AI Policy vs Operational Reality - One-page Board Briefing

Topic: AI policy vs operational reality.

Why it matters: Policies describe intent. Risk lives in workflows - especially during exceptions and time pressure.

Primary risks:

• Policy divorced from daily work
• Unmanaged exceptions that become normal
• Overreliance on training vs system design
• Symbolic ownership without authority

Questions boards should ask:

• Do workflows reinforce policy, or rely on memory?
• Where do exceptions occur most and why?
• What metrics reveal real behavior and near-misses?
• Who owns AI risk operationally and can stop use?

Board takeaway: Governance works when controls exist where work happens, not just in policy documents. Boards should focus oversight on operational reality.