Why Most Boards Ask the Wrong First Question About AI and Data Risk
When boards discuss AI and data risk, the first question is often: “Are we compliant?” It feels sensible, but it’s usually the wrong starting point.
Compliance describes whether known requirements have been met. It does not explain how decisions are made, which assumptions are at play, or where uncertainty remains. In fast-moving AI and data environments, those gaps matter more than the documented controls.
The better first question is: “What do we not yet understand well enough to make this decision confidently?”
That reframes risk as a knowledge problem, not just a control problem.
Boards rarely fail because policies are missing. They fail when they approve initiatives without clarity on data lineage, model behaviour, ownership, or escalation paths – and only discover those weaknesses when outcomes are challenged.
This insight shifts board-level conversations away from reassurance and towards decision confidence, helping leaders surface hidden exposure before it becomes personal, reputational, or irreversible.
Contact the Author
Iain Borner
Chief Executive Officer
As Co-founder and CEO of The Data Privacy Group, Iain Borner leads our mission to empower businesses with top-tier data protection services and foster Digital Trust across all customer touchpoints. With an extensive background in data privacy management, he is passionate about safeguarding businesses' reputations, revenues and relationships in this digital age. It's about steering organisations towards a future where Digital Trust is their most invaluable asset.
Receive the latest news to your Inbox
