The CISO AI Risk Review Checklist: 12 Questions to Ask Before Your Next Board Meeting

A CISO AI risk checklist is a structured set of questions that lets you lead the board conversation on AI rather than react to it. Every board cycle, someone asks what the organisation is doing about AI. Most CISOs arrive with reassurance. Few arrive with evidence. This checklist gives you twelve questions to close that gap before your next board meeting.

AI risk is now a standing board obligation, not a topic that surfaces when a vendor makes an announcement. The organisations that handle it well treat it as a recurring review, the same way they treat financial controls or incident response. The questions below cover shadow AI, model governance, data leakage, vendor risk and regulatory exposure. Each one is written to be asked in the room and answered with facts.

Why the board expects a CISO-led AI risk review

Boards raise AI because it now touches liability, regulation and reputation at once. A CISO who leads the conversation controls its framing; one who waits to be asked ends up defending gaps they have not yet mapped. The difference is whether you walk in with a structured position or an anecdote.

The practical problem is that AI adoption inside most organisations is already ahead of the governance around it. Staff use unauthorised tools. Vendors embed models into products without disclosure. Data moves into systems nobody has assessed. A board-ready review names these categories and states where the organisation stands on each, so the discussion moves from worry to decision.

The 12 questions to ask before your next board meeting

Group these under the five risk categories the board cares about. Work through them in order and record the answer, the evidence and the owner for each.

Shadow AI

1. Which AI tools are staff using that we have not sanctioned, and how do we know?
2. Do we have a policy that names acceptable and prohibited AI use, and can staff find it?
3. What is our route for someone to request approval for a new AI tool?

Model governance

1. Which AI models or features are embedded in the systems we already run, including through vendors?
2. Who owns the decision to deploy an AI capability into a production process?
3. Can we explain, in plain terms, how any customer-facing AI decision is made?

Data leakage

1. What organisational or personal data can reach an external AI service, and under what controls?
2. Have we assessed whether our AI use creates a data protection obligation we are not meeting?

Vendor risk

1. Which suppliers have added AI to their products, and have we reviewed the associated risk?
2. Do our contracts address how vendors train on, store and share the data we send them?

Regulatory exposure

1. Where does our AI use fall under UK or EU regulatory scope, and who tracks changes?
2. If a regulator asked tomorrow how we govern AI, what evidence could we produce today?

Most boards will accept a partial answer on any single question. What they will not accept is a CISO who cannot say which questions have answers and which do not. The value of the list is the honest map, not a perfect score.

How to turn the checklist into evidence

Answering these questions properly means moving from opinion to evidence, and that is where a structured assessment earns its place. A CISO can guess at shadow AI usage or measure it. A board notices the difference.

Our fixed-fee UK AI Security Gap Analysis works through exactly these categories: discovery of AI in use, assessment against a governance baseline, gap identification and prioritisation. The output is a defensible risk position you can take into the board meeting, with the twelve questions answered rather than merely posed. The fixed fee means you know the cost before you commit, which is itself a fact you can report upward.

The checklist and the assessment work together. Use the questions to frame the board conversation this cycle. Use the assessment to replace the gaps with evidence before the next one. Over successive cycles the same twelve questions become a stable measure of whether the organisation’s AI governance is improving.

Making the review recurring

The strongest position a CISO can hold is a review that repeats every board cycle. AI capability changes fast, so a one-off answer decays within months. A recurring review against the same twelve questions shows the board a trend line, and a trend line is far more persuasive than a snapshot.

Set the cadence to match your board calendar. Assign an owner to each risk category so the answers are maintained between meetings rather than reconstructed under pressure. Treat any question that moves from answered to unanswered as a signal that adoption has outrun governance again.

Common questions CISOs raise about board AI reviews

Who should own the AI risk review inside the organisation?

The CISO typically owns the review, but ownership of individual answers should sit with the relevant function. Data leakage answers belong with the data protection lead, vendor risk with procurement and model governance with whoever runs the affected systems. The CISO’s job is to assemble these into one board-ready position, not to hold every fact personally.

How often should a CISO refresh the AI risk position?

Refresh it every board cycle at minimum, and sooner if a major new AI tool enters the organisation or a regulatory reference changes. AI adoption moves faster than annual governance reviews can track, so a quarterly or per-cycle rhythm keeps the board position current and prevents the answers from decaying into reassurance without evidence.

What if we cannot answer most of the twelve questions yet?

An honest map of what you cannot answer is itself a strong board position. Report which questions have evidence, which have partial answers and which have none, then propose a plan to close the gaps. Boards respond well to a CISO who names the unknowns and owns a route to resolving them.

Do we need external help to run this review?

Not always, but external assessment adds independence the board values, particularly on shadow AI discovery and regulatory scope where internal teams may lack visibility or time. A structured, fixed-fee assessment produces evidence in a form built for board reporting, which is often faster than assembling the same picture internally.

Bring the twelve questions to your next board meeting, then close the gaps they expose. Turn the checklist into a defensible, evidenced risk position before your next board cycle.