You didn't decide to deploy AI. Your vendors decided for you. The EHR added an ambient scribe, the accounting platform added anomaly detection, the helpdesk added a copilot — and each one quietly changed what happens to your data and who is accountable when a model gets it wrong.
Boards have absorbed that AI is a risk topic. What most haven't absorbed is that their largest AI exposure is contractual, sitting inside renewals nobody reads as AI decisions. Here are the questions that surface it — the same ones we use in structured AI vendor due diligence.
1. What of ours goes into the model — and where does it go?
Not the marketing answer; the data-flow answer. What leaves your environment when the feature is used, which subprocessors touch it, whether it's used to train shared models, and what happens to it when the contract ends. If the vendor can't produce a data-flow diagram, that is the answer.
2. Who is liable when the AI is wrong?
AI features shift error modes: a hallucinated clinical summary, an anomaly flag that stops a legitimate wire, a copilot that writes a discriminatory response to a customer. Ask how the contract allocates liability for AI-assisted output — most vendor paper currently pushes it all to you, and boards should know that's what they signed.
3. What is the regulatory posture of this feature?
Depending on your sector this ranges from FDA classification (clinical decision support) to model risk expectations from financial regulators, to state AI statutes. The vendor should tell you which regime they believe applies and what documentation they'll provide when your examiner or auditor asks. "We're SOC 2 compliant" does not answer an AI governance question.
4. Can we turn it off?
The most underrated question. Per-feature opt-outs, tenant-level controls, and contractual notice before new AI features activate. Vendors increasingly ship AI features enabled by default — your governance program can't govern what it doesn't know switched on.
5. Show us your bias and performance evidence.
For anything touching decisions about people — hiring, lending, care, claims — ask for performance metrics disaggregated across the populations you serve, and the cadence on which they retest. A vendor with a real answer has a mature model program. A vendor offended by the question is telling you something too.
What the board actually does with this
The board's job isn't to interrogate vendors — it's to require that someone does, on a defined cadence, with results reported in business terms. Practically: an AI-inventory of vendor features, a tiering by data sensitivity and decision impact, these questions asked of the top tier, and exceptions surfaced in the quarterly risk packet. That's a governance motion, not a technology project — and it's exactly the gap our AI Security & Governance Assessment was built to close.
