Reporting AI Near-Misses to the Board of Directors

Define an AI near-miss before you measure it

Start with a single working definition: an AI near-miss is an attempted or detected event that a control stopped before harm occurred. Board reporting depends on counting the same thing the same way every time.

Classify each event in a fixed taxonomy. Every event should map to a taxonomy category and a severity level, so that counts and trends can be compared across systems and agents.

Separate operational reporting from board oversight

Not every near-miss belongs in front of the board. Operational teams work with events as they are detected; the board receives a summary on a regular cadence.

That summary should contain counts, trends, and a few narrated events. Narrated events give directors concrete examples, while the counts and trends show whether the overall picture is changing.

Set escalation criteria in writing

Escalate only events that meet written criteria. Documented thresholds keep escalation consistent and prevent the board from receiving either every event or only the ones someone happens to notice. The criteria fall into three groups:

• Severity: the event reaches a severity level defined in the taxonomy.
• Recurrence: the same kind of event keeps appearing.
• Control gap: the event exposes a weakness in an existing control.

Events that meet these criteria move to risk leadership and the board.

Use runtime logs and audit trails as the evidence base

Link every figure in the report to runtime enforcement logs and audit records. Each number should be traceable to three things:

• an agent identity,
• an attempted action, and
• a policy decision.

When runtime controls block or flag an event, they write a decision record. Those records are the source for the counts, trends, and narrated events that reach the board.

Establish the reporting process

Treat near-miss reporting as a data pipeline with five stages. Each stage hands a defined output to the next, and the final report is delivered on a fixed cadence.

Near-miss reporting as a data pipeline

What a board-level near-miss report should contain

• Counts of near-miss events for the reporting period.
• Trends over time, across systems and agents.
• A few narrated events that met the written escalation criteria.
• Taxonomy category and severity level for each reported event.
• Traceability for every figure to runtime enforcement logs and audit records, including the agent identity, the attempted action, and the policy decision.