# What Is AI? A Board Member’s Plain-Language Guide

Date: 2026-06-15

“AI” is now used as a label for everything from simple automation to systems that generate text, code, images, and decisions. For boards, the first job is not to become technical—it is to build a shared vocabulary so strategy, risk, and accountability can be discussed without hand‑waving.

<!--more-->

## A Useful Definition (One Sentence)

The OECD definition is board-friendly because it’s broad and technology-neutral:

**Fact:** An AI system is a machine-based system that *infers* how to generate outputs (predictions, content, recommendations, or decisions) from inputs, and those outputs can influence physical or virtual environments ([OECD definition](https://legalinstruments.oecd.org/public/doc/648/dd63ee37-eef0-40d8-9480-26c011db227d.htm)).

In practice, “infers” usually means it learned patterns from data rather than being explicitly coded with fixed rules.

## What AI Is (and Isn’t)

Boards often get stuck because vendors and teams use “AI” as a prestige word. Here is a cleaner separation:

- **Automation (rules-based)**: “If X then Y.” Deterministic, predictable, easy to audit.
- **AI / ML (data-driven)**: “Given X, Y is likely.” Probabilistic, can degrade when conditions change.
- **Generative AI (LLMs, image models)**: Produces content that can *look* confident even when wrong; needs governance and verification.

The strategic question isn’t “do we use AI?”—it’s **where does probabilistic behavior help, and where does it create unacceptable downside?**

## Key Terms Boards Should Know

### AI
The umbrella term. It includes many techniques (not just today’s LLMs).

### Machine learning (ML)
A subset of AI where models learn from data. The organization’s risk posture changes because outcomes become **statistical**, not guaranteed.

### Large language model (LLM)
A type of ML model trained to generate and transform text (and sometimes multimodal outputs). LLMs are powerful for drafting and summarizing, but they can “confabulate” (hallucinate) and still sound plausible.

### Agent
An AI system that can **plan and take actions** using tools (e.g., browse, write tickets, trigger workflows). Agents raise the risk level because they can do more than “talk”—they can *act*.

## Why AI Matters at Board Level

AI is not a “tech project.” It touches the board’s core duties:

- **Strategy and value creation**: productivity, customer experience, new product capability, faster analysis.
- **Risk and controls**: data protection, cybersecurity, model errors, reputational incidents, third-party risk.
- **Operating model**: new skills, new controls, and new failure modes (especially with agents).
- **Regulatory exposure**: GDPR for personal data processing; DORA for ICT resilience in finance; EU AI Act obligations and governance expectations (risk-based compliance).

## Five Oversight Questions That Work in Any Industry

Use these in management reporting and vendor discussions:

1. **Inventory**: What AI systems are we using (including “shadow AI”)? What data do they touch?
2. **Role clarity**: For each system, are we a *provider*, *deployer*, or *user*? Who is accountable?
3. **Risk tier**: What decisions does the AI influence? What is the impact if it is wrong?
4. **Controls**: What are the guardrails (privacy, security, human oversight, monitoring, escalation)?
5. **Evidence**: What metrics and logs prove the controls work (not just policies on paper)?

---

**Want a structured deep dive beyond the buzzwords?** I deliver board-level courses on AI, cyber, and regulations—and I consult with boards on AI strategy, governance, and risk. [Contact me](https://goldmanmalka.com/about).

---

### Relevant Sources

1. **OECD definition of an AI system (Recommendation on AI)** — OECD — [https://legalinstruments.oecd.org/public/doc/648/dd63ee37-eef0-40d8-9480-26c011db227d.htm](https://legalinstruments.oecd.org/public/doc/648/dd63ee37-eef0-40d8-9480-26c011db227d.htm)
2. **AI Risk Management Framework** — NIST — [https://www.nist.gov/itl/ai-risk-management-framework](https://www.nist.gov/itl/ai-risk-management-framework)
3. **AI RMF 1.0 (NIST AI 100-1)** — NIST — [https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10](https://www.nist.gov/publications/artificial-intelligence-risk-management-framework-ai-rmf-10)
4. **ISO/IEC 42001 explained (AI management systems)** — ISO — [https://www.iso.org/cms/%20render/live/en/sites/isoorg/home/insights-news/resources/iso-42001-explained-what-it-is.html](https://www.iso.org/cms/%20render/live/en/sites/isoorg/home/insights-news/resources/iso-42001-explained-what-it-is.html)
5. **The 2026 AI Index Report** — Stanford HAI — [https://hai.stanford.edu/ai-index/2026-ai-index-report](https://hai.stanford.edu/ai-index/2026-ai-index-report)