Tier 4: Board and market exposure controls

AI-related financial and risk disclosures

Disclosure of AI-related risks and impacts that could influence financial performance, operations, legal exposure, or strategic outcomes.

Board-defensible evidence

Materiality assessment records showing how AI risks were evaluated for financial reporting and disclosure, including who performed the assessment, what criteria were used, and approval dates.
Risk factor drafting files showing how AI risks were described, what evidence informed the language, and legal review sign-off, including version history and rationale for changes.
ERM integration evidence showing AI risks mapped into enterprise risk registers, with owners, controls, KRIs, and periodic reporting to audit or risk committees.
Incident and loss event records showing AI-related operational disruptions, remediation costs, claims, regulatory inquiries, or contractual impacts, and how they informed disclosures.
Board oversight documentation showing AI risk disclosures were reviewed at the appropriate level, including minutes and management responses to committee questions.

Disclosures are judged on whether leadership had a defensible basis for what was said and what was omitted.

Twelve questions, scored across all four tiers, with your gaps named — or take the whole framework into your next meeting.