Board-Ready AI Assurance Checklist

How to use this checklist

When: Use before approving a new AI use case, enabling AI features in a supplier product, rolling out general-purpose AI assistants, or reporting AI progress to the board.
Who: The executive AI sponsor should own the completion of this checklist.
How: Complete it collaboratively with colleagues across IT, data protection, information governance, procurement, service delivery, and tenant voice teams.

Board assurance summary — six questions for every AI use case

What AI is being used, by whom and for what housing purpose?

Who is accountable for the use case and its risks?

What tenant, staff, data, cyber, supplier and equality risks have been assessed?

What human oversight exists, and can a person challenge or override AI-supported outputs?

What evidence shows the tool is accurate enough, fair enough and useful enough for the intended context?

What will be reported back to the board, and how often?

RAG rating guide

Rating	Meaning	Board response
🟢 Green	Evidence is clear, proportionate and current.	Proceed, monitor and review at agreed intervals.
🟡 Amber	Some evidence exists, but gaps remain.	Proceed only with conditions, owners and dates.
🔴 Red	Evidence is missing or risk is not understood.	Do not approve rollout. Require action before proceeding.

Ten governance areas

1. Ownership and Governance

Board question: Who is accountable for AI use across the organisation?

There is a named executive owner for AI governance.

There is a named business owner for each AI use case.

AI risk is recorded in the enterprise risk register or equivalent governance route.

The board or Audit and Risk Committee has agreed how AI assurance will be reported.

Existing policies have been reviewed for AI impact — including data protection, cyber security, acceptable use, procurement, records management, equality, complaints and safeguarding.

The organisation has defined safe, restricted and prohibited AI uses.

The governance route covers general-purpose assistants, supplier AI and bespoke AI.

Red flags:

AI is described as "an IT issue" only.
No one can list current AI use.
A policy exists but there is no monitoring, ownership or reporting.

2. AI Inventory and Use-Case Register

Board question: Do we know where AI is already being used or proposed?

The organisation has an AI inventory or use-case register.

The register includes general-purpose AI tools, Microsoft Copilot or equivalent assistants, supplier AI features and local experiments.

Each entry has a clear purpose, owner, affected service area, data category and risk rating.

Shadow AI risks have been considered, including informal staff use of public tools.

Proposed use cases are assessed before procurement, pilot or rollout.

3. Housing Purpose, Tenant Benefit and Value

Board question: What housing problem does this use of AI solve?

The use case starts with a clear housing problem, not a tool.

Expected benefits are stated for residents, staff, homes or organisational resilience.

The use case has measurable success criteria.

The benefits case includes quality, safety, trust and fairness — not only efficiency.

There is a plan to stop, redesign or roll back the use case if benefits are not shown.

4. Tenant Trust, Fairness and Transparency

Board question: How will tenants know when AI is used, and how will fairness be protected?

The organisation has assessed potential effects on tenants, including vulnerable residents and digitally excluded groups.

Equality, bias and discrimination risks have been considered.

There is a plain-English explanation of when and how AI is used.

Residents have a clear route to ask questions, challenge decisions or request human review where appropriate.

The organisation can explain how human accountability remains visible.

5. Data Quality, Records and Knowledge Management

Board question: Is the underlying information good enough for this use?

The use case identifies the data sources it relies on.

Data quality, completeness, timeliness and relevance have been checked.

Known data gaps or record-keeping weaknesses are documented.

Records created or summarised by AI are stored, checked and retained appropriately.

6. Data Protection, Privacy and Automated Decision-Making

Board question: Are personal data and individual rights protected?

The lawful basis for processing personal data has been identified where needed.

A Data Protection Impact Assessment (DPIA) has been completed or a documented decision explains why one is not required.

Special category data and sensitive tenant information have extra controls.

Any automated decision-making or profiling risk has been assessed with up-to-date ICO guidance.

7. Cyber Security and Supplier Assurance

Board question: Can we trust the systems and suppliers involved?

Cyber security risk has been assessed for the AI tool or supplier feature.

Supplier due diligence covers security, data handling, subcontractors and model dependencies.

The contract covers data use, retention, audit rights, incident reporting and termination.

There is a rollback or disablement route if the AI feature causes harm or performs poorly.

8. Human Oversight, Accuracy and Testing

Board question: How do we know the AI is reliable enough for this context?

The AI has been tested against realistic housing scenarios.

Accuracy, error rates and failure modes have been assessed.

Human oversight is meaningful: reviewers have the training, authority and time to challenge outputs.

Outputs are monitored after rollout, not only during pilot.

9. Staff Capability, Culture and Safe Use

Board question: Do staff know how to use AI safely and when not to use it?

Staff have clear guidance on safe and unsafe AI use.

Training covers data protection, confidentiality, bias, hallucination, verification and escalation.

Staff can report concerns, errors or near misses without blame.

10. Board Reporting, Incidents and Continuous Assurance

Board question: What will the board see, and how will it know when to intervene?

The board receives a regular AI and data governance update.

The report covers use cases, benefits, risks, incidents, resident impact and supplier changes.

AI incidents, complaints and near misses are logged and escalated.

The board has agreed thresholds for pausing, escalating or stopping AI use.

Quick red-flag test — pause or escalate if any of these are true:

The organisation cannot list current AI uses.
The use case affects residents but has no tenant impact assessment.
Personal data is used without a DPIA or documented screening.
A supplier AI feature is enabled without cyber, data and contract review.
Human oversight is claimed but not designed.
Benefits are asserted without a baseline or measurement plan.
No rollback or stop route exists.

HAILIE position

Start with housing problems, not AI tools.
Govern by use case, risk, and data sensitivity.
Keep human accountability visible.
Share what works, so the sector does not solve the same problem many times in isolation.