It comes up near the end of the meeting, usually from the board member who read something on the plane. “Are we safe with AI?” You have five minutes, no slides, and a room that has been sold hype all year and is now bracing for fear. Neither is what they want. They want to know someone has their hands on it.

Here’s the thing. That question has a short answer, and the short answer is better than the long one. Three sentences, and each one is a fact you can stand behind.

Build AI board reporting around facts and decisions

Sentence one: what AI can reach today. Which systems, which data, which tools are connected. If the honest answer is “we have not fully measured that yet,” say so, because that is also a fact, and it sets up the next sentence.

Sentence two: what it is allowed to do. Read only, or take actions, and which actions require a person to approve them. This is the sentence that tells a board you are governing, not guessing.

Sentence three: how we would know if that changed. The log, the review, the person whose job it is to look. A board does not need the mechanism. It needs to hear that there is one.

Then bring one number you can defend, and say where it came from. Not a feeling, not “we think we are in decent shape,” and not a statistic from a vendor’s survey. The best number is one you measured yourself: how many systems AI is connected to, how much of the file share it can reach, how many actions it can take without a person. Name the measurement scope and date, along with any limitation. A measured gap is something a board can fund. A worry is not.

Show the path, not the wall. Boards react badly to a list of everything that is blocked, because it sounds like the company is falling behind. Instead: here is what we have approved, here is what is next, here is what is off limits for now and why. Same facts, different shape, and the shape says “we are moving carefully” instead of “we are stuck.”

Say what you have said no to. Think of it like a CFO who has never declined a spend request. Nobody trusts that CFO. A security leader who can name one AI request that was turned down, and the reason, is more credible in that room than one who says everything is fine.

The key thing is to end by asking for one decision. A budget line, an owner, a policy sign-off, a date. If the meeting ends with a mood, you will be asked the same question next quarter. If it ends with a decision, the board has joined the work, and the question becomes “how is it going” instead of “are we safe.”

So basically the five minutes are not a test of how much you know. They are a test of whether you can say it plainly. Three sentences, one number, one path, one no, one ask.

Practical next step: write your three sentences today, before there is a meeting. Read them to someone outside security and ask whether they understood. If any sentence needs a second sentence to explain it, cut it down until it does not.

Where Ovatio fits

An AI Readiness Assessment turns evidence from an agreed scope into a readout and prioritized next steps your team can explain.