At minimum, boards should mandate periodic reporting on material AI use cases, key risks, vendor dependencies, and control effectiveness ...