Questions the board will ask about technology this year

Board questions about technology are rarely about technology. They are about exposure, competence and whether the money is buying anything. These eight come up most often, with what sits underneath each.

“What are we doing about AI?”

Underneath: does our technology leadership have a view, or are we reacting to vendors?

A good answer names two or three specific uses with owners and expected outcomes, says what has been deliberately declined, and states what has to be fixed first. A list of pilots reads as activity rather than direction.

“Are we spending the right amount on technology?”

Underneath: is this number defensible, and how would we know?

Benchmarks help less than a split does. Run, grow and transform — with the observation that the transform number is what buys the future and it is usually the first thing cut.

“How exposed are we to a cyber incident?”

Underneath: if it happened, would we look like we had been careless?

Answer with what is in place, what is known to be weak, what is being done about it and by when. Boards are far more comfortable with a named gap on a plan than with an assurance that everything is fine.

“Could our data end up inside an AI tool?”

Underneath: reputational and legal exposure.

Answer with what is actually configured — which tools are sanctioned, what data may go into them, what the contracts say about training, and what has been blocked. “We have a policy” is not the answer; what is enforced is.

“What happens if a key system fails?”

Underneath: continuity, and whether anyone has tested the assumption.

The credible answer names the critical systems, the recovery expectation for each, and when it was last tested. Untested recovery plans are widely understood by boards to be aspirations.

“Are we too dependent on one vendor?”

Underneath: pricing power and the cost of changing our mind.

Answer with where the concentration sits, what the exit would cost, and where it was a deliberate choice. Deliberate concentration with known exit costs is a defensible position; undiscovered concentration is not.

“Is the big program going to land?”

Underneath: do we believe the status reporting?

The strongest answer references an independent read. A leader who has arranged their own assurance is demonstrating the thing the question is testing.

“What keeps you awake?”

Underneath: are you being straight with us?

Name one real thing, with what you are doing about it. Answering with nothing, or with something safely generic, costs more credibility than the risk itself would.

The pattern

A number, a date and a name in each answer. And at least one thing you have decided not to do — the fastest way to demonstrate that the plan is a set of choices rather than a list of everything anyone asked for.