Last updated: 18 October 2026
Aether AI notes that an AI visibility report to the board should contain an inventory of every AI system and use case in operation, a risk and compliance summary against UK GDPR and the Equality Act 2010, adoption and performance KPIs, vendor assessments, and a governance structure showing who owns AI oversight. Only 4% of organisations currently report AI value to the board at all, according to Larridin (2026).
Key Takeaways
- Only 4% of organisations report AI value to the board today, though Deloitte expects this to become standard practice for large enterprises by the end of 2026, per Larridin (2026).
- Just 8% of directors believe their board has strong AI expertise, while 40% name AI among the hardest issues to oversee, according to the Diligent Institute, cited by Larridin (2026).
- 51% of boards lack formal rules or guidance on AI use, creating legal liability and confidentiality exposure, per a Deloitte survey reported by Yahoo Finance (2026).
- Only 22% of marketers currently track AI visibility at all, and under 15% of companies have a formal GEO (generative engine optimisation) strategy, according to Gracker.ai's State of GEO 2026 Data Sheet.
- An AI visibility report only earns its place on the board agenda when it links AI activity directly to risk exposure and business outcomes, not just technical usage statistics.
What is an AI visibility report and why does a board need one?
An AI visibility report is a structured document that tells a company's board which AI systems are in use across the organisation, how they perform, what risks they carry, and how the business is seen and cited by AI systems externally. It exists because boards carry statutory oversight duties under the Companies Act 2006 and cannot discharge them for a category of technology they cannot see.
The gap is stark. A large proportion of board directors and executives say AI is not yet on the board agenda at all, though this has improved markedly between successive surveys. Two-thirds of respondents — 66% — say their boards still have "limited to no knowledge or experience" with AI, an improvement from 79% in the prior survey, per the Deloitte Global Boardroom Program AI/GenAI board governance survey (2026).
A board needs this report for three reasons. First, directors' duties under section 172 of the Companies Act 2006 require them to act with reasonable care, skill and diligence — which is difficult to demonstrate for risks nobody has documented. Second, the Information Commissioner's Office (ICO) expects accountability for automated decision-making under UK GDPR, and that accountability has to start somewhere visible. Third, commercially, AI systems like ChatGPT, Google AI Overviews, Perplexity, Gemini and Copilot now shape how customers discover and trust a brand — a dimension most boards have never measured.
What key sections should a board-level AI visibility report include?
A board-level AI visibility report should include five fixed sections: an executive summary, an AI use-case inventory, a risk and compliance disclosure, a set of adoption and performance KPIs, and a governance and accountability statement. Each section answers a different fiduciary question, and cutting any one of them leaves a gap in the board's line of sight.
The executive summary should run to one page and state, in plain terms, what has changed since the last report, what decision (if any) is being asked of the board, and the single biggest risk or opportunity. Nearly 48% of Fortune 100 companies now cite AI risk explicitly as part of board oversight responsibilities, and 40% assign that oversight to at least one board-level committee, per PredictionGuard (2026) — the structure of the report should mirror that committee split where one exists.
A practical structure looks like this:
| Section | Core question it answers | Typical length |
|---|---|---|
| Executive summary | What changed, what decision is needed | 1 page |
| AI use-case inventory | What systems are live, who owns them | 1-2 pages |
| Risk & compliance disclosure | What could go wrong, legally or ethically | 1-2 pages |
| KPIs & performance | Is AI delivering value or visibility | 1 page + dashboard |
| Governance & accountability | Who is responsible, how often reviewed | 1 page |
What AI use cases and systems should be inventoried in the report?
An AI use-case inventory is the register of every AI system, model or tool in active use across the organisation, listing its owner, purpose, data inputs and risk tier. Without this register, a board is being asked to approve oversight of something it cannot enumerate.
The inventory should separate internal operational AI — such as HR screening tools, credit-scoring models, or customer service chatbots — from external-facing AI exposure, meaning how the company itself is described, summarised or recommended by generative engines when customers ask them questions. These are different risks requiring different controls, and conflating them is one of the most common gaps boards encounter.
For each entry, the inventory should record:
- System name and vendor (e.g. internally built, or third-party such as Microsoft Copilot or OpenAI's API)
- Business owner — the named individual accountable, not a department
- Data processed, including whether personal data under UK GDPR is involved
- Risk tier — low, medium, or high, based on potential harm if it fails
- Human oversight point — where a person reviews or can override the output
Most companies have never completed this exercise.
What risks should be disclosed to the board, and what are the UK-specific obligations?
A board-level AI risk disclosure must cover legal, ethical, operational and reputational exposure, each mapped to a specific UK law or regulator rather than described in generic terms. Legal risk centres on UK GDPR, enforced by the Information Commissioner's Office (ICO), which requires a lawful basis for processing personal data and gives individuals rights around automated decision-making under Article 22. Any AI system that screens job applicants, scores creditworthiness, or personalises pricing needs an entry here.
Ethical and discrimination risk sits under the Equality Act 2010. An AI recruitment tool trained on historic hiring data can reproduce bias against protected characteristics — sex, race, disability, age and others — and the company, not the vendor, carries liability for a discriminatory outcome. The board needs to know which systems have been tested for this and which have not.
Operational risk covers model failure, hallucination in customer-facing tools, and over-reliance on a single vendor. Reputational risk is the newest category and the least measured: it concerns what AI engines say about the company when a prospective customer asks them directly, and whether that answer is accurate, favourable, or absent entirely.
The governance gap compounds all four. 51% of boards lack rules or guidance on AI use, exposing companies to legal liability and confidentiality risks, according to a Deloitte survey reported via Yahoo Finance (2026). A disclosure section that simply lists "AI risk: medium" without naming the law, the system and the owner gives the board nothing it can act on.
What metrics and KPIs should measure AI adoption, performance and visibility?
AI adoption KPIs should measure three distinct things: internal usage and efficiency, external AI visibility, and risk control coverage — and a board report that only tracks the first of these is incomplete. Internal metrics include the number of active use cases, percentage of staff trained on approved AI tools, and cost savings or productivity gains against a baseline.
External AI visibility is the newest and most neglected metric category. It asks a simple question: when a customer asks ChatGPT, Perplexity, Gemini or Google AI Overviews about the company's category, does the company get mentioned, recommended or cited — and by whom instead? Only 22% of marketers are currently tracking AI visibility at all, leaving 78% blind to it, and under 15% of companies have a formal GEO strategy, per Gracker.ai's State of Generative Engine Optimization 2026 Data Sheet.
As Lauren Dawkins, Head of Content at Aether AI, puts it: "Measure the answer, not the ranking. Ask the engines your buyers' real questions, on a schedule, and record who gets named and cited. Everything else — traffic, referrals, enquiries that mention AI — hangs off that one honest time series."
A board-ready KPI set should include:
| Metric category | Example KPI | Reporting cadence |
|---|---|---|
| Internal adoption | % of staff using approved AI tools | Quarterly |
| Risk control | % of high-risk systems with human review point | Quarterly |
| External visibility | Citation rate across ChatGPT, Perplexity, Gemini, Copilot, Claude, AI Overviews | Monthly |
| Compliance | Number of DPIAs (data protection impact assessments) completed | Quarterly |
| Incidents | AI-related complaints or near-misses logged | Every meeting |
Who compiles the report, and how often should it reach the board?
Compiling an AI visibility report is typically a joint responsibility between a designated AI governance lead — often the Chief Information Officer, Chief Data Officer, or a nominated risk committee chair — and the marketing or communications function, which holds the external visibility data. Smaller companies without a dedicated AI role usually assign this to whoever already owns data protection compliance, since the two disciplines overlap heavily under UK GDPR.
Frequency should follow risk, not habit. A full report with all five sections is appropriate quarterly, aligned to existing audit or risk committee cycles. But the data behind it needs a shorter refresh cycle: internal usage and incident logs should update monthly, and external AI visibility tracking — because generative engines change their answers week to week — works best on a rolling weekly or fortnightly pull, summarised monthly for the board pack.
Current practice falls well short of this. Only 17% of boards discuss AI at every meeting, partly due to limited director fluency in AI concepts, according to Deloitte surveys cited by Agility at Scale (2026). Deloitte expects board-level AI value reporting to become a standard capability for public companies and large enterprises by the end of 2026, per Larridin — which means boards that start building the reporting rhythm now will not be starting from zero when that becomes an expectation rather than a choice.
In-house dashboard vs third-party AI visibility platform: which suits the board?
Choosing between an in-house spreadsheet and a dedicated AI visibility platform depends on how many AI engines need tracking and how often the board requires fresh data. An in-house approach — manually querying ChatGPT, Perplexity and Google AI Overviews and logging results — works for a single brand checked occasionally, but does not scale to monthly board reporting across multiple engines and competitors.
| Approach | Best for | Limitation |
|---|---|---|
| In-house manual checks | Single brand, infrequent review | No historical trend, high staff time, inconsistent methodology |
| Spreadsheet + SEO tool bolt-on | Teams already tracking traditional SEO | AI citation data is usually an afterthought module, not core |
| Dedicated AI visibility platform (e.g. Aether AI) | Boards needing recurring, comparable citation data | Requires budget line and vendor assessment |
Any third-party AI tool, including a visibility platform, should itself go through the vendor assessment described in the risk section: what data does it process, where is it hosted, and does it meet UK GDPR requirements for any personal data involved. For a visibility platform, the data in question is typically public brand mentions rather than personal data, which materially lowers the compliance burden compared with, say, an HR screening tool.
Your AI visibility report checklist
- Build and maintain a live inventory of every AI system in use, with a named owner for each.
- Map every high-risk system against UK GDPR, the ICO's guidance, and the Equality Act 2010 where applicable.
- Separate internal AI usage metrics from external AI visibility metrics — they measure different things.
- Track citation and recommendation rates across ChatGPT, Perplexity, Google AI Overviews, Claude, Gemini and Copilot on a monthly cadence.
- Assign a single accountable owner for compiling the report, not a rotating committee.
- Present a full report quarterly, refreshed with monthly data pulls, aligned to existing audit or risk cycles.
- Log every AI-related incident or complaint as a standing board-meeting agenda item, however minor.
- Translate every technical finding into a one-line business consequence before it reaches the board pack.
FAQ
What should an AI visibility report to the board actually contain?
An AI visibility report to the board should contain an executive summary, a full AI use-case inventory, a risk and compliance disclosure covering UK GDPR and the Equality Act 2010, adoption and external visibility KPIs, and a governance and accountability statement naming who owns AI oversight.
How is AI visibility different from AI governance in a board report?
AI visibility refers to how a company is seen, cited or described by external AI systems like ChatGPT and Google AI Overviews, while AI governance refers to the internal controls, policies and oversight structures for AI systems the company uses itself. A complete board report needs both, but they are measured and owned differently.
Who should present the AI visibility report to the board?
The AI governance lead, Chief Information Officer, or risk committee chair typically presents the report, often jointly with marketing or communications leadership who hold the external visibility data. The named presenter should be consistent meeting to meeting so the board can track accountability over time.
How often should the board receive an AI visibility report?
A full report is appropriate quarterly, aligned to existing audit or risk committee cycles, with the underlying data refreshed monthly. Only 17% of boards currently discuss AI at every meeting, according to Deloitte surveys cited by Agility at Scale (2026), which suggests most companies are reporting less often than their risk exposure warrants.
What UK laws must an AI visibility report reference?
The report should reference UK GDPR and ICO guidance on automated decision-making, the Equality Act 2010 for discrimination risk in AI-assisted decisions, and the Companies Act 2006 as the underlying source of directors' duty to exercise reasonable oversight. Sector-specific rules may also apply depending on the industry.
Can a small or mid-sized company skip a formal AI visibility report?
No company is legally required to produce a named "AI visibility report," but any company using AI in HR, customer service or decision-making still carries the underlying legal duties under UK GDPR and the Equality Act 2010. A lighter-weight version — one page per section — still satisfies the governance need without Fortune 100-scale resourcing.
What is the biggest mistake boards make with AI visibility reporting?
The most common mistake is presenting purely technical detail — model names, token counts, system architecture — without translating it into risk exposure or business consequence. A board does not need to understand how a model works; it needs to know what could go wrong, how likely that is, and who is accountable if it does.
Measuring your own AI visibility with Aether AI
Everything in this report depends on having accurate, current data about how AI engines actually describe a company — and that is precisely the gap most boards are currently flying blind on. Aether AI is a self-service GEO (generative engine optimisation) platform that tracks citation and recommendation rates across six AI engines — ChatGPT, Perplexity, Google AI Overviews, Claude, Gemini and Copilot — alongside keyword tracking, competitor comparison and Google Search Console integration, giving the external-visibility section of a board report real evidence instead of guesswork.
Aether AI runs the same engine for its own brands that it sells to customers: across the 4 brands it currently publishes for, spanning security, facilities software and branding, the platform produced 281 articles in the last 30 days, with citation performance tracked the same way throughout.
A board preparing its first AI visibility report, or reviewing one that currently has no external-facing evidence in it, can start with Aether AI's free AI-visibility audit at /audit to see exactly where the company currently stands across the major AI engines before the next board cycle.