AI Governance Board Reporting: The Metrics Your Executives Actually Need

Category 1: Risk Metrics

• AI incident count & severity: How many AI system incidents occurred this quarter? Categorise by severity (P1-P4). Trend over time. Board wants to see this number declining or stable.
• Regulatory exposure score: Number of AI systems in scope for EU AI Act high-risk classification. Compliance status of each (green/amber/red). Any systems operating without required documentation.
• Vendor concentration ratio: Percentage of AI workloads dependent on a single provider (OpenAI, AWS, Google). If >70%, flag as concentration risk per DORA.
• Data governance compliance: Percentage of AI training datasets with documented provenance, consent basis, and retention policies. Target: 100%. Anything less is regulatory exposure.
• Model risk inventory: Total number of AI models in production. Categorised by risk tier (per your internal framework or EU AI Act classification). Any models without assigned owners or current risk assessments.

Category 2: Value Metrics

• AI-driven revenue/savings: Quantified business impact of AI systems. Revenue generated (AI-powered products), costs saved (automation), or efficiency gained (productivity tools). Must be attributable, not theoretical.
• AI investment efficiency: Total AI spend (compute + people + tools + licenses) divided by quantified business value. Trending up = good. Trending down = you're spending more for less.
• Time-to-production: Average time from AI concept to production deployment. Boards understand "we went from 9 months to 3 months" as a capability improvement.
• AI adoption rate: Percentage of eligible business processes with AI augmentation. Shows organisational penetration and remaining opportunity.

Category 3: Compliance Status

• EU AI Act readiness: Traffic-light dashboard of each high-risk AI system against EU AI Act requirements (risk management, data governance, technical documentation, human oversight, accuracy/robustness).
• DORA ICT register status: AI-related third-party services properly registered, assessed, and within contractual compliance. Any outstanding gaps.
• Audit findings: Number of AI-related audit findings (internal + external). Open vs closed. Average time-to-remediation. Any overdue findings.
• Training completion: Percentage of relevant staff who've completed AI governance training. Required for EU AI Act Article 4.

The One-Page Board Report

• Top section — RAG status: 5-6 key indicators as red/amber/green circles. Board members should understand overall health in 5 seconds.
• Middle section — Trends: 3-4 line charts showing quarter-over-quarter movement. Risk trending down, value trending up, compliance improving.
• Bottom section — Actions needed: 2-3 bullet points requiring board decision or awareness. Budget requests, policy approvals, risk acceptances.
• Appendix (for those who want detail): Full metrics with definitions, data sources, and methodology. Most board members won't read this but it demonstrates rigour.

Golden rule: If a metric requires a footnote to explain what it means, it's too technical for the board deck. Translate it or remove it.

Risk Quantification Approaches

• Annualised Loss Expectancy (ALE): Probability of AI failure × financial impact per occurrence × frequency per year. "Our customer-facing AI has a 5% annual probability of a bias incident that would cost €2M in fines and remediation = €100K ALE."
• Regulatory penalty exposure: EU AI Act fines up to €35M or 7% of global turnover. GDPR fines up to €20M or 4%. Quantify your maximum exposure based on current compliance gaps.
• Reputational impact: Reference industry benchmarks. AI bias incidents at comparable companies caused X% stock price drops, Y customer churn, Z media coverage days.
• Operational disruption: If the AI system fails, what's the per-hour business impact? For revenue-critical systems, this is easily quantifiable.