What the Board Should Be Asking About AI Before Approving the Budget

Microsoft is pushing Copilot hard, and so are Google, Salesforce, and other software vendors. The pitch lands at the C-suite level, gets handed to IT, and can reach the board as a budget line with a productivity multiplier attached.

Boards often approve it. They can ask more questions first.

AI investment can pay off. The risk this post covers is narrower: approving the budget without understanding what has to be true in your environment first can turn a well-intentioned AI investment into a liability.

Here are four questions a board can ask before approving an AI budget.

“Has our environment been assessed, or are we assuming we are ready?”

Boards may not ask this because the assumption is that IT would have flagged a problem if one existed. That assumption can break down: the gaps that create AI risk are not always the ones that cause day-to-day operational problems. IT teams optimize for uptime and user productivity. Data governance gaps that do not trigger help desk tickets can go unprioritized.

An organization can run Microsoft 365 smoothly for years while its SharePoint permissions are a mess, its data loss prevention policies are in audit mode rather than enforce mode, and its sensitivity labels are inconsistently applied. None of that causes visible problems until an AI system starts surfacing confidential content to people who technically have access but should not practically have it.

The board can ask for a readiness assessment result in place of an IT team’s reassurance.

“What data could our AI system reach, and who would know?”

Copilot and similar AI tools operate with the permissions of the user running them. If a senior manager has accumulated access to folders and SharePoint sites from five years of project work, Copilot can reach everything that manager can reach, and will use it when generating responses.

In many organizations, no one has a clean answer to what any given user can access. Permissions accumulate over time. People change roles. Projects end but access does not get revoked. The result is that AI deployment, in an unassessed environment, effectively gives every user a tool that can surface anything they have ever been granted access to, whether or not that access was intentional.

The board’s question is whether anyone has mapped the data exposure before the system goes live.

“What is our liability position if AI surfaces the wrong information?”

Legal and finance belong in the room alongside IT for this one. Three areas of liability apply before deployment is approved.

Internal. An employee uses Copilot and receives a response that includes compensation data, personnel information, or business strategy documents they were never meant to see. The exposure is internal, but the consequences (HR, legal, trust) are real.

Regulatory. Depending on your industry, surfacing certain categories of data through an AI system to someone without authorization may trigger notification obligations under HIPAA, GDPR, state breach notification laws, or sector-specific regulations. Many organizations do not know whether this applies to them until it is relevant.

Insurance. Some cyber insurers may ask about AI governance at renewal, and some policies may tie coverage to documented controls. Ask your broker what yours requires.

A board that approves an AI budget without understanding these three vectors is approving risk it has not priced.

“What is our response plan if something goes wrong after deployment?”

This question is about whether the organization has thought past the launch date. An AI deployment that surfaces the wrong data or creates a security incident may need a response plan beyond the standard data breach playbook, because the path of exposure is different.

Before approving deployment, the board can ask what the rollback or containment procedure looks like. Two concrete points to ask about: who can switch off Copilot access, and how affected content would be identified. The answers show whether anyone has thought it through.

None of these questions require technical expertise to ask. They are the same governance questions a board asks of any major technology investment.

A board can ask for evidence that the readiness work happened before it approves the budget, not after the system is live. Treating readiness as an IT detail leaves the board without that evidence.

Sources

• Microsoft Learn: What is Microsoft 365 Copilot
• HHS: HIPAA Security Rule
• EUR-Lex: General Data Protection Regulation (Regulation (EU) 2016/679)