AI strategy in the boardroom: the questions that matter

Artificial intelligence is not an IT matter that can be delegated — it belongs to the overall direction (Oberleitung) of the organisation and thus on the agenda of the board of directors. The law does not require this implicitly but expressly: overall direction and the ultimate supervision of management are non-transferable duties of the board of directors (Art. 716a OR, Swiss Code of Obligations). For this, a board of directors need not understand AI in technical terms. It must ask the right questions — on strategy, risk, competence and oversight — and must not settle for executive management's answers until they are robust.

The key points at a glance

• AI is a matter for the top, not for IT. Where AI touches value creation, the risk profile or legal compliance, it falls under overall direction — which the board of directors cannot relinquish under Art. 716a OR.
• Questions beat expertise. The board of directors need not understand the models; it must steer executive management with the right questions and scrutinise its answers.
• The governance gap is documented. Only 17% of Swiss boards of directors have all AI outputs reviewed by a human, and three in four receive scarcely any regular reporting (swissVR Monitor II/2024).
• The same applies to nonprofits — and more urgently. Foundation boards (Stiftungsrat) and association boards bear the same duty of care and oversight, usually within volunteer-run (militia) structures and with other people's money.

Why AI is a matter for the top

The board of directors of a public limited company has a handful of duties it can neither delegate nor evade. Foremost among them is the "overall direction of the company and the issuing of the necessary directives", together with the "ultimate supervision of the persons entrusted with management, in particular with regard to compliance with the law" (Art. 716a para. 1 OR). As soon as AI touches an organisation's strategic direction, risk profile or legal compliance — and increasingly it does — it falls squarely within this inalienable core. A body that leaves AI to IT or to individual enthusiasts breaches its duty to lead.

For nonprofits, the same logic applies through a different legal basis. By settled practice, the foundation board holds the overall direction of the foundation and is subject to a statutory duty of care, loyalty and oversight; the association board conducts the association's affairs and represents it (Art. 69 ZGB, Swiss Civil Code). Delegating a task never releases a supervisory body from the duty of careful selection, instruction and monitoring — and that holds for an outsourced AI service just as much as for any other management function.

That a real gap yawns here is borne out by the figures. The swissVR Monitor II/2024 (Deloitte, HSLU, n=391) records that 70% of Swiss boards of directors have engaged with generative AI, yet only 17% have all AI outputs reviewed by a human, and roughly three in four receive scarcely any or no regular reporting on AI use. The greatest perceived risk is flawed AI results (60%). The attention, then, is there — the oversight is not yet.

The seven questions

A board of directors or foundation board needs no textbook questionnaire, but seven questions to put to executive management and whose answers it examines in earnest. They align along the four duties: strategy, risk, competence, oversight.

1. Where exactly does AI create value for us — and where is the limit? This question forces executive management to anchor AI in value creation rather than in the technology. A good answer names two or three concrete use cases with the expected benefit and states just as clearly where AI is unsuitable or too risky for the organisation. Vague enthusiasm without a boundary is a warning sign.

2. Which few priorities do we pursue first — rather than everywhere at once? The biggest mistake is frantic activity on a broad front. A robust answer shows deliberate prioritisation: a few initiatives with a clear link to the strategic objectives, not a dozen parallel pilot projects without focus.

3. Which AI systems are we already using — including unbidden? In almost every organisation, "shadow AI" is at work: staff use freely available tools without the leadership knowing. A good answer rests on a genuine inventory of all AI systems, including the AI features in bought-in software — not on a guess. Where the inventory is missing, so is control.

4. Who is liable for AI outputs, and who reviews them? An AI system never relieves anyone of responsibility; that remains with the organisation and its governing bodies. A sound answer names clear responsibilities, a review mechanism for critical outputs and documented guardrails for data protection under the revised Data Protection Act (revDSG). That, according to swissVR, only 17% of boards have all outputs reviewed shows how often this question is left open.

5. Do executive management and staff have the necessary AI literacy? AI literacy is no optional extra but, since February 2025, a legal obligation: Art. 4 of the EU AI Act requires a sufficient understanding of AI from all who operate AI systems — with effect for Swiss organisations with an EU nexus as well (see EU AI Act for Swiss nonprofits). A good answer evidences targeted, documented training — not the assumption that "they will pick it up as they go".

6. How is the board reported to on AI — and against which metrics? Without reporting there is no ultimate supervision. A robust answer defines a few meaningful metrics — systems in use, incidents, reviewed outputs, level of competence — and a fixed cadence in which they reach the board. That three in four boards of directors receive no regular AI reporting is the single greatest structural weakness of all.

7. Which guardrails have we set — and do they withstand scrutiny? Strategy without guardrails is risk. A good answer points to a binding AI policy that governs data protection, permissible fields of use and red lines and is reviewed regularly — not to a paper drafted once and left in a drawer.

Especially for nonprofits: smaller is not safer

In nonprofit organisations, these questions are not smaller but more urgent. Foundation boards and association boards mostly work within volunteer-run (militia) structures — with less time, less frequent technical background and yet full legal responsibility. They are also under particular scrutiny: foundations are subject to state foundation supervision, and the handling of donor and grant money tolerates no uncontrolled experiments. Added to this, nonprofits often work with especially sensitive personal data — of clients, beneficiaries or members. Here, ill-considered use of AI jeopardises not only efficiency but the trust that is the organisation's very basis of existence. That is precisely why the seven questions belong in every board and foundation board meeting too.

From questionnaire to AI strategy

The seven questions expose the governance gap — they do not yet close it. The step from good questions to robust answers runs through a structured approach: an honest baseline assessment, prioritised use cases and guardrails built in from the outset. That is exactly what we developed the path to effective AI for — three phases, nine steps, with decision points at which the board decides, with full cost control, whether to proceed.

Often, for the right questions, a board of directors first needs an independent outside perspective. Our sparring for C-level executives and boards of directors challenges assumptions, puts risks in perspective and makes decisions robust — with no sales interest of our own in any particular technology.

If you would like to sharpen the seven questions for your organisation, arrange a free initial consultation. In 45 minutes we clarify where your board stands today and what the most sensible next step is.

This article provides general guidance and does not constitute legal advice.

Harry Witzthum

Founder of Rautaki · Doctor of Philosophy · NPO manager VMI