For boards making AI decisions that matter
The AI Risk Dialogue
A thematic, board-level review of AI uncertainty, dependency and control.
Boards are approving AI tools, partnerships and investments faster than most of them can answer two simple questions: who really understands the risk, and what happens if a key supplier walks away? The issue isn’t whether to embrace AI: you have to. It’s whether you are taking on exposures faster than you and your people can understand them, challenge them and keep control of them.
Policies, inventories and technical reports have their uses, but they rarely show where authority really sits, or which dependencies are becoming hard to undo. Those answers live in the conversations around the board table.
AI risk isn’t one thing, either. Some of it you already feel directly: errors, poor customer outcomes, fraud. Some can be settled with evidence: model performance, bias, security, data quality. And some is genuinely unresolved. Force all three into one risk score and you get the appearance of control, not the reality of it.
Three lenses, not one framework
What do we actually know?
For each significant use of AI, separating what you have experienced directly, what evidence can settle, and what remains genuinely uncertain. Then asking what evidence would change your decision.
Do the right conversations happen?
Who holds the knowledge, who challenges it, and whether bad news reaches the people who can act on it. Whether your risk and technology teams mean the same thing by the same words, and whether challenge survives a commercial push to say yes.
What could you not undo?
Where your AI capability really depends on models, cloud platforms, data and specialist suppliers, and whether you could cope if one changed its terms tomorrow. The aim isn’t zero dependency, but dependency you could still walk away from.
Start here, for free
Two tools to try on your own board before we speak. Neither needs a meeting with me.
The Seven Questions
Two short statements on each of the three lenses, and one on risk appetite. It takes about two minutes, your results appear on screen straight away, and nothing you answer is stored.
The AI Blast Zone
Goes deeper on the third lens. AI chipmakers, cloud providers and AI labs fund, supply and buy from one another, so a problem in one may be passed on rather than absorbed. Choose what fails and how far it spreads, sketch your own firm, and see which of your processes, funding and holdings it reaches. What you enter stays in your browser.
Ways to work together
A single board session
Built around the three lenses, a single session stands on its own: you leave with a shared view of where you are and what to look at first.
It suits boards where directors don’t yet agree on where they stand with AI, or that want to test the ground before committing to more. If you then want the full review, the session becomes its scoping phase.
The full review
Built around your board’s actual concerns rather than a generic checklist.
- Scoping. A conversation with the Chair, CEO, Risk Committee Chair or CRO to identify the decisions that matter.
- Documents. What is already there: strategy papers, policies, supplier contracts, risk assessments, board minutes.
- Interviews. Eight to twelve confidential conversations with directors, executives and specialists. This is usually where the real picture emerges, often a different one from the papers.
- Workshop. A facilitated board or executive workshop to test the findings and agree what happens next.
What you are left with
- AI uncertainty map
- What is known, what is assumed, and what is still unresolved.
- Risk-dialogue map
- Where information and challenge move, and where they get stuck.
- Dependency assessment
- What you rely on, and what you could and couldn’t replace.
- Board decision framework
- What needs board sign-off, what is delegated, and when to escalate.
- Governed learning agenda
- What to test before going further, and what would stop you.
- 90-day action plan
- Practical next steps, prioritised.
Who it is for
Any board moving from AI experiments to AI that actually matters, especially where supplier concentration, agentic AI or capability you couldn’t easily rebuild is a concern.
This isn’t model testing, cyber assurance or legal advice; those need their own specialists, and where they are needed I will say so plainly and help you find the right one. This sits above that: whether those specialists’ answers reach the board, and whether the board knows what to do with them.
If the questions point to wider weaknesses in how risk is managed, Risk Management Maturity looks at the whole picture.
Why me
I spent over twenty years, including eight as a partner, at PwC. After the financial crisis I wrote for the OECD on risk management and corporate governance in banks. I then chaired the Institute of Risk Management and was principal author of its guidance on risk appetite and tolerance. Since then I have chaired board risk committees and sat as a non-executive director across banking, payments and critical financial infrastructure, including through periods where the theory of good governance met the reality of a live board under real pressure.
My work has always been about risk appetite, risk culture and the conversations that decide whether difficult information reaches the people who can act on it. This review brings that experience to AI: treating it as a governance and behavioural question first, not just a technology one.
I do this work myself. There is no team of junior consultants: the person you speak to first is the person who conducts the interviews and stands in front of your board.
Related reading
Writing that sits behind the three lenses, all on the Writing page.