AI is no longer a technology decision sitting with IT. For UK SME boards, it's now a governance decision — and most boards haven't caught up. Not because directors lack judgement, but because AI oversight questions haven't been asked of them before, in this specific way.
Below are the five questions I'd expect any board to be able to answer clearly before approving further AI investment.
The five questions I'd put to any board
What decision is this AI system actually making, and who is accountable if it's wrong?
Every AI deployment makes or influences a decision — approving a transaction, prioritising a case, drafting a communication. If no named person can explain, in plain terms, what happens when that decision is wrong, the system isn't ready for scale, regardless of how well the pilot went.
How do we know it's working, beyond "it feels faster"?
Speed is the easiest thing to notice and the least useful thing to measure. Boards should ask for a small number of concrete indicators — error rate, override rate, customer complaints, time-to-resolution — tracked before and after deployment. If those numbers don't exist, the board is approving a feeling, not a result.
What happens when it fails, and has that actually been tested?
Every system fails eventually. The question isn't whether, it's whether a human is positioned to catch it before it causes damage, and whether that hand-off has been tested under realistic conditions rather than assumed on a slide.
What data is this system using, and do we have the right to use it this way?
This is where most SME AI risk actually sits — not in the model, but in the data feeding it. Boards should be able to state, without checking, whether customer or employee data used in an AI system was collected with that use in mind, and whether it's being stored and processed in line with UK data protection obligations.
Who outside the project team has reviewed this, and when will they review it again?
A system approved once and never revisited is a system nobody is actually governing. Boards should expect a fixed review point — quarterly is reasonable for most SME deployments — where someone independent of the original build checks it against the four questions above.
The discipline that separates real governance from governance theatre
None of these questions require deep technical expertise to ask. They require the discipline to ask them before the investment, not after something goes wrong. That discipline — more than any particular tool or vendor — is what separates AI governance that actually protects an organisation from AI governance that exists only on paper.
If your board hasn't been through these five questions yet, that's a reasonable place to start.