AI Governance Framework for Boards: The BOARD-AI Playbook

From CRISP-DM to BOARD-AI

I’ve run CRISP-DM more times than I can count.

I first used it as a data scientist building predictive models for financial services, where Business Understanding meant translating risk and credit questions into compliant, usable data-science problems.

Later, in ML engineering and enterprise technology, the framework scaled with the work: data pipelines, feature stores, model monitoring, retraining workflows, and deployment controls across complex environments.

In industrial AI, it became something more: a translation layer between technical teams discussing F1 scores and plant leaders focused on uptime, production, EBITDA, and CO₂ targets.

Every data person should know CRISP-DM.
Every board member doesn’t — and that is exactly the problem.

When I began advising boards and C-suites on AI strategy and governance, I saw the same gap repeatedly. Technical teams had a process for building AI. Boards often had no equivalent structure for governing it.

The BOARD-AI Framework applies CRISP-DM’s familiar six-phase logic to board-level AI oversight: alignment, inventory, governance, metrics, decisions, and continuous fluency.

Why Boards Need Their Own CRISP-DM

Every data scientist should know CRISP-DM: Business Understanding, Data Understanding, Data Preparation, Modeling, Evaluation, Deployment. It became a shared language because it gave messy, ambiguous projects a repeatable shape.

AI governance at the board level has the opposite problem today. It is not messy because there is too much structure — it is messy because there is often too little.

The gap, in numbers

• 88%+ of organizations use AI in at least one business function
• 39% of Fortune 100 companies disclose any board oversight of AI
• 66% of directors say their board has “limited to no knowledge or experience” with AI
• 1 in 3 boards do not even have AI on their meeting agenda
• 10.9 points is the ROE outperformance gap between companies with AI-savvy boards and those without

Source: McKinsey, “The AI reckoning: How boards can evolve”

That gap between exposure and oversight is exactly what the BOARD-AI Framework is built to close — by borrowing the phase structure data leaders already trust and re-pointing it at the boardroom.

The Six Phases at a Glance

Phase 1 — Board Alignment

Business Understanding, adapted

Objective: Translate AI capabilities into strategic questions the board can actually engage with, rather than technical detail it cannot act on.

The starting point is not a tools list — it is posture. McKinsey’s research identifies two strategic dimensions that determine how a company should approach AI:

• Source of value — expanding into new products and revenue, versus optimizing the existing model
• Degree of adoption — holistic and enterprise-wide, versus selective and targeted

Plotting a company against those two axes produces four archetypes (McKinsey):

Phase 2 — AI Inventory & Risk Discovery

Data Understanding, adapted

Objective: Surface the AI that already exists inside the organization — including the AI nobody officially approved.

Shadow AI is the board’s blind-spot equivalent of shadow IT, except the stakes can be higher: AI systems may recommend, classify, generate, or influence decisions.

A functioning discovery process needs a living AI inventory with, at minimum:

1. System name
2. Business owner
3. Purpose
4. Data inputs
5. Deployment status
6. Risk classification

Sources: OneTrust; Acuity AI

Risk classification should map to the EU AI Act’s four-tier structure, translated into board language:

Sources: European Commission, AI Act; Governance AI

Phase 3 — Governance Architecture Design

Data Preparation, adapted

Objective: Decide who owns AI oversight and through what structure, before deciding what to measure.

Two structural options

• Standalone AI committee — better for Business Pioneers and Internal Transformers, given higher decision volume and complexity
• Embedded in audit/risk committee — often sufficient for Pragmatic Adopters, provided the mandate remains clear

Whichever structure is chosen, committee design research converges on five non-negotiables (Acuity AI):

1. Chair independence — no conflicting stake in the technology’s success
2. Governance-heavy membership — legal, compliance, risk, HR, and data protection have real authority; technologists advise
3. Direct board reporting line — do not hide AI governance beneath routine operating updates
4. Authority to say no — the ability to pause a high-risk deployment, not merely recommend
5. Documented terms of reference — mandate, membership, cadence, quorum, and decision rights

A simple accountability model

• Compliance & Legal → set the rules
• AI Governance Committee → approve and monitor against those rules
• Build Teams → implement within guardrails and report upward

The governance policy should define pilot-to-scale rules, human sign-off thresholds, vendor and data guardrails, and escalation triggers that clarify what must reach the board — and how quickly (McKinsey).

Phase 4 — Board Reporting & Metrics

Modeling, adapted

Objective: Define what boards should actually see, distinct from what technical teams want to present.

Only about 15% of boards currently receive AI-related metrics (McKinsey). A board dashboard does not need model-accuracy curves. It needs four areas mapped to decisions the board can make:

Track ROI by business unit, the share of AI-enabled processes, resilience indicators, reskilling progress, and regulatory alignment.

Reporting cadence that works

• Quarterly: board-level summary focused on trends, material risk, and decisions
• Monthly: executive-committee review focused on operational detail and follow-through

Because value often lags implementation, use leading indicators — inventory coverage, risk-classification completion, pre-deployment review pass rate, and unresolved control issues — to confirm whether governance is maturing before ROI is visible.

Phase 5 — Board Decision Framework

Evaluation, adapted

Objective: Give boards a repeatable way to decide when to fund, pause, or kill an AI initiative.

Fewer than 25% of companies have a board-approved, structured AI governance policy (McKinsey). Without one, too many AI decisions are made on enthusiasm, vendor pressure, or executive sponsorship rather than evidence.

A workable prioritization matrix scores initiatives across three dimensions:

• Strategic value
• Risk exposure
• Organizational readiness

The kill switch is not a punishment mechanism. It is a pre-agreed set of conditions that triggers a pause and committee review:

• Sustained performance drift
• Unresolved bias findings
• Missed regulatory deadlines
• Unremediated vendor risk

This makes the decision about evidence and governance, not about whoever is most invested in the project surviving.

Board questions differ by AI posture

• Pioneer boards should ask whether the value pool is large enough to reshape the market and whether the company can manage first-mover risk.
• Functional-reinventor boards should ask which workflows most benefit from AI and whether weak pilots are being defunded quickly enough.

Source: McKinsey

Phase 6 — Board Fluency & Continuous Oversight

Deployment, adapted

Objective: Make AI governance a standing muscle, not a one-time project.

Directors do not need to become data scientists. They need enough fluency to ask sharp questions and recognise weak answers (McKinsey).

Build that fluency through four channels:

1. Ongoing education
2. Regular AI briefings
3. External training
4. Direct exposure to the people building and operating AI — not only filtered executive summaries

A realistic 90-day on-ramp

• Month 1: build shared vocabulary and align on AI posture
• Month 2: review the AI inventory and risk tiering
• Month 3: test the decision framework against a live initiative

Treat AI fluency as boards treat financial literacy for new directors: a defined capability, not an assumption. An internal AI champion network can then help translate the board’s approved governance model into day-to-day practice.