Ghana has a national AI strategy. Does your board have an AI position?

Meanwhile, something more immediate has already happened inside your organisation. Your staff are using AI. Not because a committee approved it, but because it is free, it is in the browser, and it makes their work faster. Somebody in finance has pasted a management account into a chatbot to summarise it. Somebody in HR has drafted a dismissal letter with one. Somebody in credit has asked one to explain a customer's file.

None of those people did anything they understood to be wrong. Most boards have no idea it is happening.

That gap, between national ambition and unmanaged daily use, is where board attention belongs this year.

The instinct is to begin with strategy. Resist it. A board cannot govern an AI strategy while it is unaware of the AI already in the building.

The first action is an inventory, and it is not a technical exercise. Ask management three things. Which approved tools with AI features are we paying for, and what are they permitted to do with our data. Which unapproved tools are staff using, established by asking rather than by monitoring. And which decisions affecting customers or employees are now being influenced by a model, even partially.

That third one is the important one. An organisation can live with staff drafting emails faster. It cannot live with a credit decision, a pricing decision or a dismissal being shaped by a system nobody can explain, in a market where explanation is exactly what a regulator or a court will ask for.

You do not need to understand how a model works to make these.

What may leave the building. Customer data, employee data, financial information, board papers. Once information is pasted into a public tool it is gone in the sense that matters. This is a data protection question before it is an AI question, and Ghana's Data Protection Act does not make an exception for convenience.

Where a human must decide. Name the decisions that a person signs, whatever a system recommends. Credit, pricing, hiring, dismissal, anything with a regulatory consequence. Write the list down. It is short, and it is the single most useful artefact a board can produce on this subject.

Who owns it. One executive, named, accountable for AI use across the organisation. Not the IT director by default, because most of this is not an IT problem. It is a risk and conduct problem with a technology component.

What the board will see. Something, quarterly. What is in use, what changed, what went wrong. A board that receives nothing on AI will receive its first report in the form of an incident.

For institutions supervised by the Bank of Ghana, this is not only good practice. The Cyber and Information Security Directive reaches AI systems used in regulated operations, and it already requires board level cyber expertise, board approved policy, and quarterly reporting on incidents and indicators. If AI is influencing operations at your institution and nothing about it reaches your board, that position is difficult to defend.

The national strategy will bring further guidance over time. Institutions that already have an inventory, a named owner and a human decision list will absorb it easily. Those starting from nothing will do so under time pressure.

Do not write an AI policy first. Policies written before the inventory describe an organisation that does not exist, and staff route around them within a month.

Do not ban it. Bans move usage from tools you can see to personal phones you cannot. The risk does not fall, your visibility does.

Do not wait for the strategy to become regulation. The exposure sitting in your organisation today comes from data leaving the building and from unexplainable decisions. Neither requires new legislation to hurt you.

Twenty minutes at the next board meeting. Management presents the inventory. The board agrees the list of decisions a human must sign. One executive is named as owner. A quarterly report is scheduled.

That is a complete first step, it requires no technical expertise from the board, and it puts your organisation ahead of most of the market. The strategy work can follow once you know what you are governing.

The Board Technology Oversight Checklist includes the AI and data questions in this article alongside twenty two others, with a scoring guide. Free, and about fifteen minutes.