Board and committee paper preparation

• Each paper gets a draft cover summary: what the board is asked to do, the key points and the risks, in the author's own words where possible. Every sentence cites the page it came from, and the author edits and signs it.
• Figures quoted in summaries and narrative are checked by code against the source report or appendix, and every mismatch is listed for the author to resolve. The AI never changes a number.
• The actions log is reconciled against previous minutes and the new papers, so overdue and silently closed actions are flagged to the company secretary before the pack goes out.
• The chair and committee chairs get a short list of question prompts for each paper, each one tied to a cited passage: assumptions not explained, risks without an owner, figures that changed since the last meeting.
• Restricted papers, such as M&A, inside information, legal advice and personnel cases, are handled in a separate, tighter workspace, or kept out of the tool altogether.
• Directors are told, in the pack, which parts were AI-assisted. The paper author and the company secretary sign off before anything is issued.

• Companies Act 2006Directors' general duties, sections 171 to 177
  →

  Directors must exercise independent judgement (s.173) and reasonable care, skill and diligence (s.174), and have regard to the matters in s.172 when promoting the company's success. A tool can help them read the pack; it can't do the judging for them. Summaries point back to the paper and never replace it. Nothing the AI drafts is written as if it were management's recommendation or the board's view.

• Companies Act 2006Minutes of directors' meetings, sections 248 and 249
  →

  Minutes of all board meetings must be recorded and kept for at least ten years, and a minute signed by the chair is evidence of the proceedings. The minute has to reflect the real deliberation. The AI may turn the company secretary's own notes into a draft outline, but the company secretary writes the record of decisions, conflicts and challenge, and the chair approves it.

• FRCUK Corporate Governance Code 2024 and the Code Guidance (updated 4 November 2026)
  →

  The guidance asks for board papers that are accurate, clear, comprehensive and up to date, with a summary and a statement of what's expected of directors. Under the chair's direction, the company secretary is responsible for good information flows. Provision 29 applies to financial years beginning on or after 1 January 2026: the board declares the effectiveness of its material controls at the balance sheet date. If the board relies on the pack to monitor those controls, document and test the checks like any other control.

• FRC, NHS England and othersOther governance codes: the Wates Principles, the Charity Governance Code (2025), the Code of governance for NHS provider trusts, and the corporate governance code for central government departments
  →

  Large private companies, charities, NHS trusts and public bodies report against different codes, but all of them expect boards to receive good information and to own their decisions. The design doesn't change. The disclosure to directors and the board's AI policy are worded for the code you follow.

• FCAUK Market Abuse Regulation: inside information and insider lists (Articles 17 and 18)
  →

  For listed companies, results, trading updates and transaction papers often hold inside information. Those papers go only to the restricted workspace, open to people already on the insider list, or stay out. The provider contract rules out model training and limits retention, and every access is logged so it can be checked against the insider list. In November 2026 the FCA's review of sponsors' use of AI noted approved enterprise tools, human review of every output, and close attention to confidentiality.

• CourtsLegal professional privilege
  →

  Privilege depends on confidentiality, and a summary of legal advice can disclose its substance. Legal advice papers stay out of the shared index, and the tool doesn't summarise them unless general counsel agrees and the workspace is confined. A 2026 Upper Tribunal decision said that putting confidential documents into a public AI tool amounts to placing them in the public domain. Enterprise tools need checking too: what the provider keeps, and who can see it.

• ICOUK GDPR and the Data Protection Act 2018
  →

  Remuneration papers, HR cases, whistleblowing reports and safety incidents hold personal data, sometimes special category. That means a DPIA before the pilot, collecting only what's needed, processing in UK regions, retention that matches the board record, and a contract that stops providers training on your data. Personnel cases stay out of the shared workspace.

• Institute of DirectorsProfessional guidance: "AI Governance in the Boardroom" (2025)
  →

  The IoD's business paper sets out governance questions for directors on AI. It's a useful starting checklist for the board's own AI policy, including how the board itself uses AI to prepare for meetings, alongside the company's own legal advice.

On a phone, the table shows the platform you pick. Sovereign / on-prem means open, portable components you can run in your own data centre or with a UK or European provider; IONOS is shown as one example, and others exist. What sovereign cloud means →

• A board-approved policy on AI in board papers: what it's used for, what's excluded, and how directors are told.
• A short label on every AI-assisted section, and a line in the pack's cover note saying which parts were AI-assisted.
• The company secretary decides, paper by paper, what goes to the shared workspace, the restricted workspace, or neither. General counsel decides on legal advice.
• Paper authors stay responsible for their papers. Summaries are theirs once signed.
• Meeting recording stays off unless the board has decided otherwise, with legal advice on what a recording would mean for the record.
• Authors and the secretariat trained before the first cycle, including what the checks can't see: context that isn't in the papers.

1. 2–3 weeks

   Discovery

   Map today's pack timetable, measure the baseline, classify papers by sensitivity, and agree what your board portal's export or API allows.

2. Gate · must be true to passBaseline agreed, classification rules signed off by the company secretary and general counsel, DPIA started, board's AI policy drafted.

3. 8–10 weeks

   Pilot

   One committee whose papers carry no inside information, such as a sustainability or health and safety committee, over two cycles in shadow mode: drafts and checks are produced, the pack is prepared as normal, and the two are compared.

4. Gate · must be true to passSummary accuracy and edit rate within agreed limits, no uncited claims shown, no restricted material in the shared index, committee chair content.

5. 4–6 weeks

   Production

   Summaries, checks and question prompts go live for the pilot committee and the main board's open papers, with monitoring and a rollback plan.

6. Gate · must be true to passBoard approves the AI policy and the disclosure wording; monitoring, support and rollback in place.

7. Ongoing

   Scale

   Add committees one at a time. The audit and remuneration committees come last, with the restricted workspace and insider-list controls tested first.

8. Gate · must be true to passEach committee passes the same pilot gate, and its chair agrees.

R ResponsibleA AccountableC ConsultedI Informed· not involved

Where I'd fit

1. 1

   Goes wrong

   The cover summary reads like a recommendation, and directors can't tell management's view from the tool's.

   How the design avoids it

   Summaries only restate the paper, with a citation for every sentence. Guardrails block recommendation language, and the author signs the summary as their own.

2. 2

   Goes wrong

   A figure in the summary doesn't match the appendix, because the model rounded or restated it.

   How the design avoids it

   Numbers are copied by code from the source and checked by code. The model never generates a figure, and an unchecked figure is marked as such.

3. 3

   Goes wrong

   A remuneration or M&A paper ends up in the shared index, and someone outside the committee can find it.

   How the design avoids it

   Restricted papers go to a separate workspace or stay out. Permissions come from the portal, default to deny, and are tested every month.

4. 4

   Goes wrong

   Directors read the summaries and stop reading the papers.

   How the design avoids it

   Summaries are short and point to pages. The chair's question prompts invite challenge, and the board evaluation asks how directors use them.

5. 5

   Goes wrong

   Meetings are recorded and transcribed "to help the minutes", creating a verbatim record nobody planned for.

   How the design avoids it

   No recording by default. The company secretary writes the minute from their own notes, and any change is the board's decision, with legal advice.

1. Annual reports from 2027
   The first Provision 29 declarations under the UK Corporate Governance Code 2024, for financial years beginning on or after 1 January 2026.

   If the board relies on the pack to monitor material controls, write the figure checks and sign-offs down as part of that control framework, with an owner and test evidence.

2. 30 November 2026, outcome by mid-2027
   The government's consultation "Modernising Corporate Reporting" (published 7 September 2026) closes on 30 November 2026. It covers financial and non-financial reporting, corporate governance and remuneration reporting.

   Keep the checks configurable, so new or removed reporting requirements change a rule set, not the design.

3. Late 2026–2028
   The Cyber Security and Resilience Bill brings medium and large managed service providers into regulation, with duties set by secondary legislation.

   Your board portal provider and AI provider may come into scope. Update supplier assurance and contracts as the duties are set.

4. 2028
   The NCSC's post-quantum cryptography milestone: a full migration plan by 2028.

   Board minutes are kept for at least ten years and papers are highly sensitive. Record which encryption the workspaces use and keep it easy to change.