Board AI Register + Eight Questions
A one-page record your board can read out loud.
Fill this in once and you have a record your board can read out loud. Keep it current and you have a program.
Educational template, not legal advice or a compliance certification.
Page 1 — AI system register
One row per AI system your organization uses, whether it was bought, built, or arrived inside software you already owned.
| System | Owner (name) | Allowed to | Not allowed to | Who can override | Stop / escalate trigger | Last reviewed | Evidence location |
|---|---|---|---|---|---|---|---|
How to use the columns. *Owner* is one human name, never a team. *Allowed to* and *Not allowed to* are written in the verbs that matter to a board: recommend, decide, act, spend, speak for us. *Who can override* names the person and the mechanism. *Stop / escalate trigger* is the condition that hands the work back to a person. *Last reviewed* is a date you enter, because a register that is never re-read is a historical document.
Page 2 — The eight questions
Eight questions a board can ask about any AI system the company runs. Each one has an answer that lives somewhere specific.
Can you name the system's owner, point to the line in your AI system register where it sits, and say what it may not decide on its own? Wherever the answer is not yet, that is where the record begins.
| # | The board's question | Answered where | By whom | Date |
|---|---|---|---|---|
| 1 | What is this system allowed to do: recommend, decide, act, spend, speak for us? | |||
| 2 | What is it not allowed to do, and who signed that list? | |||
| 3 | Who can override it, and how fast? | |||
| 4 | What evidence has to sit behind an output before anyone acts on it? | |||
| 5 | If it goes wrong, can we reconstruct what happened? | |||
| 6 | Who tests it, independently of the people who built or bought it? | |||
| 7 | What makes it stop, or hand back to a person? | |||
| 8 | Who is accountable for the outcome, by name? |
A policy tells people what they should do. Architecture can stop some things from happening. Neither can testify. The dated record is what a regulator or an underwriter reads.
Where these answers usually live
If your organization already produces governance artifacts, most of these questions already have a home.
- Questions 1, 2, 3, 4 and 7 are answered by an AI Acceptable Use Policy: authority and scope, the one-page not-allowed list with a named signer, override and escalation, evidence and human-review requirements, and stop triggers.
- Questions 5 and 6 are answered by an Executive Risk Report: record-keeping findings and the assessment method, refreshed on a cadence.
- Question 8 is answered by a Board Memo, which names the accountable owner in the form a director reads.
Four artifacts. Eight questions your board can answer out loud. Refreshed on a monthly cadence, because the next question is always "and is that still true?"
Why a register, specifically
A regulator, an underwriter, or a director will ask for the register before asking for anything else. A register with named owners against each entry is the fastest way to answer that first question well.
EU AI Act Article 4 has required providers and deployers to take measures supporting the development of AI literacy among the people operating AI on their behalf since February 2, 2025. Article 50's transparency obligations have applied since August 2, 2026. A register is how an organization shows which systems those duties attach to.
Governance is an ongoing program, never a one-time audit. Date this page when you fill it in, and again when you review it.
Free, and there is nothing to sign up for. The calculator is twelve questions and no account; the method is published in full.