# What Should Your Board Ask About an AI Agent Project?

> Board oversight of AI in growth companies: KPMG and INSEAD's five principles and the questions to ask before approving an AI agent project.

- Published: 2026-09-15
- Author: Master Mind
- Canonical: https://aimaster.fi/en/artikkelit/mita-hallituksen-pitaa-kysya-ai-agenttihankkeesta

In April 2026, KPMG and the INSEAD Corporate Governance Centre published five principles to guide boards on AI oversight. The need is real: growth company boards approve AI agent projects more often, but few know how to challenge them the way they would an investment or an acquisition. Board oversight of AI in growth companies isn't a technical deep dive — it's asking the right questions before signing off.

The problem shows up concretely at the board table. Management brings an AI agent proposal full of promised savings and efficiency gains. The board approves it, because no one wants to be the one "blocking innovation." Months later it turns out the agent handles customer data in ways nobody mapped, or that responsibility for its errors was never defined. The questions get asked in the wrong order — after the fact.

## Why does an AI agent belong on the board's agenda, not just the CTO's?

An AI agent makes autonomous decisions and operates inside business processes — that makes it a strategic risk and opportunity, not a technical detail. The board's job is to oversee long-term value creation and risk-taking, not write code. When an agent handles customer service, approves invoices, or negotiates contracts, its mistakes hit the balance sheet and reputation directly — the same level the board already oversees for other major decisions.

## What are KPMG and INSEAD's five principles for board AI oversight?

The framework KPMG and the INSEAD Corporate Governance Centre published in April 2026 groups board-level AI oversight into five principles. The framework is voluntary and sector-agnostic — it is not EU or Finnish legislation, but a practice boards choose to adopt.

- Strategic oversight for long-term value creation — AI projects get the same scrutiny as other major investments.
- Active technology and security oversight — the board tracks what data and systems agents can access.
- Workforce transformation and human accountability — who is accountable for an agent's actions, and how roles change.
- Building trustworthy AI — transparency, fairness, and traceability as approval criteria, not afterthoughts.
- The work of the board — updating skills, agenda, and reporting for the AI era.

## What questions should the board ask before approving an AI agent project?

The board should ask four things: what data the agent can access, who is accountable for its errors, how its behavior is monitored in production, and what the euro-denominated benefit is relative to the risk. If management can't answer these concretely, the project isn't ready for approval.

| Question area | What the board asks |
| --- | --- |
| Data and access rights | Which systems and data can the agent access, and who defined those boundaries? |
| Accountability for errors | Who is accountable when the agent makes a mistake — the vendor, IT, or the business owner? |
| Production monitoring | How is the agent's behavior tracked daily, and who can stop it if needed? |
| Euro-denominated benefit | What value does the project create in euros, and which process does it target? |
| Scalability | How does the project scale if the first agent works — or does it stay a one-off pilot? |

## How does a growth company put board oversight into practice in three steps?

A board cannot oversee what hasn't been mapped. The first step is [Master Plan](https://aimaster.fi/tuotteet/master-plan) — an AI strategy sprint that maps where AI creates the most value for your company, measured in euros. It gives the board a euro-based prioritization instead of approving projects based on impressions.

The second step is data. [Master Layer](https://aimaster.fi/tuotteet/master-layer) is a data foundation layer that connects a company's existing systems — CRM, ERP, documents — securely for AI use. This is where the board gets an answer to "what data can the agent access": access rights and boundaries are defined here, not after the fact.

The third step is the agent itself. [Master Mind](https://aimaster.fi/tuotteet/master-mind) is a set of AI agents that operates on Master Layer's data and runs business processes independently. Development proceeds in 3-day sprints, so the board sees results and risks quickly — not after months of planning. The same structure used to build the agent also produces the reporting a board needs: what the agent does, what it can access, and when it escalated a decision to a human. Defining [AI agent accountability in advance](https://aimaster.fi/artikkelit/kun-ai-agentti-tekee-virheen-kuka-vastaa-nain-kasvuyritys-maarittaa-tekoalyn-vir) belongs to this stage — not the moment after a mistake has already happened.

## What's the difference between board oversight and employee AI literacy?

Board oversight is about decisions and risk-taking — which projects get approved and under what conditions. Employee AI literacy is about day-to-day skills: how staff use AI tools safely and understand their limits. Both are needed, but they solve different problems. For more on what [AI literacy under AI Act Article 4](https://aimaster.fi/artikkelit/ai-lukutaito-on-pakollista-helmikuusta-2025-nain-kasvuyritys-tayttaa-ai-actin-ar) means in practice, we covered it in a separate article.

A growth company board that puts AI oversight on the agenda now isn't doing it for bureaucracy's sake. It's because an agent running unsupervised in production is a more expensive problem than an agent that never reaches production for lack of proper mapping.

## Frequently asked questions

### What does board oversight of AI mean in practice?

It means the board evaluates AI agent projects with the same rigor as other major investments: what data the agent can access, who is accountable for errors, and what the euro-denominated benefit is. It's not about technical implementation — it's about decisions and risk-taking.

### Does a small growth company need board-level AI oversight?

Yes, if the AI agent handles customer data or makes business decisions independently. The risk isn't tied to company size but to how much responsibility the agent is given. A smaller board can run a lighter process, but the questions stay the same.

### Who on the board is accountable for AI risk?

KPMG and INSEAD's principles recommend shared accountability across the whole board, not a single member. In practice, one board member often coordinates the topic and brings it to the agenda regularly, but approval and oversight remain a board-wide responsibility.

### How does Master Plan help the board make AI decisions?

Master Plan maps where AI creates the most value for your company, measured in euros. It gives the board a concrete prioritization and euro-based justification instead of approving projects based on impressions or hype.

### Are the KPMG and INSEAD principles mandatory in Finland?

No. Published in April 2026, the principles are a voluntary, sector-agnostic framework — not EU or Finnish legislation. A board can adopt them as practice independently of other legal obligations, such as AI Act requirements.