Reporting AI to the board

Two things arrived at once. Provision 29 of the UK Corporate Governance Code took effect for financial years beginning on or after 1 January 2026, requiring boards to declare whether material controls were effective at the balance sheet date and to name the ones that were not. At the same time AI moved into operations faster than the controls around it matured. The manager who owns AI delivery now answers two questions from the same board, in the same pack. Is this working, and can we stand behind it. Most organisations answer them with different numbers drawn from different places and held to different standards, and neither survives a director asking how you know. This paper argues that they are one report rather than two, because the instrumentation that proves a control fired is the instrumentation that proves a use case moved. It sets out a single test and three tiers of evidence, applies them to the numbers that usually appear in board packs, and gives a standing pack structure ordered the way a board actually wants it: what is running, what it returned, what is in pilot, what was stopped, and then the assurance that licenses those claims. It includes guidance on what visuals earn a place and which should be refused, aggregation rules for federated groups where a group average hides the failing division, the groundwork that has to exist before any of this is possible, how to communicate it upward, a worked specimen board page with commentary, and a ninety-day plan. Sources are dated and weighed in an appendix, including where a finding is correlational and where an author has a commercial interest in their own conclusion.