Your board asked what the company is doing about AI. Fair question. Asking it is the board’s job. The easy answer is a slide, and it writes itself: the tools already in use, a pilot in one team, a promise to keep watching the space. It gets through the meeting.
The meeting after it is harder. A slide reports activity, and activity is not the kind of thing a board can check on a fixed date. Nobody is lying, and still there is nothing in the slide that anyone can be held to. Four parts change that. Not one is a technology question.
The question is not going away
In Finland the duty is written down. The board sees to the administration of the company and to the appropriate organisation of its operations, in those words. Read chapter 6, section 2 of the Limited Liability Companies Act 624/2006. Management must act with due care, which is chapter 1, section 8, and both duties bind every Finnish limited company, whether it is listed or not. None of it is new.
EU law adds a floor. A company that uses AI systems is asked to support the AI literacy of the staff who operate them. The duty sits in Article 4 of the AI Act, in the wording the EU amended in July 2026. National authorities begin supervising it in August 2026.
The same amendment pushed the high-risk rules the other way, back to December 2027 and August 2028, while the literacy duty stayed where it was. None of that tells you what to do about AI, only that answering is no longer optional. So build the answer from parts a board can check.
The first part is a problem with a name
Begin with a problem stated in business terms. Something with a name, costing money or time today, rather than an ambition to use AI. Quotes go out slowly. Too many go out wrong. Every Monday the same report is rebuilt by hand. The forecast is a guess, because nobody trusts the pipeline data.
AI belongs in the sentence, not the noun: it is how a problem gets solved, never what is wrong. An AI plan gives a board nothing it can be right or wrong about, which is why it settles nothing. One problem is enough. The next starts from what the first taught.
The number is your CFO’s, in your CFO’s units
The second part is your CFO’s number. Days, euros, margin points, hours at month end. Kept as a running record rather than a one-off estimate, that number becomes a ledger, and the ledger lives with your CFO rather than with the supplier. Every line names the decision or the piece of work it came from, and nothing goes in without one.
Make it forward-looking. What already happened is a reconstruction, and reconstructions get argued about in the meeting where they matter most. What changes next year can still be acted on. The record carries the dead ends as well as the gains, because a number that only rises is not honest.
Solved is agreed before the build starts
The third part is a definition of solved, in writing, naming which ledger line moves and roughly by how much. Agree it before anyone builds anything. Written after the fact, solved becomes whatever was delivered; written first, it is a test the work can fail. Oversight rests on that difference.
Solved has to be one thing, not five problems in one name. One question sharpens it. Ask what breaks if the thing is switched off, and then design the work backwards from that list.
The reading date goes in the minutes now
The fourth part is a date. On that date the ledger is read, by the people who agreed it, against what they wrote down. Fix the date before the work starts. Settle what a thin result means as well, because both of those questions get much harder to agree once somebody has a stake in the answer.
A date also decides who speaks first. The supplier should be the one to say the number is thin, and the one to offer to stop. If that is not agreed beforehand, the reading quietly turns into a negotiation nobody set out to have. We set our own reading at day ninety. Any date works, as long as it is fixed in advance.
The answer that is still there in a year
Without those four parts, the answer decays. Nobody can say a year later whether it worked, so the next meeting gets a fresh slide. The question restarts. With them, the answer becomes a small piece of governance. One problem, one number, one date. A board can oversee that, because there is something in it to be wrong about.
Take one concern to your next board meeting. Not five. Ask your CFO which of their numbers it touches. Put the reading date in the minutes. Write the decision down with its reasoning, and note whether it can be reversed. A year from now, the answer should not depend on who is still employed.
The board is not really asking about AI. It is asking whether your company can still account for what it does.