What it means
- The board (or its risk or audit committee) receives regular, decision-useful reporting on AI: what AI the company uses, how risky it is, how it is performing, and what went wrong.
- A small set of AI risk metrics (key risk indicators) is tracked over time against agreed thresholds.
- Top management reviews the AI management system at planned intervals and records decisions.
- ISO 27001 reuse: None at Annex A level. New for AI, not covered by ISO 27001 Annex A. Your ISO 27001 management review cadence (clause 9.3) and risk committee reporting can host the AI dashboard.
Why it matters
- RBI FREE-AI expects board-approved AI policy and consumer protection frameworks, and asks for AI disclosures in the annual report, which the board must stand behind.
- Directors carry accountability for AI risk; they cannot oversee what they do not see.
- ISO/IEC 42001 requires management review and leadership commitment.
Checklist
- Agree the reporting forum (board, risk management committee, audit committee) and frequency (at least quarterly for BFSI).
- Define 8 to 12 AI risk metrics, for example:
- Set thresholds (green, amber, red) aligned with the board's AI risk appetite (SC-AI-001 AI governance policy approved by the board or top management).
- Include upcoming regulatory changes from horizon scanning (SC-AI-009 Regulatory applicability register and horizon scanning).
- Hold and minute a management review of the AI management system at least yearly.
- Approve the annual report AI disclosure (SC-AI-025 Public AI transparency statement and notices).
- Track board actions to closure.
Evidence examples
- Board or committee AI risk dashboard packs.
- Minutes showing discussion, challenge and decisions on AI.
- KRI definitions with thresholds and data sources.
- Management review minutes for the AI management system.
- Board-approved annual report AI disclosure.
- Action tracker from board and management reviews.
Common pitfalls
- Reports full of AI success stories with no risk metrics.
- Metrics with no thresholds, so nobody knows when to worry.
- AI reported only after an incident.
- Directors with no AI briefing, so they cannot challenge what they see.
Satisfies
- VoluntaryISO/IEC 42001
- BindingEU AI Act
- SupervisoryPRA SS1/23
- VoluntaryNIST AI RMF and GenAI Profile
- SupervisoryNYDFS AI Cybersecurity Letter 2024
- SupervisoryOSFI E-23
- VoluntaryRBI FREE-AI
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 5.1 leadership and commitment
- 9.1 monitoring, measurement, analysis and evaluation
- 9.3 management review
ISO/IEC 27001
No direct equivalent
SOC 2
- CC1.2
- CC2.2
Key takeaways
- A short AI dashboard with thresholds beats a long narrative.
- Report regularly, not just after incidents.
- Minute the board's challenge and decisions; that is the evidence.