Artificial intelligence tools now arrive at many companies the way any software does: a business unit proposes a vendor, procurement negotiates, and IT integrates. Boards increasingly want visibility of those decisions, and the questions below help directors ask for the information that matters without becoming product managers.
1. What data goes in, and where does it go?
Ask management to describe the categories of data the tool will receive, whether any of it is personal or confidential, and whether the vendor may use it to train or improve its models. The answers determine which privacy obligations apply and what the contract must say.
2. Who is accountable for the output?
Where the tool informs decisions about customers, employees or credit, the company remains responsible for those decisions. Directors should expect a named owner, a review process and a record of how the tool's recommendations are checked.
3. What does the contract allocate?
- Use of company data for training
- Security obligations and incident notice
- Intellectual property in inputs and outputs
- Liability caps and indemnities
- Exit rights and data return
4. What would we disclose if it went wrong?
Consider in advance how an error, a data incident or a regulatory inquiry involving the tool would be escalated, and who decides whether it must be disclosed to regulators, customers or investors.
5. How will we know it is still working as intended?
Tools change after they are approved. Ask how performance, bias and vendor changes will be monitored, and when the decision will come back to the board.
This publication is general information, not legal advice. It may not reflect later developments. Contact a lawyer about your circumstances.