Boards across Malaysia and the wider region are having more AI conversations than at any point in the last decade. Almost all of them are framed the same way: what can this technology do for us, and how fast can we adopt it. Far fewer boards are asking the second, harder question — what happens when it gets something wrong, and who is accountable when it does.
That gap is not a minor oversight. As AI systems move from experimental pilots into decisions that touch credit, hiring, pricing, and customer interaction, the governance question stops being theoretical. A board that has approved an AI-driven initiative without understanding its failure modes has, in effect, approved a risk it cannot yet describe.
Start with what the system actually decides
The most useful question a director can ask is deceptively simple: what decision is this system making, and what would happen if it made that decision badly, at scale, before anyone noticed? A recommendation engine suggesting products carries very different risk than a model scoring loan applicants or flagging fraud. Boards routinely evaluate AI initiatives as a single category — "our AI strategy" — when in practice each deployment carries its own risk profile and deserves its own line of questioning. Grouping them together is how material risks get approved alongside low-stakes ones, with the same light-touch scrutiny.
Directors do not need to understand the underlying model architecture to ask this well. They need to understand what the system is deciding, who it affects, and what the cost of a wrong decision looks like in commercial and reputational terms.
Ask who can override it, and how quickly
Every AI system that touches a customer-facing or regulatory decision needs a clear answer to one question: if this is wrong, how does a human find out, and how fast can they intervene? In our experience, this is the question most often skipped in board papers. Management teams are comfortable presenting accuracy metrics and efficiency gains. They are far less comfortable presenting the failure and override pathway, often because it has not been built yet.
A board does not need to build that pathway itself. It needs to insist that one exists, that it has been tested, and that someone in the organisation owns it. That single requirement — a named owner for AI failure response, distinct from the team that built the system — closes more governance gaps than any policy document.
Regulatory alignment is necessary, not sufficient
Boards in regulated sectors — banking, insurance, lending, payments — are increasingly asked to demonstrate that AI-assisted decisions meet existing regulatory standards for fairness, explainability, and record-keeping. That is the right baseline, and it is where most governance conversations currently stop.
It is not, however, where they should stop. Regulatory compliance answers whether a decision can be defended after the fact. It does not answer whether the decision-making process itself is sound, or whether the organisation would catch a systemic error before it compounds across thousands of customers. Boards that treat regulatory sign-off as the end of the governance question are underwriting a narrower form of assurance than they think they are.
The data question comes before the model question
Most AI governance failures we have seen trace back not to the model itself but to the data it was trained or is operating on — data that reflects historical bias, data that is no longer representative of current conditions, or data collected without a clear chain of consent. A board that asks detailed questions about model performance while asking almost nothing about data provenance and quality is inspecting the output while ignoring the input.
This is a place where directors without technical backgrounds can add real value. Asking where the data came from, who has checked it for bias, and how often it is refreshed does not require deep technical fluency — it requires the same scepticism a good director already applies to financial statements and management representations.
What this means in practice
None of this requires boards to become technical experts or to slow adoption to a crawl. It requires four standing habits: categorising AI deployments by decision stakes rather than treating them as one initiative; requiring a tested human override pathway with a named owner before go-live; treating regulatory compliance as a floor rather than a ceiling; and interrogating data quality with the same rigour applied to financial disclosures.
Boards that build these habits early are not slowing their organisations down. They are the ones who will be able to move fastest when the technology matures further — because they will already know what questions to ask, and they will not be relearning governance from the position of having to explain a failure that already happened.