The Board Question About AI That Most CFOs Can't Yet Answer

Key Takeaways 

• Through 2026, boards, regulators and standard-setters moved from asking "what is AI doing for us?" to "what is AI costing us if it fails?" - and most CFOs in financial services do not yet have a repeatable way to answer in dollar terms. 

• Three specific exposure questions are now showing up at board and audit-committee level: AI vendor concentration, unbudgeted remediation cost if governance gaps are examined under new regulatory standards, and AI-driven litigation/compliance exposure. 

• Regulators are moving faster than finance functions. The US federal banking agencies' SR 26-2 explicitly asks for "exposure quantification," and APRA has told Australian banks, insurers and superannuation trustees that boards often lack the literacy to challenge AI risk claims - but neither has prescribed a methodology. 

• There is no accepted actuarial or accounting standard for AI risk exposure equivalent to how credit or market risk is reported. CFOs are being asked to produce a number for a category of risk the profession has not yet agreed how to measure. 

• sourceCode's position: a CFO should be able to proactively answer the three board-level AI exposure questions below - not scramble to build the methodology after a director asks the question in the room. 

Introduction 

For most of the last two years, AI has been a management story inside financial services boardrooms: use cases, productivity gains, pilots converted to production. Through 2026, the conversation shifted register. Directors stopped asking what AI could do and started asking what it could cost - in the same breath they ask about credit losses, market risk limits, or capital adequacy. 

That shift creates a specific problem for CFOs. Credit risk has decades of actuarial convention behind it. Market risk has Value-at-Risk. AI risk exposure has neither a standard, nor an actuary, nor an accepted unit of measure - yet boards are starting to ask for the number anyway. This piece sets out why that gap has opened, what the three exposure questions actually are, and a reporting structure finance functions can use to answer them before they are asked. 

Why the Board Conversation Changed in 2026 

The acceleration is traceable to a specific run of regulatory and standard-setter activity rather than general anxiety. Between May and September 2026, AI concentration risk moved from analyst commentary to formal warning from the IMF, the European Systemic Risk Board, the Joint Committee of the European Supervisory Authorities, the Financial Stability Board and Moody's (Cloud Security Alliance, 2026). In August 2026, Financial Stability Board Chair Andrew Bailey wrote to G20 finance ministers warning that frontier AI "may have the ability materially to alter the speed, scale and economics of cyber risk" (cited in Cloud Security Alliance, 2026). The European Central Bank has directed significant institutions to submit action plans on frontier AI cyber risk by 31 October 2026 - ten days after this piece is published. 

This followed the Financial Stability Board's earlier foundational assessment, which named third-party dependency and provider concentration among AI services as a vulnerability capable of amplifying systemic risk across the financial sector (Financial Stability Board, 2024). 

Closer to home, the Australian Prudential Regulation Authority told APRA-regulated banks, insurers and superannuation trustees in April 2026 that many boards "lack the technical literacy to effectively challenge management on AI risks," and flagged that some entities are "heavily dependent on a single provider for multiple AI use cases" with gaps in their contingency planning (APRA, 2026). That is a regulator describing, almost verbatim, the vendor concentration question boards are now asking CFOs to quantify. 

On the US banking side, the Federal Reserve's SR 26-2 - issued jointly with OCC Bulletin 2026-13 and FDIC FIL-15-2026 on 17 April 2026, replacing the SR 11-7 model risk framework that had stood since 2011 - moves to a materiality-based approach and explicitly expects "defensible model tiering, exposure quantification, and credible vendor oversight" from regulated banks (CRA, 2026). The word "quantification" is doing real work here: for the first time, a prudential regulator is asking for a number, not just a governance narrative. 

The Three Exposure Questions Boards Are Now Asking 

Reviewing EY's board briefing for CFOs, the fourth and sharpest of four questions EY says boards are now putting to finance leaders is simply: "what are the financial impacts of AI-related risks?" (EY, 2026). In practice, across the APAC and Gulf BFSI conversations we are party to, that question is splitting into three distinct lines of board inquiry. 

1. Vendor concentration exposure. How much revenue-generating process, decisioning or customer-facing capability sits behind a single AI vendor or foundation model with no tested failover? This is the exposure APRA flagged directly, and it is the subject of the vendor-concentration framework we published earlier this quarter (Read more about the AI vendor-concentration risk - "Three Tests" framework). What has changed since that piece is that the question is no longer theoretical: it is now explicitly named by APRA, the FSB and the IMF as a board-level financial stability concern, not just an operational risk note.
2. Unbudgeted remediation exposure. If a supervisor examines current AI governance against a materiality-based standard like SR 26-2, what would a consent order, lookback review and remediation programme cost - and is that cost currently in any budget? Cognizant's assessment of the US banking sector found that building AI-speed governance capability costs three to four times a bank's current oversight budget, for institutions ranging from roughly US30billiontoUS200 billion in assets - but notes that figure is still smaller than the cost of a single serious enforcement action (Cognizant, 2026). The same analysis flags that SR 26-2 explicitly excludes generative and agentic AI systems from its scope for now, leaving a live gap between what is regulated and what is actually deployed - and governance of that gap takes twelve to eighteen months to build, which means it cannot be assembled retroactively once an examiner is in the building (Cognizant, 2026). That gap is precisely where the exit-plan weaknesses we documented in September become a cost line rather than an operational footnote (Explore more about the AI vendor exit-plan gaps - "Exit Anatomy" / Seven-Part Exit Anatomy framework).
3. Litigation and compliance exposure. What is the modelled range of loss from AI-driven claims decisions, underwriting outputs or credit decisions that end up contested, and does current insurance actually respond? US generative AI-related litigation grew 978% between 2021 and 2025, according to a joint Gallagher Re, MIT and Testudo analysis of standard insurance coverage for AI risk (Gallagher Re, MIT and Testudo, 2026). That analysis, and separate industry reporting on new exclusionary endorsements filed by Verisk's ISO and by several major carriers from 1 January 2026, both point to the same conclusion: general liability and E&O markets were not built to price AI-specific harm, and several insurers are now moving to exclude it rather than price it (Insurance Intel, 2026). Lockton Re is quoted making the point bluntly: "CGL insurers do not currently model, underwrite, or price AI risks" (cited in Insurance Intel, 2026). This is the exposure line our litigation-focused piece from early October examined in detail (Read more about theAI claims-litigation exposure - "The Override Docket" framework).

Why No Standard Methodology Exists Yet 

The honest answer is that CFOs are not failing to produce this number because they are unprepared - they are failing because no one has yet agreed how it should be calculated. Credit risk reporting rests on decades of loss-given-default and probability-of-default convention, overseen by actuarial and accounting standards bodies. AI risk exposure reporting has none of that scaffolding. PwC's 2026 Annual Corporate Directors Survey of roughly 600 US public company directors, as reported by Corporate Compliance Insights, found that 66% of directors rate the quality of management-provided metrics linking AI outcomes, risks and business performance as fair or poor, and 60% say AI oversight is not yet meaningfully built into the board's work (Gaskin, 2026). Deloitte's Q2 2026 CFO Signals survey of 200 North American CFOs at organisations with at least US$1 billion in revenue found 51% cite a lack of governance authority as their top AI obstacle, 43% cite insufficient visibility into which AI tools are even in use, and 46% cite cost uncertainty as their leading internal AI concern (Deloitte, 2026). Those are not the answers of a profession withholding a known number - they are the answers of a profession that has not yet been handed the measurement standard to produce one. 

Introducing the Board Exposure Brief 

If no regulator or standards body has prescribed a methodology, the pragmatic path is to build a reporting structure that is honest about its own limitations rather than wait for one to arrive. We call this structure the Board Exposure Brief: a single page, reviewed each board cycle, with three distinct exposure lines, each carrying its own method note and confidence band rather than a single blended number. 

Line 1 - Concentration Exposure. The dollar-weighted estimate of revenue-generating processes, decisions or customer-facing capability dependent on a single AI vendor or foundation model with no tested failover. The input data for this line is the vendor-dependency mapping work we set out in our earlier piece on AI vendor-concentration risk, cross-checked against whether an exit plan for that vendor has actually been tested rather than just documented. 

Line 2 - Remediation Exposure. The estimated unbudgeted cost of a remediation programme - lookback review, consent order, re-platforming - if current AI governance were examined today against a materiality-based standard such as SR 26-2. Cognizant's three-to-four-times oversight-budget benchmark (Cognizant, 2026) is a reasonable starting multiplier for this line until an institution has its own control-maturity assessment to work from. 

Line 3 - Litigation-Compliance Exposure. The modelled range of loss from AI-driven claims, underwriting or credit decisions that end up contested, informed by the institution's own override and contest-rate pattern rather than industry averages alone, and checked against what current E&O and general liability coverage will actually pay for AI-specific harm. 

Each line is reported with a stated method, a confidence band (high/medium/low), and an agreed escalation trigger - the threshold at which the line moves from a standing board paper item to an active agenda discussion. The point of the Brief is not false precision; it is that the board sees the same three questions, answered the same documented way, every cycle - so a director's question is met with an existing answer rather than a scramble. 

The Counterargument: Is It Too Early to Force a Dollar Figure? 

A reasonable objection deserves airtime here, because it is a genuine tension rather than a straw man. None of the regulatory activity above actually mandates a single dollar figure for AI risk exposure. APRA's letter asks for literacy and contingency planning, not a specific loss number. SR 26-2 asks for "exposure quantification" as a discipline, not a prescribed formula. Forcing a single headline number into a board pack before the underlying data, model inventories and loss-history baselines exist risks manufacturing false precision - a confident-looking figure built on soft, unaudited inputs that gives directors more comfort than the underlying governance actually earns. 

There is also a Goodhart's Law risk: once a number becomes the thing being managed, finance and risk teams may optimise the inputs that make the number look better rather than the controls that make the exposure smaller. The more defensible position, and the one this piece ultimately lands on, is not that every CFO should publish a single AI risk figure this quarter, but that every CFO should be able to show the board a transparent, documented basis for each of the three exposure lines - including where confidence is low and why - rather than offering no structured answer at all. A documented range with clearly stated assumptions and confidence bands is a materially better board answer than either a false-precision number or a shrug. 

What This Means for the Buying Committee 

For the CFO and CRO jointly, the near-term task is not building a perfect actuarial model - none exists yet - but building a reporting structure that can survive a board question asked without warning. 

For the Chief Risk Officer and Chief Compliance Officer, the SR 26-2 and APRA signals both suggest supervisors will increasingly test whether vendor contingency planning and model tiering are real artefacts or slideware. 

For the CIO/CTO, the vendor concentration line cannot be answered without an accurate, current inventory of which revenue processes sit behind which AI vendor or model - information that in most organisations we have worked inside of currently lives across procurement, engineering and shadow deployments rather than in one place. 

For the Board Risk Committee, the practical ask is to decide, in advance, what confidence band and what escalation trigger on each exposure line should prompt a conversation - rather than discovering the threshold during a live incident. 

The sourceCode’s Perspective 

Having sat inside BFSI technology and risk functions across Australia, Malaysia and Vietnam for the better part of two decades, under an insourcing and ODC delivery model, our view is that the gap between "we have an AI governance committee" and "we can show the board a defensible exposure number" is almost always a data architecture problem before it is a modelling problem.  

Most of the institutions we have worked alongside can describe their AI governance process fluently in a board pack narrative. Far fewer can answer, within the hour, which specific revenue-bearing workflows depend on a single AI vendor with no tested fallback, what a remediation programme against a materiality-based standard would actually cost given their current control maturity, or what their existing claims and compliance litigation pattern already implies about future exposure.  

That is not a reason to panic-build a perfect model. It is a reason to start building the three underlying inventories - vendor dependency mapping, control-maturity-to-remediation-cost benchmarking, and litigation/compliance pattern tracking - now, so that when a director asks the question, the answer is a documented range with stated assumptions rather than a promise to come back next quarter.  

We do not have a published client case study to cite on this specific exposure-reporting exercise, and we want to be direct about that rather than imply one. Contact us here for further discussion! 

Conclusion 

The board question about AI that most CFOs cannot yet answer is not really "is our AI safe?" It is "what does it cost us if it is not, and can you show me the number?" Regulators across Australia, the US, the UK and the EU moved through 2026 toward demanding exposure quantification as a discipline, without yet prescribing how to do it.  

That gap between expectation and method is exactly where a CFO can get ahead of the next board cycle rather than behind it - by building a documented, three-line answer to vendor concentration, remediation and litigation/compliance exposure before the question arrives unannounced. 

If you want to walk through how your organisation's current AI risk reporting would hold up against these three board-level questions, that is a conversation worth having before the next board cycle, not after it. 

FAQ 

Is there an accepted industry-standard methodology for quantifying AI risk exposure in dollar terms? Not yet. Regulators including the US federal banking agencies (via SR 26-2) and APRA are asking institutions to build "exposure quantification" capability, but none have prescribed a specific formula or disclosure standard, unlike credit or market risk. 

Why are boards suddenly asking CFOs about AI vendor concentration specifically? Because regulators named it directly as a systemic concern in 2026 - APRA flagged entities "heavily dependent on a single provider for multiple AI use cases" with weak contingency planning, and the IMF, FSB, ESRB and Moody's issued related warnings between May and September 2026. 

Does cyber or E&O insurance already cover AI-related litigation exposure? Generally not reliably. Several major carriers filed AI-specific exclusions from standard general liability and professional indemnity forms effective 1 January 2026, and industry analysis describes a persistent gap between how AI harms arise and how existing policies are underwritten. 

What is the single biggest obstacle CFOs report in managing AI risk right now? In Deloitte's Q2 2026 CFO Signals survey, the leading obstacle cited was balancing the speed of AI deployment against risk management, followed closely by a lack of governance authority and insufficient visibility into which AI tools are actually in use. 

Should a CFO publish a single AI risk exposure number to the board this quarter? Not necessarily a single figure. Given the immaturity of methodology, a documented range per exposure category - with stated assumptions, data sources and confidence bands - is more defensible than a single false-precision number. 

Reference List 

APRA (2026) APRA calls for a step-change in AI-related risk management and governance. Australian Prudential Regulation Authority, 30 April. Available at: https://www.apra.gov.au/news-and-publications/apra-calls-step-change-ai-related-risk-management-and-governance 

Cloud Security Alliance (2026) AI Concentration Risk Moves From Theory to Institutional Warning. CSA AI Safety Initiative research note, 27 September. 

Cognizant (2026) The AI Governance Gap: The Compliance Risk Banks Are Underpricing. Cognizant Fintech AI Summit. 

CRA (Charles River Associates) (2026) Model Risk Management Guidance: SR 26-2 in the Era of AI. CRA Insights, July. 

Deloitte (2026) CFO Signals: Q2 2026. Deloitte, 23 July. 

EY (2026) Four Questions Boards Are Asking CFOs About AI Governance. EY Center for Executive Leadership. 

Financial Stability Board (2024) Financial Stability Board Report on Financial Stability Implications of Artificial Intelligence. Financial Stability Board, 14 November. 

Gallagher Re, MIT and Testudo (2026) Smart Systems, Blind Spots: Rethinking Insurance for the AI Era. Gallagher Re, 24 March. 

Gaskin, J.L. (2026) 'Boards Say They Need More From Management on AI', Corporate Compliance Insights, 23 September. 

Insurance Intel (2026) 'Chubb is excluding the risk its own underwriters wrote', P&C Insurance Executive Intelligence (Insurance Intel), 1 April.