An AI policy for the board: what it should say

A board AI policy answers four practical questions. Which AI tools may directors and the board office use for board work? Which papers may go into them? Who checks the output before it enters the record? And what must never be entered at all? Two pages are enough, as long as the board approves the policy and every director has read it. Without one, directors decide case by case, often with personal accounts.

Why does a board need its own AI policy?

The company's general AI policy is written for employees. Directors are different. Most are not employees, they use their own devices, they sit on several boards, and they handle the most sensitive information the company has. A director who pastes a takeover offer into a free chatbot account to get a summary has shared it with a third party whose terms they probably have not read.

The board office faces a similar question from the other side. AI can draft minutes, translate agendas and summarise long reports. Used well, it saves hours. Used without rules, it creates drafts nobody checked and copies nobody controls. A policy also protects the people who want to use AI properly, because they know what is allowed without asking each time.

What should the policy cover?

The table lists the sections of a policy that fits on one page. The next parts show sample wording for the clauses that boards ask about most.

Sample clauses

These sentences are starting points, not legal advice. Adapt the words in brackets to your company.

• Principle. "AI may help prepare and record the board's work. It does not take part in deliberations and does not decide. Responsibility for every paper and for the minutes stays with the person who presents or signs them."
• Approved tools. "Board material is entered only into the tools on the list of approved tools, kept by [the board secretary]. Free or personal AI accounts, browser extensions and note-takers that join calls on their own are not approved unless they are on the list."
• Human review. "A named person reviews every AI result before it is used or shared. For minutes, this is [the board secretary], who checks names, numbers, the wording of each resolution and the votes against the notes."
• Recording. "No meeting is recorded or transcribed unless the chair has announced it at the start and no participant objects."
• Incident. "Board material entered into a tool that is not approved is reported at once to [name] and handled like a security incident."

Which papers may go into which tool?

A simple three-class scheme is easier to follow than a long list. Directors should be able to decide in a few seconds, without calling the secretary.

The board decides where each type of paper falls. A company with listed securities will usually put more into the restricted class than a family-owned firm.

Which conditions should an approved tool meet?

• The provider does not use board material to train its models.
• Inputs and outputs are not retained, or only for a short, stated period.
• Data is processed in a location the company accepts.
• The tool is part of a contract with the company, not a personal subscription.
• Admins can switch AI features off.
• Sub-processors are named and a data processing agreement is signed.

These conditions turn a vague concern into a checklist the board office and IT can apply to every tool. Our post on AI briefings without hallucinations covers the second half of the problem: making sure the output stays tied to the papers.

Worked example: checking one tool

Muster AG (an invented company) wants to approve a transcription tool for the board office. The board secretary fills a short record per condition.

One failed condition means the tool stays off the list until the terms change or the board accepts the retention period in writing. This is the point of the record: the decision is visible and repeatable.

What does Swiss law expect?

The Federal Data Protection and Information Commissioner has stated that the Data Protection Act, in force since 1 September 2023, applies directly to AI-supported data processing. According to the FDPIC, providers and users must make the purpose, functioning and data sources of AI-based processing transparent, affected people can object to automated processing and ask for automated individual decisions to be reviewed by a person, and high-risk processing calls for a data protection impact assessment. A board AI policy is a practical way to show that the company has thought about these points.

How do you introduce it?

Adopting a policy is a board decision, so treat it as one. The steps below take one meeting cycle.

1. The board office drafts the policy and the list of approved tools, with IT and the data protection adviser.
2. The chair puts the draft on the agenda for decision, with the open choices marked.
3. The board adopts it and records the decision in the minutes.
4. The board office sends the adopted text to every director and asks each to confirm once that they have read it.
5. The policy is repeated whenever it changes, and reviewed after a year because tools change quickly.

Sample resolution text

"The Board of Directors adopts the AI policy for board and executive board material dated [date], including the list of approved tools in the annex. [The board secretary] keeps the list and reports changes to the chair. The policy is reviewed by [date next year]."

Which mistakes are common?

• A policy without a tool list. "Use approved tools" means nothing if no list exists. Write the list before the board votes.
• A ban that nobody follows. Prohibiting all AI pushes use into personal accounts. Offer one approved route.
• Rules that depend on the chair's memory. Put review and deletion duties on named roles, not on goodwill.
• No rule for AI that joins calls by itself. Many video tools can add a note-taker. The policy should say who may switch it on.
• No record of use. A short note with date, tool, purpose and reviewer is enough, and it answers questions from auditors or a new director.
• Ignoring AI inside existing software. AI features appear in tools the company already uses.

What changes with the company type?

• Listed companies and regulated firms. The restricted class is larger and approvals are stricter; coordinate with legal and compliance.
• Foundations and associations. Volunteer members often use personal devices and accounts, so the approved route must be easy and free of surprises. Keep the policy short.
• Groups. Decide whether the group board sets one policy for all subsidiary boards, or whether each board adopts its own on the same template.
• Directors on several boards. Say that the director follows the strictest applicable rule when material of two companies is involved.

How does Konsaro fit an AI policy?

Konsaro's AI copilots use AI models in the EU with zero data retention. Board material is not used to train AI models, AI output is a draft that the board office reviews before it is shared, and organisation admins can switch AI off for the whole organisation. The Translation Copilot does not translate board papers. The AI copilots page describes each copilot, and the directors page and the board office page show how each role works with AI in the portal.