Tier 4: Board and market exposure controls

Board oversight of AI governance

Board-level structure and reporting that ensures AI risk is governed like other enterprise risks, with clear accountability, cadence, and escalation.

Board-defensible evidence

Board or committee charter language defining oversight responsibilities for AI risk, including which committee owns which decisions and how AI is included in enterprise risk oversight.
Board reporting packs showing AI inventory status, risk tier distribution, incidents, exceptions, and key risk indicators, with a consistent cadence and documented follow-ups.
Decision minutes showing board or committee engagement with AI risk, including questions raised, actions requested, and management responses with due dates.
Escalation protocols showing when AI issues must be brought to the board, what constitutes a material AI event, and who is responsible for notification and documentation.
Periodic effectiveness review evidence showing the board assessed whether oversight is sufficient, including training, external briefings, or independent review where needed.

Oversight is judged by records of attention and action, not by claims that the board was "aware."

Twelve questions, scored across all four tiers, with your gaps named — or take the whole framework into your next meeting.