What should the board's quarterly AI report contain?

01Why boards need a report as well as a briefing

Most boards hear about AI as a strategy item: a presentation on opportunity, a vendor demonstration, an update on a pilot. That tells directors what management hopes for. It does not tell them what is running, what it costs or who approved it, which is what their duties of care and diligence are about.

Regulators have started to say so. In April 2026, APRA found that boards of regulated entities lacked the technical literacy to challenge management on AI risks. In a late-2025 survey of 419 Australian directors and senior executives for the AICD's 2026 director's guide, nearly a third of organisations reported at least one use of agentic AI. Only 21.8 percent named the board as primarily responsible for AI operating safely and lawfully.

The cost of not knowing is measured. IBM's Cost of a Data Breach Report 2026 found shadow AI, meaning AI used without approval or oversight, involved in 43 percent of breaches, up from 20 percent the year before. More than two thirds of organisations had no governance process to limit it.

02The four blocks

1. The estate. How many AI systems and agents the business runs, how many have a named owner, how many are approved with a written scope, and how many were found this quarter that nobody had approved. The number to watch is coverage: the share of the estate with an owner and an approval.
2. The spend. AI spend for the quarter by business unit, against the caps the board approved, with the forecast for the year at the current rate. Every increase above a threshold the board sets, with the person who approved it.
3. The exceptions. Incidents involving AI, agents that exceeded their scope or their cap, and approvals overdue for review because a model or tool changed. Each with an owner and a date.
4. The pace. How long it takes to get an AI agent approved, from request to sign-off. A rising number means the governed path is getting slower, and teams will route around it.

03What each block should not contain

Vendor names and feature lists, which belong in management's papers. Usage counts without cost. Pilot announcements without an owner. A green status that nobody can trace to a number. The report earns trust by being the same shape every quarter, so a director can see what moved.

04The decisions the report should ask for

• Approve or adjust the AI spend ceiling for the next quarter.
• Accept or reject the risk on each exception still open after its due date.
• Confirm who in management is accountable for AI overall.
• Note any agent whose actions touch customers, staff or regulated decisions, and the person in the loop for each.

05Getting to the first report

The first report will have gaps, and the gaps are the finding. If management cannot say how many agents are running, block one shows a range and the plan to close it. If spend cannot be split by unit, block two shows the total and the date attribution will be in place. A board that sees an honest first report and a better second one is better placed than one that sees a confident page with no numbers behind it.