Before rollout, the board should see five things on paper: which workflows AI will touch, who approves its output, what is logged, which risk framework the assessment follows, and how the company stops a workflow. Together they make a short governance plan that management keeps current, not a policy written once and filed.
#Key takeaways
- Governance starts with an inventory: the board cannot oversee AI it does not know is running.
- Every workflow needs a named person who approves AI output and can override it.
- Logs should let an auditor reconstruct what the system did, with which inputs, and who approved it.
- Name a recognised framework, such as the NIST AI risk management framework or ISO/IEC 42001, so the board is not judging a homemade one.
- Regulated companies also answer to their sector regulators, whose rules sit on top of the general ones.
#What governance should be in place before AI rolls out?
- an inventory of every workflow where AI produces or changes something, including tools staff use on their own.
- a named approver for each workflow, with the authority to reject or correct the output.
- a risk assessment for each workflow against a named framework, kept with the inventory.
- logging that records inputs, outputs, model versions and approvals.
- an off switch: who can stop a workflow, how, and what the team does by hand while it is stopped.
- a review date set by the board, when the inventory and the assessments are checked again.
This is the list Stennir writes into every consulting engagement. We explained why in why we ship governance plans with every consultancy engagement.
#Which risk frameworks should the board ask about?
Two are widely used. The NIST AI risk management framework treats human oversight and accountability as part of managing AI risk (NIST, january 2023). ISO/IEC 42001 is the international standard for an AI management system (ISO, december 2023), which a company can be certified against.
For the security side, the OWASP top 10 for LLM applications list puts prompt injection first: text from a customer or a document can try to change what the model does. The board does not need the technical detail, only confirmation that someone has tested for it on each workflow.
#What changes for a regulated financial company?
Sector regulators such as SAMA and NCA set their own rules; check them. They sit on top of general data protection law, so a workflow that passes a general review can still need more for a bank or an insurer. Ask compliance to map each workflow against the regulator's published requirements before any customer data is used.
This post is not legal or regulatory advice; confirm with counsel and your compliance function. What Stennir adds is the workflow detail they need to make that call: the data each step touches, where it is processed, who approves the result and what is logged.
#What should you log to audit what an AI system did?
- The input the system received, or a reference to it if storing the full text is not allowed.
- The model and version, and the version of the instructions it was given.
- The documents or records it retrieved to produce the answer.
- The output it produced, before any human edit.
- Who approved, edited or rejected it, with a timestamp.
- What happened next in the downstream system, such as a record updated or a message sent.
With those six, an auditor can rebuild any decision after the fact. Without the approval line, nobody can say who was responsible when something goes wrong.
We are
Stennir writes the inventory, approvers, logging and off switch into each workflow before it runs, and leaves you owning the accounts, the logs and the switch.
We aren't
Stennir is not a law firm or a certification body, and does not replace your compliance function or your regulator's review.
#What should a board or risk committee do next?
Ask management for the inventory first: every place AI already touches work, including tools staff adopted on their own. Then ask for an approver and a log design for each. AI consulting produces both, and AI for compliance shows how review workflows run. take the free readiness assessment or book a 30-minute call.
#Common questions
Does the board need to approve every AI workflow?
No. The board approves the governance plan and the risk appetite, and sees the inventory. Management approves individual workflows inside those rules. The board should be told when a workflow touches customer data, makes a decision about a person, or falls under a sector regulator, because those carry the most risk.
Who approves what the AI produces?
A named person in the business who already owns that work, such as the head of the claims or finance team. They can reject or correct any output, and their decision is logged. Stennir does not take that role, because the accountability has to stay inside your company.
What stays with us?
Everything that matters for an audit: the accounts, the data, the logs, the instructions given to the model and the off switch. Stennir sets them up in your name. If you stop working with us, the logs and the governance record remain readable by your own team and auditors.
What could go wrong?
The usual failures are an inventory that misses tools staff adopted themselves, approvals that become a click without a real check, and logs that record the output but not who approved it. Each is easy to find in a test audit before rollout, and much harder to explain afterwards.
