Reporting AI risk to a board that doesn't speak security

Boards are asking about AI risk with increasing specificity, and the security teams answering them often reach for the wrong vocabulary. Control families and model taxonomies do not move a board. Exposure, cost, and liability do.

Translate findings, keep the substance

A finding like "unsanctioned AI tools have access to customer data" translates cleanly: here is the data that could leave our custody, here is the regulatory posture if it does, here is what containing it costs versus what an incident costs. The technical detail stays in the appendix, intact, for the directors who want it.

Report posture, not incidents

The most useful board artifact is not a list of events. It is a statement of where the organization stands: what is inventoried, what is governed, what is knowingly accepted, and what is still unknown. That last category, honestly sized, is what earns credibility.

Anchor to a decision

Every board presentation should end with something the board can decide: a risk acceptance, a budget line, a policy ratification. Reporting without a decision attached trains the board to treat AI risk as background noise.