Boards have been briefed. They have seen the demo. They have approved a budget large enough to be visible and small enough to be deniable. What they often have not done is interrogate the company like owners. Generative AI is not a single project. It is a class of operational risk that happens to look like a product.
Here are six questions that fit in a committee packet. If management cannot answer them in plain language, you do not have a program. You have a vendor relationship.
1. Where does customer data go, in fact?
Not the policy PDF. The actual path: which tools, which regions, which logs, which subprocessors, which “improvement” toggles are on by default. If the answer is “we think legal signed off,” keep asking.
2. What decision is the model allowed to finish?
Drafting a memo is not the same as issuing a credit decision, a medical summary, or a support refund. Draw the line in writing. Ambiguity here is how you get a headline.
3. Who is accountable when it is wrong?
A committee is not an owner. Name a role, a review path, and a kill switch. If the only answer is “the vendor’s SLA,” you have outsourced judgment you still own.
Possibility is a sales word. Permission is a board word.
4. What is the unit cost at the volume we claim?
See the startup piece in this issue. Seats are not economics. If the plan assumes infinite cheap tokens, the plan is a wish.
5. What do we stop doing?
If nothing is retired — no overlapping copilots, no legacy process, no headcount plan that changes — this is additive spend. Additive spend needs a higher proof than “everyone else is doing it.”
6. How will we know in 90 days?
Pick one or two operating metrics, not a sentiment survey. Cycle time, error rate, cost per ticket, win rate. Put the date on the calendar now. Boards that skip this will still be watching demos next summer.
None of this is anti-AI. It is pro-fiduciary. The technology is real. So is the ability of organizations to confuse motion with return.