The Seven Questions Your Board Will Ask About AI Risk in 2026 (And How a CISO Should Answer Them)

TL;DR. Audit committees have stopped asking strategic questions about AI ("what's our strategy?") and started asking operational, evidence-seeking ones ("how do you know?"). This guide lists the seven questions a CISO should expect at the next board meeting, mapped to authoritative frameworks: NIST AI RMF (AI 600-1), the OWASP LLM Top 10 (2025), the EU AI Act, and ISO 42001. For each: why it is being asked, what a weak answer sounds like, and what a defensible one looks like.

Why are AI questions from the board different in 2026?

Through 2024 and the first half of 2025, board AI conversations were strategic: is there a strategy? Are we falling behind? By mid-2026 the questions have become operational and evidence-seeking. Three forces are driving the shift: the EU AI Act's Aug 2, 2025 GPAI obligations entered force; the NIST Generative AI Profile (AI 600-1) gave auditors a vocabulary; and D&O insurers are actively re-pricing policies around AI risk.

The pattern across every audit committee we have observed: directors no longer accept posture as an answer. They want evidence on demand.

What are the seven questions?

The seven questions consistently surfacing in audit and risk committees through Q1–Q2 2026, in roughly the order they appear:

1. How many AI tools are in use across the company right now?
2. What sensitive data has been entered into AI tools in the last 90 days, and by whom?
3. If an employee fed our customer list into a public LLM tomorrow, would we know?
4. What is our exposure if a regulator audits our AI use next month?
5. How would we know if one of our AI agents took a destructive action on its own?
6. What is our worst-case AI-related incident scenario, and what would it cost us?
7. Is there anything we are not asking you that we should be?

Each is unpacked below.

Question 1: How many AI tools are in use across the company right now?

Why it is asked. This is the warm-up question. The board wants to know whether you have basic visibility. They have read about enterprise shadow AI prevalence and want to know which side of the curve you are on.

Weak answer. "We have approved ChatGPT Enterprise and Microsoft Copilot." This answers a different question — the SaaS contract question. Directors who have been paying attention hear the gap immediately.

Defensible answer. "As of last week's scan, we have N distinct AI tools in active use. M are formally sanctioned. K are in the controlled-allowance category — known, monitored, low risk. J are unsanctioned and under active review. Here is the 6-month trend." Continuous shadow AI discovery — not a one-off audit — is what makes this answer defensible. A six-month-old number is a liability; a last-week number is a credential.

Question 2: What sensitive data has been entered into AI tools in the last 90 days, and by whom?

Why it is asked. This is the question keeping general counsels awake. The board wants to know whether you have created a data-loss surface they did not know existed. The "by whom" part is not idle — they want to know whether you can attribute, because attribution is the difference between a contained incident and an unbounded one. This is the operational expression of OWASP LLM02: Sensitive Information Disclosure (OWASP LLM Top 10 2025).

Weak answer. "We have a DLP policy that blocks sensitive data from being pasted into AI tools." Past-tense thinking. Even if true, tells the board nothing about what got through.

Defensible answer. "In the last 90 days, we observed N attempts to send classified content into AI tools. M were blocked at the prompt layer. K reached an AI model. Of those, J contained PII, H contained payment data, and G contained MNPI. All have been individually investigated, attributed, and remediated. Here is the per-business-unit breakdown."

Question 3: If an employee fed our customer list into a public LLM tomorrow, would we know?

Why it is asked. This is the trapdoor question. It sounds hypothetical; it is not. The board is testing whether your detection works, in a form that does not let you hide behind policy. A policy that says "do not paste customer data into ChatGPT" is irrelevant to whether you would detect it.

Weak answer. "Our policy prohibits that." Do not say this. Directors exchange glances.

Defensible answer. "Yes. Prompt-layer inspection runs on every AI interaction in the managed environment, and on every browser-based AI interaction via our extension. A structured customer list crossing that boundary would be flagged within seconds; the request would be blocked; the user, their manager, and the SOC would be notified. For unmanaged endpoints, we have N% coverage and a 30-day plan to close the gap." A partial answer is acceptable if honest and time-bound. Bluffing is not.

Question 4: What is our exposure if a regulator audits our AI use next month?

Why it is asked. Directors have read about the EU AI Act enforcement structure (with the Article 99 penalty tiers reaching €35M or 7% of global annual turnover for prohibited-practice violations), about the SEC's AI-related disclosures guidance, and about state-level regulations in Colorado, California, and elsewhere. They want to know whether a no-notice audit would produce a clean evidence trail or a frantic three weeks of consultants reconstructing what happened.

Weak answer. "We are working toward compliance." The answer of a CISO who has not yet been audited.

Defensible answer. "We have evidence mapped to eight frameworks — SOC 2, ISO 27001, ISO/IEC 42001, NIST AI RMF, EU AI Act, HIPAA, GDPR, and PCI DSS 4.0. For each, we can produce on demand the policies in force, the controls implementing them, the audit log of enforcement actions, and the exceptions register with named owners and review dates. Our last internal mock audit took N days end to end. Remaining gaps are documented on this slide with target close dates."

Question 5: How would we know if one of our AI agents took a destructive action on its own?

Why it is asked. Boards have moved past worrying about chatbots and started worrying about agents. The shift happened roughly in the last two quarters as autonomous coding, customer-service, and research agents went into production at scale across the Fortune 1000. The risk maps to OWASP LLM06: Excessive Agency (OWASP LLM Top 10 2025) — granting LLMs unchecked autonomy to take action.

Weak answer. "We are not really running autonomous agents in production yet." Ask your engineering leaders before the meeting. You may be surprised — especially if your developers have adopted Model Context Protocol (MCP) servers.

Defensible answer. "Every agent in our environment runs through a policy enforcement layer that logs every tool call, every external system invocation, and every action taken on a user's behalf. High-impact actions — anything that writes to production, contacts a customer, or moves money — require either human approval or pre-authorized policy. We run weekly red-team exercises against our agents and publish findings to engineering. The last exercise surfaced N issues; all are remediated." The AccuroAI agent governance platform is built around this enforcement model, but the principle holds regardless of vendor.

Question 6: What is our worst-case AI-related incident scenario, and what would it cost us?

Why it is asked. This is the D&O insurance question dressed in plain clothes. The board needs to put a dollar figure next to "AI risk" in the enterprise risk register, and would prefer that figure come from you rather than from their consultants. Standard reference data for the cost-modeling exercise comes from the annual IBM Cost of a Data Breach Report, which provides industry-segmented breach cost benchmarks.

Weak answer. "It is hard to quantify." It is hard. That does not mean you do not try. A board that hears "hard to quantify" assumes you have not modeled it, which means they have to — without you.

Defensible answer. "Our top three modeled scenarios are: (1) bulk customer-data exfiltration via prompt injection into a customer-service agent; (2) M&A material exposure via Copilot oversharing; (3) autonomous agent destructive action against a production financial system. Here is the methodology, here are the assumptions (benchmarked against IBM Cost of a Data Breach Report 2024 industry segments), and here are the controls reducing each." Defensibility, not precision, is the bar.

Question 7: Is there anything we are not asking you that we should be?

Why it is asked. The most underrated question on the list. Many of the most engaged directors end every CISO update with some version of this question. They are inviting you to surface the thing you have been worrying about that did not make the formal agenda.

Weak answer. "No, I think we've covered it." Never. Always have one.

Defensible answer. Pick the one specific risk you are genuinely losing sleep over — the one the slide deck did not capture, where you need air cover, budget, or a strategic decision. "Yes. We are seeing rapid adoption of personal AI accounts on personal devices used for work — call it 'BYO-AI.' Our current controls don't extend there. I'd like to bring a recommendation to the next meeting." Boards reward CISOs who use the floor when offered. They remember the ones who do not.

The meta-question behind all seven

Read the seven back to back and they share something. They are not asking "do you have a strategy?" They are asking "can you produce evidence on demand?"

That shift — from strategic posture to operational evidence — is the single biggest change in board-level AI risk conversations in the last twelve months. It aligns with the NIST AI RMF's emphasis on the Measure and Manage functions (NIST AI 600-1 Generative AI Profile), and with ISO/IEC 42001's requirement that AI management systems produce auditable evidence of control operation. Most security organizations are least prepared for this shift, because most 2024–early-2025 AI governance investment went into policy documents and committee charters rather than runtime instrumentation.

Frequently asked questions

What AI risk frameworks should I cite in a board update?

The most authoritative references for 2026 board conversations are: NIST AI Risk Management Framework with the Generative AI Profile (AI 600-1); ISO/IEC 42001 for AI management systems; the EU AI Act; and the OWASP Top 10 for LLM Applications (2025) for technical risk.

What are the EU AI Act penalty tiers?

The EU AI Act establishes tiered administrative fines: up to €35 million or 7% of global annual turnover for prohibited-practice violations; up to €15 million or 3% for other violations; up to €7.5 million or 1% for the supply of incorrect or misleading information to authorities. Penalty rules entered force August 2, 2025.

How do I quantify worst-case AI breach cost for the board?

The standard reference data is the annual IBM Cost of a Data Breach Report, which segments by industry and breach type. Build three modeled scenarios — bulk data exfiltration, sensitive content exposure, autonomous agent destructive action — using your industry's benchmark per-record costs and tenant-specific exposure data.

What is OWASP LLM06 (Excessive Agency)?

LLM06: Excessive Agency in the OWASP Top 10 for LLM Applications (2025) describes the risk of granting LLMs unchecked autonomous capabilities — broad tool access, write permissions, or decision authority — that enable unintended consequences. It is the central risk for organizations running AI agents in production.

How often should the audit committee receive an AI risk update?

For organizations of meaningful scale, quarterly is the emerging norm — matching the audit committee cadence. Topic-specific deep dives (a major incident, a regulatory inflection like an EU AI Act milestone, a board-approved budget request) warrant ad hoc updates between quarterly cycles.

What is NIST AI 600-1?

NIST AI 600-1 is the Generative AI Profile of the NIST AI Risk Management Framework, published in July 2024. It maps generative AI-specific risks to the four AI RMF functions (Govern, Map, Measure, Manage) and provides actions enterprises can take to address them. It is increasingly cited in regulator conversations and internal audit work.

Where to take this next

If you want a faster path — including a board-ready evidence map across all eight major frameworks and a working pilot of unified AI risk reporting — that is exactly the conversation our team is running this month. Book 30 minutes with our security team and we will walk through your tenant, your agent fleet, and your current evidence trail with you.

Related reading

• CISO's AI Strategy 2026: The Role Redefined by Generative AI
• Building an AI Governance Committee: Charter Template
• How to Conduct an AI Risk Assessment
• Microsoft 365 Copilot Oversharing: Why Your M365 Tenant Is About to Leak Itself
• MCP Server Security: A 2026 Field Guide