In the past two years, I have sat in on more board-level reviews of AI deployment proposals than in the previous 10 combined. The dollar amounts have gone up, as have the strategic stakes. What has not gone up enough is the quality of the questions board members ask before approving these proposals.
Most board reviews follow a predictable script. Management presents a use case, a vendor, a timeline, and an ROI model. Board members ask about the vendor's track record, the integration risk, and the projected savings. The proposal gets approved or sent back for revisions on the basis of those answers.
Those questions are not wrong. They are insufficient.
Across 20 years of building insurance software and watching deployments succeed or fail, I've seen three other questions matter more for the long-term success of an AI decision-making deployment. Most board members are not asking them yet. The ones who do are the ones whose organizations end up with AI in production rather than stuck in pilot.
Question 1: What is the data foundation we are building this on?
Every AI deployment runs on data the organization already has. The proposal will say so. What the proposal usually does not say is whether that data is in the shape the model needs.
In my experience working with carriers, the data foundation question surfaces three different problems depending on the organization. Sometimes the data exists but is fragmented across systems of record that cannot be reconciled to a single customer or transaction. Sometimes the data is reconciled but tagged inconsistently across business units. Sometimes the data is consistent but does not include the variables the model actually needs to make a defensible decision.
Each of these is a deployment-stopping problem. None of them is visible from the vendor demo. All of them surface in the first 60 days of integration when the model starts producing outputs that the business cannot use.
When my team published research from 20 US insurance leaders earlier this month, data quality and fragmented systems came in as the single biggest blocker to AI deployment. ROI uncertainty came second. Internal IT capacity came third. The order surprised some readers. It did not surprise me.
Board members who ask "what is our data foundation" are not slowing the project. They are giving it a chance to succeed.
Question 2: How do we document an adverse decision?
Most AI deployments at the decision-making layer touch outcomes that affect customers. In insurance, that means claim denials, payout reductions, and coverage decisions. In banking, that means lending denials and credit limit reductions.
For each of those, the regulatory environment in 2026 expects you to be able to document why the AI system reached the decision it did, what input features it considered, what model version was active at the time, and what human review was involved. The expectation is not theoretical. The NAIC Model Bulletin on AI in insurance, adopted in 24 U.S. states as of early 2026, makes this explicit. The EU AI Act makes this explicit. Federal regulators in banking and healthcare are moving the same direction.
In recent research, only three of 14 carriers with AI in production were confident they could produce a complete decision audit trail within five business days if a state regulator asked. The other 11 were less confident. Some far less.
The board question is not whether the AI deployment will be regulated. It will be. The board question is whether the deployment as proposed has the documentation discipline built in, or whether it will require an expensive retrofit when a regulator first asks.
Question 3: Does the AI touch the actual decision?
This is the question most likely to change the structure of the deployment itself.
In my experience, AI deployments succeed faster and create more measurable value when they sit on the edges of a decision-making pipeline rather than at the decision itself. The reasons are operational and regulatory. Capabilities that handle structured but tedious work, such as document interpretation, intake triage, and fraud signal generation, scale faster because the data they consume is more structured, the output they produce is easier to measure, and the regulatory scrutiny they attract is lower.
Capabilities that touch the decision itself, such as reserve recommendation in claims, credit decisioning in lending, and care recommendation in healthcare, scale more slowly. The data is messier. The measurement is harder. The regulatory exposure is higher.
This does not mean decision-making AI is wrong. It means decision-making AI should generally not be the first deployment. The board approving a first AI deployment that sits at the decision itself, before the organization has built the data foundation and the documentation discipline on lower-stakes capabilities, is approving the most complex deployment under the worst conditions.
In that same research, of the 20 U.S. insurance leaders surveyed, just three described their organizations as running AI-assisted decision making. Seventeen still relied on humans for every meaningful decision. The 13 with any AI in production had deployed it on the edges of the pipeline, not at the decision.
A different conversation
When boards ask these three questions, the conversation about an AI deployment changes. The vendor selection becomes secondary. The integration timeline becomes secondary. The ROI model becomes secondary, because all three depend on getting the data foundation, the documentation discipline, and the pipeline position right first.
The boards that ask these questions get more AI deployments into production. The boards that do not ,get more pilots that never move beyond pilot.
