Why this framework exists
Many AI conversations start with technology: models, tools, vendors or automation. At board and management level, that is usually too late as a starting point.
The first questions should concern decisions: what are we funding, what risk are we accepting, who is accountable for the result and whether the organization can move from a pilot to a permanent process.
Risk
What risks does this AI use case create?
- Which processes are already supported by AI?
- Does AI affect customers, employees, financial decisions or legal compliance?
- What data enters the system and who approved its use?
- Is there a scenario for AI error, data leakage or a decision the organization cannot explain?
- Are AI risks visible in risk management, compliance and audit?
ROI
Where is AI expected to change the result?
- What business problem does the AI initiative solve?
- How will we know the project makes sense?
- What is the cost of maintaining the solution after the pilot?
- Who owns the business result, not only the technology launch?
- At what result is the project scaled, stopped or rebuilt?
Responsibility
AI often blurs accountability. Business says it is technology. IT says it is process. The vendor says it is configuration. Compliance sees the risk when the decision is already operating inside the organization.
- Who owns each AI use case?
- Where does a human approve a decision, and where do they only react after the fact?
- Can the organization reconstruct the decision path: data, prompt, model, output, human, final decision?
- Who owns the AI vendor and the terms of service?
- Does accountability exist in the process or only in policy?
Execution
It is easy to run an AI pilot. It is harder to build a process that works every day, has an owner, metrics, quality control, maintenance budget and a place in the operating model.
- Does the pilot have a path to a permanent process?
- Which functions must cooperate: business, IT, data, security, legal, compliance, HR, operations?
- Does the team have the competence to maintain the solution after implementation?
- How is output quality monitored after launch?
- Who has the authority to stop a project if risk grows faster than value?
How to use it
This framework does not replace AI strategy, legal audit or technical assessment. It helps structure the conversation before a decision.
It works best when a board wants to assess an AI strategy presented by management, when management wants to review a portfolio of AI initiatives, or when an owner wants to see whether the organization controls risk and execution.