A chair can sit through a vendor tour, collect a thick pack and still leave with no name next to the next approval. The minutes will record a briefing and nothing else. On Thursday a manager will still paste client work into whichever window loads fastest, because nobody in the room had to decide who may say yes.
The Australian Institute of Company Directors says the board plays a key role in governing the balance between opportunity and risk, including the effect on employees, customers and the other people the organisation deals with. I use that as the test for the booking. If the session never reaches those people, you have paid for a technology briefing and called it governance.
The room you are booking
The AI governance workshop runs as two tiers because the jobs differ. Staff need a half day on everyday use, what may go into a tool and when to distrust an output. Leaders, risk owners and the people who approve use cases need a day on the operating model. Directors sit nearer the second room. They still have a narrower job than the executive who will run the model on Monday.
You map that model to NIST, ISO 42001 and the EU AI Act, then you translate it into the rules the organisation already has. A session that reads those documents aloud spends the directors' time on a recital. They need the translation. Which uses are material enough for this table. Who at management owns the approval. What this board will see, and on what cadence. What stays with management and never needs a board paper.
The day for the people who approve use cases is in what AI governance training for leaders has to settle. Squads who are about to let a system act need the questions in AI governance for non-lawyers. The board session is the oversight above both. It fails when a provider sells the staff literacy booking with the word board printed on the agenda.
What the agenda has to cover
Start with where AI already sits. Directors cannot oversee a use nobody has shown them. Before the day, ask management for the tools staff already open, the vendors hidden inside products you bought for another job, and the pilots that can send, pay, file or tell a customer something. If nobody can produce that list, the first hour is the hunt, and you should say so when you book. A facilitator who arrives with a generic maturity poster and no interest in your stack will waste the morning.
Then put the decision rights on the table. One senior leader should carry oversight and report to the board, or to a committee you already run. Use the risk committee when that is where operational risk already lives. A committee created for one slide will have nobody assigned to call it. The session should force that choice while the directors who have to live with it are in the room. A recommendation that goes back to a working group you have not staffed is how the pack gets longer and the approval line stays blank.
Risk appetite belongs in the same conversation, in language a director can repeat without the slide. What you will allow on low-stakes internal drafting. What needs a recorded yes before it touches a customer, an employee or a payment. Where sensitive data stays out of a tool you have not approved. Cyber security and data governance are already on most boards' lists. The session should ask whether those controls still hold once a model can draft or act. Ask for a change to the rules you have. A fresh binder that ignores the shared drive will sit beside the policy file.
The human effect and the rhythm
Leave time for the people on the receiving end. Employees who are quietly using tools you have not approved. Customers who get an output they will hold you to. A prompt tutorial will not help these directors oversee that. They need to know which of those effects is already happening, and which one management will bring back with evidence a director can read in ten minutes.
Close on the rhythm. Every material use has an owner. Every permission has a review date, and on that date someone decides the permission continues or ends. The minutes should point at the page where the yes lives. A note in a chat will not survive an inquiry. Who may let an internal agent send is the squad version of that question. The board version is which executive must tell you before that permission exists.
Write the rhythm into the calendar before you leave the room. Name the month you will look again. Name the person who brings the page. If the next look depends on someone remembering, the date will slip. Directors are busy enough that a date with no name loses to the next pack.
How to choose who runs it
I ask a short list of questions before I would put a provider in front of a board. You can ask us the same ones. Will they work from your acceptable-use rules and the tools staff already open, or from a framework slide with your logo on the last page? We shape the leadership day around those rules. A proposal that cannot show that work is guessing at your rules.
Will directors leave with a decision they can minute? A keynote can raise awareness. The useful close is a named owner, the committee that will hear them, the uses that reach this table and the date you will look again. If the proposal offers a discussion guide and a reading pack, you are booking homework. Who from management must attend? Directors cannot guess where the tools already run. The person who owns technology and the person who has seen the unapproved use should be in the room, ready to answer. A directors-only hour with no operator in it produces questions and no record of the facts.
Check you are buying the leadership day, separate from the all-staff half day. Most large organisations need both, and they are different bookings. Buy only the staff session and the approval question stays where the policy file left it. Buy only the board session and staff keep pasting work into unapproved tools. Say which one you are buying this time. Lawyers still mark the pages that touch privacy, employment and the regulator. Directors need the questions they will ask, and the evidence they will accept, in plain words. A session that trains the board to recite article numbers will not survive the next paper.
Length, place and what to refuse
A half day can force the owner and the first list of material uses if management has done the inventory. A full day gives you time to test two live uses against the appetite you just set. In person is better when the directors are in one city, because you can see who agrees and who goes quiet. Remote works when the board is split, if the chair stays on the call and you stop the side channel that lets people dissent off the record.
Leave the tool demo off the agenda. A model drafting a paragraph gives the directors nothing they can minute. Leave the tour of other companies off it too. Another firm's slide will not name your owner. Skip the policy reading that never opens the tools your staff already use. People remember a short rule. A rule so heavy that the rollout stops has failed, and a rule so light that sensitive data keeps leaving the building has failed too. Refuse a facilitator who wants the board to become the helpdesk. Depth on how a model works belongs with the people who run the systems. The board's skill is the question and the demand for evidence.
Also refuse the session whose only promised line is that the board is now more aware. You can circulate a paper for that. The workshop has to change what the next minutes can point at. If the provider cannot say what will be different in the register a fortnight later, keep the money.
What you should be able to open
Within a fortnight you should be able to open one page and see the uses the board will oversee, the management owner, the committee that hears them and the date of the next look. Management should know which uses they may approve without coming back, and which ones wait until the board has seen them. Staff still need a plain statement of what may go into a tool. That statement is the staff tier. It has to match the appetite the directors just set, or you are running two policies.
If you are choosing the day, send the inventory you already have, the policy you already wrote and the decision you need in the minutes. We will shape the leadership day around that constraint. If you have no inventory, say that. The first hour can build it with the operators present. We will not read a framework at people who needed a name and a date. A chair is ready to book when they can name the committee that will own the oversight and the executive who will carry it. Add one live use you want tested in the session. If those are missing, hold the directors' calendar and book the management meeting that creates them. The workshop will not invent an owner the organisation has refused to name.
