Report authority and exposure, not technology. Tell the board what each agent may do and how far, on what evidence, how often the bounds stopped or held something, what went wrong and why, and where you sit against the risk appetite the board approved. End with the decisions you need from them. Leave model names and architecture in the appendix.
Why do board reports on AI often miss?
They tend to swing between two extremes: a technology update full of model names and project milestones, or a one-line assurance that "governance is in place". Neither lets directors exercise judgement. Directors need to know what the business has authorised machines to do on its behalf, whether that authority is earned, and whether the controls are holding.
Our answer on what a board should ask about AI agents lists the questions. The report should answer them before they are asked.
What should the report contain?
| Section | What it shows | Source |
|---|---|---|
| Authority | Each agent, its owner, and its certified depth | The register and certificates |
| Evidence | Which agents are certified, when evidence lapses, any lapsed | Certification records |
| Bounds in action | Held, refused and withheld actions by type, and the deciding bound | The verdict record |
| Approval quality | Whether held items are really reviewed | Approval records, seeded tests |
| Incidents | What happened, harm, link that failed, fix | Incident reports |
| Appetite | Exposure against the limits the board set | Risk appetite statement |
| Changes | Depth raised or new agents since last report | Change log |
| Decisions needed | What the board must approve or note | Management |
Keep it to two pages plus appendices. The board paper on AI agent deployment template gives a layout for proposals to deploy new agents; the regular risk report follows the same logic.
What are the practical steps?
- Agree risk appetite first. The board approves what kinds of action agents may take, how far, and what level of exposure is acceptable. Without this, the report has nothing to measure against.
- Assess each agent's risk in the same format; an AI agent risk assessment template keeps them comparable.
- Pull data from records, not from project teams. The register, certificates, verdicts and incidents.
- Write the summary in plain words. "Our collections agent may now agree payment plans up to six months without a person, based on testing on 2,000 past cases" is a sentence directors can challenge.
- Name the accountable executive for each agent or group of agents.
- Ask for decisions explicitly, such as approving a depth increase above appetite or accepting a residual risk.
- Report on a fixed cycle, with incidents above a threshold reported between cycles.
How do supervisors frame board oversight?
Regulators expect boards to oversee material risks, and agents are no exception. In the US, the interagency model risk guidance SR 11-7 places responsibility for model risk with the board and senior management; our article on SR 11-7 governance and board oversight of agents applies it. In the UK, the Senior Managers and Certification Regime means a named senior manager answers for the areas agents work in. Broader frameworks for AI risk management all put accountability at the top.
A worked example
Take a mid-sized insurer's second quarterly report. Authority: five agents, the highest depth being depth 3 for the claims logging agent and depth 2 for the others. Evidence: one certificate lapsed for nine days because of a delayed test run; depth dropped automatically during that period. Bounds: underwriting support had a sharp rise in refusals after a new product launched, because its sources had not been updated. Incidents: one, a batch of incorrect claims acknowledgement letters, caught by a breaker after 40 letters. Appetite: within limits. Decision needed: approve raising claims reserve-setting to depth 3 under 2,000, with test evidence attached.
The board approves the depth increase but asks for a one-off review of how product launches update agent sources.
Which controls make the report trustworthy?
- Data from the record, not from the teams being reported on.
- Consistent measures across quarters.
- Internal audit review of the report's figures at least annually.
- A named executive signing the report.
The topic guide, agent governance is a bound, not a model, explains why authority, rather than technology, is what the board governs.
Questions people ask
How technical should the board be?
Not very. Directors need to understand depth, evidence and verdicts, not model architecture. Offer a short briefing when agents are first introduced.
Should every agent be in the board report?
Every agent that acts should appear in the summary table. Detail can focus on agents with the highest depth or exposure.
How often should the board hear about agents?
Quarterly is common, with a threshold for incidents that triggers an immediate report. Increase frequency during a large rollout.