The Board asked what we're doing with AI. Now what?

You're reading The AI Directive — practical AI intelligence for business leaders. Subscribe here if someone forwarded this.

There is a question a lot of leaders are being asked now:

It sounds simple. It is not.

The weak answer is a list of tools.

Copilot licences. ChatGPT usage. A proof of concept. A few teams experimenting with prompts. A vendor demo. Maybe an internal AI working group with a serious-sounding name.

That is activity. It is not yet a strategy.

Another weak answer is a promise:

All potentially true. None of them enough.

The Board question is not really asking whether AI exists in the business. It almost certainly does. People are using it officially, unofficially, experimentally or quietly.

The better question underneath is:

That is the standard I would take to a Board.

Not:

But:

That changes the conversation.

It also stops AI becoming a visible burst of activity with no real control.

AI is very good at generating activity: workshops, demos, prompt libraries, pilots, Teams channels, supplier briefings, governance policies, adoption dashboards.

Some of that will be useful. Some of it will just be noise.

The leadership work is to separate four things:

✅ Where AI helps people work better
Drafting, summarising, comparing, preparing, finding, structuring and thinking.

🔁 Where AI improves a business workflow
Faster handoffs, better decision notes, fewer errors, clearer customer responses, improved cycle time, less rework.

⚠️ Where AI creates new risk
Data exposure, poor judgement, weak source material, unmanaged external communication, uncontrolled agents, over-reliance on confident output.

💷 Where AI deserves more investment
Not because the demo is impressive, but because there is evidence that the work improves and the risk can be managed.

That is the difference between experimentation and leadership.

Traditional disciplines start to feel uncomfortable here. Business cases like certainty. AI does not always give you much certainty at the start. It gives you a direction, a hypothesis, a cost to test, and several ways to be wrong quickly.

That does not mean abandoning discipline.

It means changing the shape of the discipline.

You do not need a six-month business case for every small AI experiment. That is a good way to make sure nothing useful happens until the technology has moved on twice.

But you do need a way to decide which experiments are worth running, what evidence will count, when to stop, when to narrow, when to scale, and who gets to make that call.

This is familiar territory for business transformation:

AI does not remove those three words. It makes them matter more.

The technology is the visible part, and usually the easiest part to over-discuss.

The process question is harder: where does this fit into real work, what changes, what gets reviewed, and what happens when the output is wrong?

The people question is harder again: who trusts it, who resists it, who owns it, who is accountable, who gains capacity, and who has to explain it when it goes sideways?

That is why "what are we doing with AI?" should not be answered from the software catalogue.

It should be answered from the operating model.

If you need to answer the Board question, start with one simple portfolio view.

Not a 40-page AI strategy. Not a vendor landscape. Not a grand statement about transformation.

One page. Five parts.

AI portfolio view

Five parts of a Board-ready AI answer

1. Use case

The actual work AI is being used for, written in plain English.

2. Value hypothesis

What should improve, and how you will know it has improved.

3. Owner

The accountable business owner, not just the tool sponsor.

4. Risk and control

What could go wrong, and the controls already in the work.

5. Next decision

Kill, narrow, rescue, scale or hold. No drift disguised as progress.

That is enough to start an adult conversation.

1. Use case

Write the work in plain English.

Weak:

Better:

If the use case cannot be written as a piece of work, it is probably still too vague.

2. Value hypothesis

What should improve?

Time saved is fine if it is real, but do not stop there. Look for cycle time, rework, quality, risk reduction, response speed, throughput, consistency or capacity.

The useful phrase is:

If you cannot fill in X and Y, the pilot is not ready for serious investment.

3. Owner

Name the business owner.

Not just IT. Not just "the AI working group". A person accountable for whether the work actually improves.

4. Risk and control

What could go wrong, and how are you containing it?

Typical controls:

This is where AI governance becomes practical. Not a policy on a shelf. Controls in the work.

5. Next decision

Every use case should have a next decision:

If the next decision is "continue exploring" three months later, you probably do not have a pilot. You have drift.

Small tests are fine. Unowned tests are not.

Fast experiments are fine. Experiments with no kill criteria are not.

AI enthusiasm is fine. AI enthusiasm with no portfolio view is how cost, risk and expectation get out of shape.

I am collecting the practical AI build notes on the YouTube channel here:

Toby Smith-Firth on YouTube

The useful question is not "what can AI do?"

It is:

1. AI strategy is not a tool list.
If the Board asks what you are doing with AI, answer with a portfolio: use cases, value, risk, owners, evidence and next decisions.

2. AI investment discipline should be staged.
Small tests can move quickly, but each one still needs a value hypothesis, a control model and a decision point.

3. The real leadership question is control.
Can the organisation turn experimentation into an operating model without losing control of cost, risk or accountability?

"Do we need an AI strategy before we let teams experiment?"
— Sensible Board question

You need enough strategy to prevent chaos. You do not need enough strategy to paralyse learning.

I would set a simple rule:

✅ Low-risk personal productivity experiments can start with guidance, approved tools and clear boundaries.

🔁 Workflow pilots need an owner, a value hypothesis, source-control rules, review points and a date for the next decision.

⚠️ Anything that touches customers, suppliers, finance, HR, legal, live records or external communication needs stronger governance before it goes near production.

That is not bureaucracy. It is proportional control.

The point is not to slow everything down. It is to know which things can move quickly, which things need design, and which things should not be happening quietly in the corner.

If you only do one thing this week, build the first version of your AI portfolio view.

Do not make it clever.

List the AI use cases currently happening or being discussed. Add the expected value, owner, risk, control and next decision.

You will learn something quickly.

Either the portfolio is thinner than the rhetoric, or the activity is broader than the governance.

Both are useful discoveries.

Next week: why the traditional business case is often too slow for AI, and what to use instead.

See you Tuesday.

— Toby

@TobySmithFirth on YouTube