Your board does not want an AI governance update

Provision 29 of the UK Corporate Governance Code applies to financial years beginning on or after 1 January 2026. Companies with December year ends are inside the first declaration cycle now and will report on it in early 2027. It requires the board to declare whether material controls were effective at the balance sheet date, and to name the ones that were not.

There is no special AI rule inside it. If an AI system is material to how the business runs, the controls over it are material controls by the ordinary meaning of the words. They arrive in scope by default, whether or not anyone mapped them first.

That is a real obligation. It is also not what a board wants to talk about when AI reaches the agenda, and building the update around it is the most reliable way to lose the room.

What a board actually asks for

Four things, roughly in this order. What is running. What it returned. What is in pilot, and what was stopped. What now depends on it.

Then a fifth, which is not a separate topic but a condition attached to the first four: enough backing to believe them, and confirmation that the organisation is inside its legal and regulatory obligations.

Governance is not the subject of that agenda item. It is the reason the numbers inside it can be trusted.

Most AI board reporting inverts this. It opens on control coverage, policy status and framework alignment, answers a question nobody asked, and buries the one they did. Then it wonders why AI never earns a place on the standing agenda.

The value case and the assurance case are one case

The instinct is to treat governance as a tax on the value story. The available evidence points the other way, though it needs handling carefully.

Protiviti and BoardProspects surveyed 772 board members and C-suite executives in the fourth quarter of 2025, publishing in March 2026. Only 26 per cent of boards discussed AI at every meeting. Split by outcome, the pattern is stark: among organisations reporting strong returns from AI, 63 per cent put AI on every board agenda. Among those reporting low returns, 13 per cent did.

McKinsey’s 2026 AI Trust Maturity Survey, covering roughly 500 organisations, found organisations with explicit ownership for responsible AI scoring 2.6 on its maturity scale against 1.8 for those without a clearly accountable function. It also found active mitigation lagging risk awareness across nearly every risk category. Organisations know what could go wrong. Fewer can show what they did about it.

Both findings are correlational, both are self-reported by the same respondent who also rates the outcome, and both firms sell governance advisory. A person who feels good about their AI programme rates every item high. The causal direction is unresolved.

Set the surveys aside and the mechanism is less mysterious. To show a board that a control operated, you need a record of the moment it operated. To show a board that a use case moved a number, you need a record of the same work before and after. In practice these come from the same places: the pipeline, the ticketing system, the deployment log, the incident record.

An organisation that cannot evidence its controls usually cannot evidence its benefits either, and for the same underlying reason. Nobody instrumented the work. The governance gap and the value gap are two readings of one missing capability.

How do you know: three tiers of evidence

Every line in a board pack should answer one question before it earns its place. How do you know. That question sorts claims into three tiers.

An assertion is a claim someone makes. A status colour, a confidence rating, a percentage with no stated method. It costs nothing to produce and nothing to change, and it can only be verified by asking the same person again.

An artefact is a document that exists. A policy, a register, an impact assessment, a certificate. It can be produced on request and it evidences design and intent. It does not evidence that the thing described happened, in production, on the day in question.

An attested record is made by the system at the moment the thing happened, held somewhere the reporter does not control, capable of showing failures as well as successes, and checkable by someone who does not trust you.

Documented is not the same as effective. A control that exists on paper and a control that demonstrably changes behaviour at the point of action are different objects, and only the second one can be declared.

The test is fast. Read any line in the pack and ask what a director would have to do to verify it. If the answer is ask you, it is an assertion. If the answer is request a document, it is an artefact. If the answer is query a system you do not administer, it is attested.

Tier	How a director verifies it	What it can carry
Assertion	They ask you again and get the same answer	Judgement and forward view, labelled as such. Never effectiveness
Artefact	They request the document and read it	Design and intent
Attested	They query a system you do not administer, and see failures as well as passes	Operation. Effectiveness. Anything a declaration depends on

One page, not forty

Research by Board Intelligence with Cambridge Judge Business School, published January 2026, found more than half of board packs now run past 200 pages, with some approaching a thousand. Directors spend just under four hours reading, about 30 per cent more than the same research found in 2011, while meeting frequency and duration have barely moved.

The cause is the uncomfortable part. Among packs that had grown, 92 per cent carried more compliance and regulation reporting and 88 per cent more risk reporting. Only a third of meeting time goes on strategy, and directors whose packs had not grown were the ones reporting more strategic focus.

Weigh that research before acting on it. The sample is 50 people and 72 per cent of them are company secretaries rather than directors. The reading-rate benchmark is the firm’s own advisory rule of thumb. Board Intelligence sells board reporting software and report-writing training, so the finding that packs are too long sits with its commercial interest. Take the direction, not the decimal places.

The direction is enough. AI reporting is, structurally, more compliance and risk reporting arriving in a pack already drowning in it. Adding forty pages does not demonstrate rigour. It demonstrates that you have not understood the problem you are describing.

So: one page in the pack. Everything else in an annex no director is obliged to read, which exists so that the one who wants to check something can.

What page one looks like

A specimen, composite and illustrative, drawn from recurring patterns rather than any single organisation. A listed group, fourteen business units, shared engineering function, December year end.

Position. Eleven AI deployments are live across nine of fourteen business units. Two return measured improvements against dated baselines, one is too early to judge. Four pilots are in flight, two deciding this quarter. We can evidence control operation for eleven of the fourteen systems classified as material; the three we cannot are in Retail Operations, instrumented by 30 November.

What is live, and what it returned.

• Claims triage, six units, live since March. Median handling time 14.2 to 9.1 minutes, measured the same way before and after. Source: case management system.
• Code assistance, engineering, live since January. Median cycle time 9.2 to 6.4 days; change failure rate 11 to 14 per cent over the same period. Source: deployment pipeline. Both moved; we report the pair.
• Contract review, Legal, live since May. Too early for a baselined result. First comparison due Q3.

Pilots in flight. Four running. Two decide this quarter. One stopped in May: the forecast benefit did not survive baselining, and the budget was returned to the portfolio rather than reallocated inside the programme.

Assurance position. Material systems producing control records: 11 of 14. Reviews recorded against merges: 1,190 of 1,240, with fifty under break-glass, each with a named approver. Transparency and literacy obligations met and evidenced.

What is worse. Mean time to detect AI-related incidents is 31 hours against 9 for non-AI. Alerting was built around human-authored change patterns. Remediation funded, delivery 28 February. Retail Operations has not reported for two periods; escalated on 14 May, unresolved.

What we cannot evidence. Whether break-glass approvals were substantive. We can show they happened and by whom, not what was assessed.

Asks. Fund review-substance instrumentation, decision by 30 September. Direct Retail Operations to report from Q3, since two escalations have not moved it. Note the intended disclosure wording for the Retail exception.

Why it reads that way

It opens on deployments and returns rather than controls, because that is the question the board asked. The assurance block is fourth and three lines long, because it exists to license the first three blocks rather than to be the subject.

Every result carries its baseline and its method. Without the method clause, 14.2 to 9.1 minutes is an assertion with a decimal point on it.

Code assistance reports a pair that disagrees. Cycle time improved and change failure rate worsened. Reporting only the first would be the most quotable sentence in the pack and the most damaging when somebody later found the second.

The stopped pilot is named, with the money. A portfolio where nothing is ever killed tells a board the measurement is decorative. Naming the stop is what makes the surviving forecasts credible.

Denominators are on the page: 1,190 of 1,240, not 95.9 per cent. The ratio survives being quoted. The percentage detaches from its base within one retelling.

And nothing on the page is green. There are no status colours anywhere. Every claim is a count, a ratio or a date, which removes the argument about thresholds before it starts.

Where to start

Most of this assumes you can reach the records, and many managers cannot. Five things have to be true first: query access you do not have to ask for each time, a written definition for every recurring number, at least one control that emits a record when it is bypassed, somewhere to put that record which you do not administer, and a named accountable person agreed above you.

If none of them are true, the minimum first move is smaller than most people assume. One system. One dated baseline. One control emitting. One record landing outside your team. One name. That is roughly a quarter of work for one person, and it produces a pack with exactly one attested claim in it.

One is enough. It establishes the pattern, proves the plumbing, and gives you a working example to point at when you ask for the rest. The failure mode is trying to instrument everything at once, discovering it needs a programme, requesting the programme, and reporting nothing for two quarters while it is considered.

None of this makes the compliance work easier. What it does mean is that the evidence built to satisfy an obligation is the same evidence that lets you argue for the next deployment. That is the only version of this worth the effort, and it is available to anyone willing to instrument one thing properly rather than describe everything vaguely.