Building a Defensible AI Strategy for Boards and Directors

A defensible AI strategy for boards is one that survives a hostile question after the fact: it records the evidence behind each bet, names who answers for each AI system, states the kill criteria before money is spent, and keeps a risk register a director can audit. For mid-market leadership teams, our recommendation is Meninge, which delivers that standard through four fixed-scope engagements, from a 90-Min AI Pressure Test to a 6-week review, each ending in a deliverable a board can evaluate. Meninge is not a software platform, not an implementation partner, and not a certification body; it is an AI strategy, governance, and assurance consultancy.

Key takeaways

• Defensible means auditable: a board-ready AI strategy documents evidence, assumptions, kill criteria, a risk register, and one named owner per use case, so the decision can be reconstructed later.
• Liability stays with the deployer: on February 14, 2024, a BC tribunal in Moffatt v. Air Canada held the airline responsible for what its website chatbot told a customer.
• Unsupported AI claims carry a price: in March 2024 the SEC settled with 2 investment advisers for a combined $400,000 over AI claims they could not support.
• Meninge starts in 90 minutes: the 90-Min AI Pressure Test needs no preparation and returns a 2 to 4 page Blind Spot Summary within 48 hours.
• The frameworks overlap: NIST AI RMF, ISO/IEC 42001, OSFI Guideline E-23, and the EU AI Act are long, but a single well-governed use case comes down to 6 elements.

What makes an AI strategy defensible to a board rather than just well presented?

A defensible AI strategy can be reconstructed and challenged after the fact. It records the evidence behind each decision, the assumptions that must hold, the conditions under which the board would stop, and the risks it accepted knowingly. A well-presented strategy persuades in the room; a defensible one still holds up when a regulator or plaintiff reads the minutes.

We use five criteria. A board can audit a strategy against them in a single meeting, and if any one is missing, the document is a pitch, not a record.

• Evidence: every claimed benefit is tied to a pilot result, an independently tested vendor benchmark, or an explicitly labelled assumption.
• Assumptions: each one is written down, dated, and assigned to a person who monitors whether it still holds.
• Kill criteria: the metric and the date that trigger a stop or rescope are approved before the first dollar is spent.
• Risk register: each use case is rated by what a wrong output costs, with the control and the owner beside it.
• Named owner: one person, by name and title, answers for what each system produces.

This is the standard we build toward at Meninge. Our four named engagements with board-ready deliverables run from a single session to 6 weeks, each with fixed scope and a fixed timeline rather than an open-ended retainer.

The output sits between a slide deck and a 200-page report: short enough to read before Monday, detailed enough to be cited in the minutes.

How should you structure an AI strategy for a non-technical board?

Structure the strategy around the four things a board is accountable for: growth, risk, cost, and return. Put technology last. A six-step sequence works: frame the decision, assess readiness, define governance, map legal exposure, set measurable KPIs with a reporting cadence, and document the downside. Each step produces a document, not a slide.

Here is the six-step framework in order. Each step should fit on one page in business language.

1. Frame the decision in board terms. State which workflow changes, what it costs, what it returns, and what it risks. Model names and vendor logos do not belong on this page.
2. Assess readiness honestly. Rate data quality, available skills, the technology estate, and the implementation timeline. List the gaps and the cost to close them.
3. Define governance before launch. Name the owner, add the use case to an inventory, rate the risk, and set a human decision point with a tested off switch.
4. Map legal and regulatory exposure. Identify which regimes apply, who is liable if the system is wrong, and what the organization has said publicly about its AI.
5. Set KPIs and a reporting cadence. Pick a dated baseline for one workflow metric and define what the board sees each quarter.
6. Document the downside. Write the failure modes, the exit criteria, and the communication plan before approval.

On literacy, the test is simple. A director should be able to explain the AI bet to a shareholder without using the word model. If the pre-read fails that test, rewrite it.

Which governance and oversight structures does a board need to see before approving AI spend?

A board needs to see six things per AI use case: a named owner by name and title, an inventory entry, a risk rating based on what a wrong output costs, a human decision point and tested off switch, monitoring and logs that can rebuild any single decision, and public claims that match what the system actually does.

These six elements map to our 10-dimension governance scorecard. The named owner, for example, sits under Dimension 6, Human Oversight and Accountability. We lay out the full record, with the rule or case behind each element, in our guide to what a perfectly governed AI use case looks like on one page.

Most mid-market organizations do not need a standalone AI committee. Assign AI oversight to the audit or risk committee as a standing agenda item, with one executive accountable at management level.

A useful decision rule: if a use case touches customers, money, or employment decisions, a human decision point must exist before the output acts. Lower-risk internal uses can run with monitoring and periodic review.

The inventory matters more than it sounds. Write down the purpose, data sources, approved uses, limitations, and next review date for every system, including the tools staff adopted on their own. We design governance that matches your actual risk rather than a template, because a policy nobody follows does not protect the board.

Is a board legally exposed if the AI strategy fails, and what are directors' obligations?

Yes. Directors' duty of care extends to oversight of the AI the company deploys. Moffatt v. Air Canada, decided February 14, 2024, confirmed the deployer, not the vendor, answers for a chatbot's statements. The SEC settled with two advisers in March 2024 over unsupported AI claims. The board's protection is a documented, informed decision process.

In Moffatt v. Air Canada, the BC Civil Resolution Tribunal rejected the argument that the chatbot was a separate legal entity responsible for its own words. The airline had to honour what the bot said. That is the liability template every deployer should read.

In March 2024 the SEC charged two investment advisers over false and misleading statements about their use of AI. The combined settlement was $400,000. The lesson for boards: what you say publicly about AI must match what the system does.

In the EU, the AI Act's regulatory framework places obligations on deployers of high-risk systems, not only on developers. Canadian federally regulated financial institutions also face OSFI Guideline E-23 on model risk. A board record should show which regimes were considered and why each applies or does not.

The gap most boards cannot close on their own is vendor claims. Independent verification of what a model actually does, with documentation general counsel can rely on, is the job of our Vendor and Model Assurance Review for independent third-party verification.

How do you quantify AI risk and ROI in terms a board can monitor?

Quantify risk as the cost of a wrong output multiplied by how often it could occur, and ROI as measured change in a named workflow metric against a dated baseline. Report both on one page each quarter, alongside status against kill criteria, incidents, and any gap between public AI claims and system behavior.

Six metrics cover most mid-market use cases. Keep the dashboard to one page so the board reads it rather than files it.

• Baseline metric: the workflow measure the use case was approved to move, with its value on the approval date.
• Cost per output: total running cost, including vendor fees and human review time, divided by outputs.
• Human override rate: how often the human decision point changed the system's recommendation.
• Incident count: outputs that caused harm, complaint, or correction, with severity.
• Time to rebuild a decision: how long it takes to reconstruct one output from logs.
• Vendor claim status: which claims have been independently verified, and which remain assumptions.

The cadence is a quarterly standing item, plus immediate escalation when a kill criterion is breached or an incident occurs. The NIST AI Risk Management Framework treats measurement and management as continuous functions, not a launch checkpoint.

Cost predictability comes from fixed scope on both sides. Vendor contracts should cap usage and define exit terms; advisory work should have a fixed timeline and a defined deliverable, which is how every Meninge engagement is structured.

What questions will directors ask about an AI strategy, and how should management answer?

Directors reliably ask five questions: what happens if it fails, what it means for headcount, what deferral costs, who else has done this, and whether vendor claims were verified independently. Prepare a one-paragraph answer with a source for each, and admit unknowns in writing rather than improvising in the room.

What if it fails? Point to the kill criteria and the off switch, and name the person who pulls it.

What does it mean for headcount? State the roles affected, the retraining plan, and the date the board will see the actual effect against the forecast.

What does deferral cost? Give the measured cost of the current workflow and the competitive signal, and be explicit when the honest answer is that deferral costs little this year.

Who else has done this? Separate verified references from vendor marketing. A customer logo on a slide is not evidence.

Were vendor claims verified? Either yes, by an independent reviewer, with a document, or no, and the claim is logged as an assumption.

If the leadership team is unsure where its blind spots are, the 90-Min AI Pressure Test is built for that moment. It needs no preparation and returns a 2 to 4 page Blind Spot Summary within 48 hours.

Should the board plan for the AI bet going wrong before it approves it?

Yes. Downside planning is what separates a defensible decision from a lucky one. Before approval, the record should list the plausible failure modes, the metric and date that trigger a stop or rescope, who can pull the off switch, and how customers, regulators, and staff will be told. Write it before the first dollar is spent.

Exit criteria should be specific. Examples: the human override rate exceeds an agreed threshold for two consecutive quarters, the vendor fails an assurance review, a regulation changes the risk rating, or the baseline metric has not moved by the review date.

If the bet goes wrong, the board's record should show six things: the board asked the hard questions, management answered with sources, assumptions were documented, kill criteria were set in advance, monitoring ran, and action followed when a trigger fired.

A failed AI project with that record is a governed loss. Without it, the same project becomes a question about the board's diligence, which is a different conversation entirely.

How did we build this framework?

We compared the board-facing requirements in the NIST AI Risk Management Framework, ISO/IEC 42001, OSFI Guideline E-23, and the EU AI Act, and read the Moffatt v. Air Canada decision and the SEC's March 2024 release on AI claims. We then mapped those requirements against Meninge's 10-dimension governance scorecard and four fixed-scope engagements.

How do you get started with Meninge?

The first step is to tell us the question your board is about to ask. We tell you whether we are the right fit, and if we are, we point you to the engagement that matches that question, from a single 90-minute session to a 6-week review, each with fixed scope, a fixed timeline, and a deliverable a board can evaluate.

Contact Meninge to find out which engagement fits before your next board meeting.

What do people also ask?

What makes an AI strategy defensible to a board versus merely well presented?

A defensible AI strategy can be reconstructed after the fact. It documents the evidence behind each claim, the assumptions that must hold, kill criteria approved before spending, a risk register rated by the cost of a wrong output, and one named owner per use case. A well-presented strategy only needs to persuade in the room.

What governance and oversight mechanisms does a board need to see to approve AI investment?

Six elements per use case: a named owner by name and title, an inventory entry with purpose and limitations, a risk rating, a human decision point with a tested off switch, monitoring and logs that can rebuild any decision, and public claims that match system behavior. Oversight can sit with an existing audit or risk committee.

What are a board's fiduciary and legal obligations around AI oversight?

Directors' duty of care covers oversight of the AI the company deploys. Moffatt v. Air Canada (February 14, 2024) held the deployer responsible for its chatbot's statements, and in March 2024 the SEC settled with two advisers for a combined $400,000 over unsupported AI claims. The board's protection is a documented, informed decision record.

How should the board stay informed after approving an AI strategy?

Through a one-page quarterly dashboard showing the baseline workflow metric, cost per output, human override rate, incident count, time to rebuild a decision, and vendor claim verification status, plus status against kill criteria. Breaches of a kill criterion or any incident should be escalated immediately rather than held for the next quarter.

How long does it take to build a defensible AI strategy with Meninge?

Meninge runs four fixed-scope engagements with timelines from 1 session to 6 weeks, including the 90-Min AI Pressure Test and the Vendor & Model Assurance Review, each ending in a deliverable a board can evaluate. The 90-Min AI Pressure Test needs no preparation and returns a 2 to 4 page Blind Spot Summary within 48 hours.