Board-Level AI Reporting: What to Include

The PSU Board received a sixteen-slide 'AI update'. Slide three was a globe. Slide seven was tokens consumed, up and to the right, labelled adoption. Slide fourteen said next quarter: autonomous finance. No one could say how many workflows were live, whether any of them could spend, or how many citizens had complained. The independent director asked for the register. There was a pause that lasted long enough to become minutes.

Boards and secretaries govern residual risk, not GPUs. Give them the same objects this cluster already built: register, class, refusals, escalations that breached clock, grievances, money-gate attestations, incidents, and the three residual risks you want them to carry in writing. If a metric does not change a decision they can take, delete it.

Template for CIOs. 16 August 2026. Not legal advice. A listed PSU and a line ministry are different animals; the objects still rhyme.

The pack that fits ten minutes

One folio plus annexes. The folio is what they read. The annexes are what CAG will later ask for.

Folio line	What good looks like	What to leave in the annex
Register census	N live, N pilot, N killed this quarter; citizen-facing / money / identity counts	The full register extract
New or upgraded classes	What went live, who signed the standing order, sunset	The cards
Money gate	Attestation: no agent spent; any near-miss	[DFPR](/blog/delegation-of-financial-powers-vs-ai-agents) mapping
Refusals and breaches	Top reason codes; escalations that missed the clock	Sample packets
Citizen harm	Grievances with agent flag; RTIs; press	Individual tickets
Incidents	CERT-In-reportable or near; outbound surprises; prompt leaks	Forensics
Eval residual	Which served language or district is still weak	The cell tables
Decisions asked of the Board	Kill, fund, accept residual risk, change sunset	Options paper

The last line is the only reason the pack exists. A Board that is only informed is being trained as an audience. Ask them to kill a hobby, fund a gate, or write that they accept a named residual risk until a date. If you cannot name a decision, skip the meeting.

What never leads the pack

Tokens, latency, 'hours saved' without a method, vendor awards, global leaderboard ranks, and photographs of a launch. Those can live in an operations annex. Leading with them is how autonomous finance arrives as a slogan rather than as a DFPR question.

Do not lead with a legal opinion that 'we are DPDP compliant'. Operational duties largely apply from 13 May 2027. The honest line is: Board existed 13 November 2025; here is what we already run as if the duties applied; here is the gap. Boards can smell a harbour that does not exist.

Two Board mornings

Objections

The CEO wants a good-news pack only. Answer: then it is a brochure. Residual risk is the Board's job.

The CISO wants forty red metrics. Answer: pick the three that would change a kill-or-fund decision. The rest is SOC.

A director asks for blockchain assurance. Answer: point them at the teardown article. Signed logs plus SIEM will be the line in the folio.

The vendor offers to present. Answer: they may sit in the annex discussion. They do not own the folio.

A four-week playbook

• Week 1: agree the folio lines with the DPO and the internal auditor. Delete the globe slide.
• Week 2: populate the first census from the register, including killed rows.
• Week 3: write one residual-risk sentence the Board can accept or reject.
• Week 4: tabletop the meeting. If no decision is asked, rewrite the folio.

File note you can paste

Subject: Quarterly Board / secretary pack for software agents.

The CIO will place a one-folio pack each quarter covering register census, class changes, money-gate attestation, refusal and escalation-clock breaches, citizen grievances and RTIs, incidents, and residual eval risk. The pack will end with decisions requested. Token counts and vendor marketing will not lead.

An out-of-cycle note will be put up when a money-class or identity-class workflow is proposed, or when a material incident occurs. This note is not legal advice.

Minutes that actually carry residual risk

If the Board accepts a residual risk — vernacular cell still weak until 30 November; unofficial research copilot killed; money-class refunds remain human-gated — write those nouns in the minutes. 'Noted' is how residual risk evaporates before the next quarter. A later CAG party or a later independent director should be able to see what was carried, by whom, until when.

PSU boards have company-law duties that a ministry council does not. Do not copy a listed-company template onto a department or the reverse. Copy the objects: census, gates, incidents, decisions. Change the addressees. A syndicate that cannot bind a vice-chancellor is not a Board for this purpose; find the body that can stop a workflow.

Send the folio forty-eight hours ahead. A ten-minute slot with a folio opened in the room for the first time will produce questions about the globe you already deleted. The decision line should be highlighted. If directors want the annex, they will ask. Most will not. That is fine. The annex is for the one who will save you.

After 13 May 2027, add a DPDP line: rights requests, consent withdrawals that the runtime honoured or failed, and any Board-facing incident you would have to tell the Data Protection Board about. Until then, run the line anyway as rehearsal. Boards hate surprises more than they hate ugly cells.

• Never let the vendor present the folio.
• Never bury a money-gate near-miss under an adoption graph.
• If no decision was taken, write that, and ask why the item was listed.

Informational field guidance. Company-law boards, university syndicates and ministry councils differ. Confirm your instrument of governance with counsel.

How this survives CAG, RTI or the Board

“Board-Level AI Reporting: What to Include” is not a workshop slide. A P1 CIO/CTO will have to reconstruct a decision after the officer who clicked approve has been transferred. Write the artefact that lets a stranger replay the case: the log fields, the approval, the override, the register row.

If the Board pack is a latency heatmap, the Board cannot govern. Give them the register, the classes, the refusals, the grievances, the money gates, and the residual risks you are asking them to carry. India AI Governance Guidelines (November 2025) are guidelines, not a statute. DPDP still allocates fiduciary duty. Delegation of Financial Powers still allocates who may spend. Do not hide those instruments behind the word governance.

If you cannot show who acted, on which purpose, with which data class, and who could have refused, you do not have accountability. You have a chatbot with a charter PDF.

• Name the owner of “AI board report template” inside the department, not the vendor.
• Keep CERT-In-relevant logs in India for the required period.
• Store overrides with a reason an auditor can read.
• Put the workflow on the AI register before it touches a citizen.

Close this loop before the next CAB

Put “Board-Level AI Reporting: What to Include” on the next change-advisory or bid-opening agenda as a single line item with an owner. If it cannot earn a line item, it will not earn a control. The owner should be a P1 CIO/CTO, not “the vendor.”

Revisit the item when the model, the GeM term, the region, or the SI changes. “AI board report template” is not a one-time workshop. It is a watch item. Date the last check. Unsigned watch items are souvenirs.

What the next noting must contain

“Board-Level AI Reporting: What to Include” belongs in a file, not only in a search result. A P1 CIO/CTO should be able to point at one artefact that proves “AI board report template”: a packet capture, a processing schedule, a scored evaluation row, a dated notice, or a refusal rule. If the only evidence is a slide, you have a heading.

If the Board pack is a latency heatmap, the Board cannot govern. Give them the register, the classes, the refusals, the grievances, the money gates, and the residual risks you are asking them to carry. DPDP 2023 does not define sovereign AI and does not write a blanket localisation rule for every model hop. CERT-In’s 28 April 2022 directions still set specified incident clocks and 180-day log retention in India for in-scope events. The November 2025 AI governance text is guidance, not a statute. A Proprietary Article Certificate, when it is lawful, lives in GFR Rule 166 — not Rule 161.

Write three dated sentences under C6 Governance & Audit: what was decided, which designation owns it after the next posting order, and when it will be re-checked. Unsigned sentences are souvenirs. Dated sentences are controls.

• Name the designation that owns “AI board report template”, plus a deputy.
• Attach one artefact a stranger can open next year.
• Name the instrument you are actually using — Act, direction, GFR clause, GeM term, or guideline paragraph.
• Leave unsourced percentages, GMV slides and house forecasts out of the noting.
• Revisit when the model, the SI, the notice, the region or the posting changes.