Scaling an AI use case is a different decision from trying it. A small pilot can take place within limited boundaries; scaling can change how staff work, how customers experience the organisation and which supplier or data dependencies become material. Before that change is approved, the board needs a clear view of its AI risk appetite.
Risk appetite is a decision about boundaries
A board’s role is neither to eliminate every uncertainty nor to approve AI because the technology appears inevitable. Its role is to decide which opportunities are worth pursuing, what level of uncertainty is acceptable, and where the organisation needs firmer boundaries.
Those boundaries will differ from one organisation to another. A modest internal productivity tool may justify a different approach from a system that influences an important customer, workforce or financial decision. The point is not to create a universal scoring system. It is to ensure that management and the board share a practical understanding of what is acceptable for this organisation, in this use case, at this point in time.
Separate exploration from scale
It is reasonable to explore new tools. But the decision to scale should not be treated as a simple continuation of the pilot. Wider adoption can increase the number of users, the information involved and the organisation’s reliance on a supplier or workflow.
The board should ask what has changed between trial and wider adoption: the significance of the outcome, the level of reliance, or the impact on people. That is where a proportionate discussion of risk appetite becomes valuable.
Decide what must remain under human judgement
AI can support analysis, drafting, triage and routine work. It should not blur accountability. Boards should be clear where human judgement remains essential, who may override an output, and how a difficult or unexpected result is handled.
Directors do not need to supervise individual tools or prompts. They do need confidence that management has considered real-world use, that staff understand their role, and that operational owners can raise concerns before they become entrenched.
If you want to discuss this important topic further, contact me. The right level of oversight should reflect the organisation and the use case, rather than a generic checklist.
Understand the dependencies that grow with scale
Risk appetite is also about reliance. A use case may depend on particular data, a supplier’s availability, a changing commercial relationship or a small group of people who understand how the work is being done. These dependencies may be manageable in a pilot but more consequential once the service is widely used.
Directors do not need an exhaustive technical account. They do need to know where the organisation is becoming dependent, who owns that relationship, and what management would do if performance, terms or business requirements changed. Good oversight keeps those questions visible while there is still room to make choices.
Ask for evidence before expansion
Before approving wider adoption, the board should expect evidence that the initiative is improving the intended outcome: operational results, user experience, workload and emerging issues. A persuasive demonstration is not evidence of value in normal operations. A pilot that uncovers a poor fit can still be useful if it leads to a timely decision to redesign or stop.
Make the position usable
An AI risk appetite statement should help people make better decisions, not become a document that is filed away. The practical test is whether directors and executives can explain why a use case is within the organisation’s appetite, what conditions apply, and what would cause them to reconsider.
For a confidential discussion about board AI governance, risk appetite and responsible expansion, contact me.