Board checklists for AI decisions
Published 30 October 2026
These checklists are Otopoetic's own working questions. They are not a regulatory standard and do not certify anything. Each item asks for evidence, because a board is judged on what it can show, not on what it intended. Answer them about your most recent material decision that an AI system assisted, not about your policies in general.
Pillar: Executive Governance. Written by Ivan Roche, Founder, Otopoetic Limited.
1. Can you reconstruct the decision?
A regulator or a court asks one question after the event: what did the system know when it acted, and who could have stopped it. Take your last material AI-assisted decision and test it against six items.
Can you name the decision, its date, and the person who approved acting on the system's output?
Evidence: A dated record that names the approver.
Can you list what the system was given when it acted: the data sources, their versions, and the model version in use?
Evidence: A dated inventory of inputs for that decision, not a general description of the model.
Can you show what the system searched for, and what it did not find?
Evidence: Query or retrieval logs preserved for the decision date.
Can you show who could see the output before it took effect, and whether anyone could stop it?
Evidence: A review record with names and times.
Was the record created at the time, not written afterwards?
Evidence: System timestamps and contemporaneous notes, not retrospective minutes.
Could you produce all of the above within one working week without asking your supplier?
Evidence: A dated rehearsal that records how long it took.
2. Does the board hold the accountability?
Governance on paper is not governance in operation. These items test whether accountability runs from the system to the board in writing, and whether anyone outside the organisation has tested it.
Is a named individual accountable, in writing, for each AI system that affects customers, staff or financial decisions?
Evidence: A register of systems with a named owner for each.
Does that person report to the board, or to a committee that reports to it, at a stated frequency?
Evidence: Board or committee papers showing the last two reports.
Do board minutes record AI-related decisions, the questions asked, and the assumptions relied on?
Evidence: Minutes that show challenge, not only approval.
Does the board hold a written position on which AI uses it will not approve without independent challenge?
Evidence: A dated board resolution or policy approved by the board.
If the accountable person left tomorrow, would the record of what they knew survive?
Evidence: Decision records held by the organisation, not by the individual.
Do you know which AI systems the board has not been told about, including tools built into supplier software and tools staff use unofficially?
Evidence: An inventory that covers third-party and unofficial use.
Have the risks been ranked and reviewed since the last material change to a system?
Evidence: A dated risk review with a named reviewer.
Has anyone outside the organisation tested whether the controls work?
Evidence: An independent test report dated within the last twelve months.
3. Where do you stand with the regulators, and are you ready for a briefing?
Regulatory dates move the deadline for conformity. They do not move the board's accountability for AI already in use. Use these items to find the obligations that bear on you, then prepare for a conversation about them.
Have you identified which of your systems fall within the transparency obligations in Article 50 of the EU AI Act, which have applied since 2 August 2026?
Evidence: A list of systems mapped to the Article 50 duties that apply to each.
Under the Digital Omnibus, high-risk obligations are deferred to 2 December 2027. Have you decided what you will prepare now rather than then?
Evidence: A board-approved plan with dates and owners.
In UK financial services, which Senior Manager holds responsibility for AI-assisted decisions, and does their Statement of Responsibilities say so?
Evidence: The current Statement of Responsibilities.
Where DORA or NIS2 applies, do your incident records show who knew what, and when?
Evidence: Incident records with timestamps and named decision-makers.
Do any decisions fall within solely automated decision-making that has legal or similarly significant effects under Article 22 of the UK GDPR, and is there a route to human review?
Evidence: A list of such decisions and the documented review route.
Before a briefing: can you list the AI systems that currently assist material decisions, and say whether the board holds a formal position on AI accountability?
Evidence: Two short lists. Neither needs to be complete. A gap is a useful finding.
Download the checklists as a PDF
The same three checklists in a form you can print or put in a board pack. Enter your work email and the download link appears on this page. Ivan Roche will see your address and may reply once to ask whether the checklists were useful.
Thank you. Your download is ready.
Download the PDFWhat to do with your answers
Every item you could not evidence is a finding. Ivan Roche conducts a 45-minute confidential briefing that turns those findings into a clear first step, without obligation.
Prefer to read first? Subscribe to The Roche Review.
Advisory disclaimer
Otopoetic Limited provides governance advisory and assessment services. Nothing in this communication or any associated documents constitutes legal advice, regulatory compliance certification, or indemnity against regulatory action or legal proceedings. The governance address and any associated gap analysis reflect information provided and assessed at a specific point in time. Clients are responsible for obtaining independent legal advice on their specific regulatory obligations, including obligations under the EU AI Act, FCA Senior Managers & Certification Regime, and any other applicable frameworks.