking each department head which tools their teams use and for what. A partial register with named gaps is a better answer than a confident estimate.

Questions about software vendors and company data#

Vendor questions ask whether outside software providers use company records to build their own AI. Most business systems now ship AI features, and vendor contracts differ on whether a customer's records may help train models that serve other customers.

The answer depends on a vendor terms register: a short table listing each system that holds company records, the clause that governs AI use, whether an opt-out exists and whether it has been applied. Without it, management is guessing. Expect directors to ask some version of each question below.

• 1Which vendors hold our most sensitive records, and what do their terms say about AI training?
• 2Have we used the available opt-outs or admin settings, and who checked?
• 3Who owns outputs generated from our data inside vendor tools?
• 4Have any vendors changed their AI terms since we signed, and who would have noticed?
• 5If a vendor wants to use our data for its AI, should it pay us?

Questions about what the company's records are worth#

Value questions ask whether the company holds records that AI developers would license and what it would take to do so. Directors read about AI data deals and want to know whether the company holds something useful, something risky, or both.

Answer with a metadata inventory rather than a valuation. No reliable price list exists for operational records, and the value of a specific dataset is known only once a buyer engages, so the board needs to know what exists, whether rights are clear and what approval would look like.

Questions about risk, privacy and insurance#

Risk questions ask which privacy laws may apply, how an incident would be handled and whether insurance responds. State privacy laws, sector rules and customer contracts may all bear on how records are used, and counsel assesses them use by use, so the board needs a current data map rather than a general assurance.

Bring the data map with personal data categories, the privacy notices in force, the incident response plan and the relevant insurance policy wording. Directors may ask whether cyber or technology errors coverage contemplates AI tools; if nobody knows, say that the broker will confirm and name a date.

Questions about decisions and approvals#

Approval questions ask who can commit the company on AI matters. The answers sit in documents the CEO may not have opened recently: bylaws or an operating agreement, a delegation of authority, investor rights agreements and credit agreements.

Licensing company records is a good test case. Some investor documents require consent to license intellectual property outside the ordinary course, and some credit agreements restrict transfers of assets, which can include data. Have counsel check before a term sheet circulates, and propose a board resolution that sets the scope management may negotiate. Which consents may apply depends entirely on your own documents.

Illustrative: a manufacturer's CEO builds the AI agenda item#

Illustrative: a fictional precision machining company runs an ERP, a quality management system holding years of NCRs and CAPAs, and a maintenance system for its machines. After a director reads about AI data deals, the board asks the CEO to come back with a view.

The CEO brings four documents instead of a strategy deck: the AI tool register, a vendor terms register for the ERP and quality systems, a metadata inventory of quality and maintenance records, and a note from counsel on approvals. The inventory flags that customer-owned drawings and any export-controlled work must be excluded.

The board approves a metadata-only fit check for internal quality and maintenance records, records the exclusions in the minutes and asks for any license terms to return for approval. The discussion fits in one agenda item because the evidence was ready.

How SourceX supports board preparation#

SourceX gives boards a consistent vocabulary for data value and approvals. The SourceX Enterprise Data Value Framework is a SourceX methodology with qualitative ratings, not prices; it looks at drivers such as uniqueness, domain expertise, human-generated signal, scale, recency and rights, and it treats preparation cost and privacy burden as reducing net value.

Nothing is shared during the initial assessment, and the supplier approves every step of the SourceX five-step transaction, so a board can authorize an assessment without authorizing a release. If the board later approves a license, the SourceX Evidence Packet gives directors one file showing provenance, licensing rights, permitted use, the privacy record and release authorization.