A board can approve an AI strategy without approving a single useful change. A presentation lists tools, a budget is allocated, and the chief executive promises efficiency. Six months later, the board receives adoption figures but cannot tell whether customers are better served or the company is taking risks it never intended to accept.
My starting point for a Norwegian AS is a narrower question: what decision is management asking the board to make? Buying assistance for employees, redesigning a core service and delegating authority to software are different propositions. They should not disappear into one technology programme.
The board should approve a mandate it can revisit
The Norwegian Companies Act, sections 6-12 and 6-13 places management of the company and supervision of its daily management with the board. Section 6-14 distinguishes the chief executive's day-to-day management. The allocation matters even when a small company's owner, chair and chief executive know each other well: technical enthusiasm does not settle which role is making a decision.
I would ask management to replace a long tool inventory with a short mandate. It should name the business outcome, the initial operating boundary, the executive responsible and the conditions that require renewed approval. The board need not select prompts or review every configuration. It needs enough information to understand what it is authorising and whether management can control it.
A six-part paper for the next meeting
- The problem: Which customer, quality, capacity or security problem are we addressing? Show the current situation, including the cost of leaving it unresolved.
- The chosen change: Describe one workflow before and after AI. Identify the decisions that remain with people and the systems the AI may access.
- The alternatives: Compare the proposal with process simplification, conventional software, additional capacity and a bounded experiment. Explain why AI is the preferred route.
- The exposure: Identify affected people, sensitive information, contractual commitments, operational dependencies and credible failure consequences. Name the unresolved questions.
- The evidence: State what management must demonstrate before expansion. Include service quality, total operating cost, exceptions and the time spent reviewing outputs.
- The mandate: Set the budget, owner, review date and escalation triggers. Separate permission to learn from permission to operate at scale.
This is my proposed working format, not a statutory template. A large regulated business will need additional controls; a small AS can often make the essential decisions explicit without creating a new committee.
Make the unresolved issue visible
Consider a hypothetical Norwegian engineering company proposing an assistant for tender preparation. The attractive outcome is faster, more complete bids. The unresolved issue is whether confidential customer drawings may enter the selected service. A general statement that the supplier is secure does not resolve that question.
The board could authorise a limited evaluation using approved material, while requiring management to resolve data use, contractual restrictions and access before connecting customer files. That decision buys evidence without silently approving the disputed processing. A calendar deadline alone should not turn the evaluation into production.
I would also ask what information directors themselves may place in AI tools. Board packs can contain acquisitions, personnel matters and commercially sensitive forecasts. The company should establish a specific approved process before directors upload those documents through personal accounts.
Ask for evidence of a changed business
At the review meeting, start with the promised outcome and the exceptions. A high number of active users may accompany useful adoption, but it does not establish reliable delivery. Ask for one completed case, one case the system escalated, and one failure that changed the design.
If the next decision concerns financial scale, use the investment and cost-of-waiting analysis. If it expands what agents can do, revisit the autonomy boundaries. The board's approval should remain understandable after the original presentation has been forgotten.
Sources and scope
Sources checked on 11 October 2026. This article concerns Norwegian private limited companies; other organisational forms and regulated sectors may have different or additional requirements. The board-paper format, example and recommendations are my analysis. The engineering company is hypothetical.