AI Management Information / Board Reporting Architecture 解读

面向对象: AI Product Lead / Senior BA / Enterprise Architect / Risk Product Lead / Model Risk Partner。 核心问题: 董事会和审计委员会不需要更多 AI 项目状态, 需要能支持监督、风险偏好、投资、停止、整改和问责的 Management Information。 学习目标: 把 AI telemetry、value metrics、control effectiveness、incidents、customer harm、model/vendor concentration、adoption 和 risk appetite 转成有 lineage、threshold、owner、cadence 和 decision-usefulness 的 MI architecture。

---

Source Anchors

AI Board Reporting Architecture 是把 AI portfolio 的事实、风险、控制、价值和行动记录做成可追溯的管理信息产品, 不是把项目周报改成董事会格式。

---

1. Thesis

AI governance pack 回答 "董事会应该监督什么"。AI management information architecture 回答 "董事会依赖的事实如何生成、校验、追溯和触发行动"。 关键问题:

What facts feed board oversight?
How is each metric defined?
Where did the number come from?
Which threshold makes it reportable?
Who owns remediation?
What decision can be made from it?

没有 MI architecture, board pack 会退化为:

metric contract
  -> telemetry / evidence source
  -> lineage and quality check
  -> risk appetite threshold
  -> report view
  -> management action
  -> board decision / challenge

---

2. Why It Matters

金融零售 AI 的管理信息难点不在 "缺少数据", 而在 "数据不能形成可决策事实"。

---

3. Core Concepts

3.1 Management Information

Management Information 是为管理和监督决策准备的信息产品。它不是 raw data, 也不是 KPI 清单。

3.2 Metric Contract

3.3 MI Lineage

business event -> AI trace -> control/eval result -> data quality rule
  -> metric calculation -> dashboard tile -> board statement -> management action

If a board pack says "AI customer harm incidents decreased 20%", the institution should show incident taxonomy version, source systems, de-duplication logic, severity rule, customer impact classification, query version, owner sign-off and action status.

3.4 2026 SR 26-2 Nuance

SR 26-2, issued in 2026 by the Federal Reserve with OCC and FDIC alignment, supersedes SR 11-7 and SR 21-8. For AI MI:

• It is risk-based and materiality-driven, not a uniform validation checklist.
• It is most relevant to banking organizations over $30B in total assets, while smaller firms may still use it as sound-practice reference.
• It narrows model scope around complex quantitative methods producing quantitative estimates.
• It explicitly leaves generative AI and agentic AI outside formal scope because they are novel and rapidly evolving.
• The carve-out is not a governance free pass; broader AI risk governance still needs telemetry, controls, incidents, evidence and MI. Implication:

Board MI should separate traditional model-risk MI, non-generative AI MI, and GenAI / agentic AI MI, while still giving directors one consolidated view of AI value, risk, controls, incidents and concentration.

---

4. Architecture Diagram

AI systems and workflows
  -> model gateway / agent gateway telemetry
  -> RAG and knowledge source logs
  -> tool action and workflow event logs
  -> control tests, evals, red-team, QA samples
  -> incidents, complaints, customer harm, appeals
  -> cost, adoption, value, finance baseline
  -> vendor, model, dependency and inventory registry
  -> MI data product layer
       - metric contracts
       - lineage graph
       - quality rules
       - threshold and risk appetite rules
  -> management dashboards
  -> board / audit committee pack
  -> decision, action, attestation and evidence closure

---

5. Financial Retail Case

Scenario: A retail bank runs six AI systems.

Decision requested: approve limited scale of customer service RAG to two additional product lines.
Evidence: qualified value events 74%; unsupported claim rate 1.6%; source freshness SLA 99.4%; AI-attributable complaints flat to baseline; vendor concentration amber.
Management action: scale low-risk intents only, run cross-use-case regression before credit-card dispute policies, reduce model concentration before direct customer response.

---

6. PM / BA / Architect Checklist

---

7. Code-Lite Experiment

Goal: build a tiny MI lineage prototype for a customer service RAG board metric.

Input tables:
  ai_trace(response_id, use_case_id, model_id, timestamp, source_doc_ids, ai_exposed)
  qa_review(response_id, supported_by_source, regulated_topic, reviewer_id, review_date)
  complaints(case_id, response_id, severity, ai_attributable, remediation_required)
  metric_contract(metric_id, numerator_rule, denominator_rule, threshold_green, threshold_red, owner)
Metric:
  unsupported_claim_rate =
    count(response_id where regulated_topic = true and supported_by_source = false)
    / count(response_id where regulated_topic = true and qa_review exists)
Lineage output:
  metric_id, reporting_period, source_tables, query_version,
  denominator_count, numerator_count, threshold_status, action_required

Experiment steps: create 50 synthetic response records; create 20 QA review records; add 3 AI-attributable complaint examples; calculate unsupported_claim_rate and harm count; generate a one-page board tile; change the denominator rule and show the lineage version change. Learning standard:

You can explain exactly why the board number changed: business reality, metric definition, data quality, source-system delay or threshold update.

---

8. Interview Questions

Q1: How is AI board MI different from AI governance material?

30 秒版本:

Governance material defines oversight, roles and decision rights. MI architecture defines the facts feeding that oversight: metric contracts, telemetry sources, lineage, thresholds, cadence and action logs. Without MI architecture, board governance becomes narrative instead of evidence-based supervision. 2 分钟版本: I separate the board governance pack from the MI architecture. The governance pack says which committees oversee material AI and what decisions they make. MI architecture says how each answer is produced: source systems, metric definition, data quality rule, lineage, risk appetite threshold, owner, reporting cadence and management action. For customer service RAG, the board should not only see unsupported claim rate; it should know the denominator, QA sampling method, source logs, threshold, trend, action owner and whether the metric supports scale or hold.

Q2: What makes a board AI metric decision-useful?

30 秒版本:

A board metric is decision-useful when it connects to a management action: scale, hold, stop, fund, remediate or accept residual risk. It must have a clear definition, owner, threshold, lineage and escalation path.

Q3: How would you handle SR 26-2 in AI board reporting?

30 秒版本:

I would not claim SR 26-2 directly governs every GenAI or agentic system. I would report three layers: traditional model-risk systems in scope, non-generative AI where model-risk principles apply, and GenAI/agentic systems governed through broader enterprise AI controls. The board still needs a consolidated AI risk and value view.

---

9. Pitfalls

AI Board MI = telemetry + metric contract + lineage + threshold + action + decision.
The board does not need more AI activity reporting.
It needs evidence that value, risk, control effectiveness, customer harm, concentration and adoption are within appetite or being acted on.