TRAINING SCENARIO — FICTIONAL · NOT A REAL DOCUMENT
← Back to the Scenario Lab
BY-BX1 · Governing AI: Duties of Boards and Responsible Persons · Board · 45 min
The board paper that isn't enough
A governed response in the ai.heart canon · printable worksheet + reveal · 20 min
1 · The situation
Management asks the board to approve an AI-supported customer and patient prioritisation system. The paper describes expected efficiency gains but does not identify which decisions the system substantially supports, what personal information it uses, whether any decisions could significantly affect rights or interests, or how the privacy policy will be updated. For the banking business, it says the system will reduce manual review but gives no resourcing or risk management assessment. For the health business, it says clinical teams have been consulted but does not show governing-body safety and quality training or escalation paths.
2 · Your decision
Take a position — or defer with reasons — before you reveal the governed response.
A · Approve a limited pilot only — subject to clear evidence gates before any customer- or patient-impacting scale-up.
B · Defer approval — until management provides a decision inventory, privacy disclosure assessment, risk and resourcing assessment, and safety and quality governance plan.
C · Approve in principle — but require the accountable executive to return with board-ready assurance before go-live.
D · Reject the current paper — because it does not allow the board to provide effective challenge or connect the system to existing duties.
Your decision and one-line reason:
AI governanceThe approval minute is the board's Node 9: conditions with return dates, escalation triggers, and named responsible persons. Approving AI without conditions is releasing without certification.
3 · Governed response — reveal after deciding
AIHEART · NESTED CONTAINMENT GEOMETRY · GOVERNED RESPONSE BLOCK
Input under review: The board decision on the AI-supported customer and patient prioritisation system — and the minute that records it.
Classification of the event: A governing-body release. The minute is the output: approve-in-principle is not approval, and conditions are what make the decision governable.
| L | Layer | Check on this case | Verdict |
|---|
| L1 · Input validation | The paper's gaps verified: no decision inventory, no APP 1.7 assessment, no resourcing or risk assessment, no safety-and-quality governance plan. | PASS |
| L2 · Context analysis | Approval in principle is the board's option — but only with conditions that carry return dates and escalation triggers. | HOLD |
| L3 · Harm / loss | Unconditional approval releases a system without evidence gates; deferral protects customers and patients. | PASS |
| L4 · Equity weighting | Responsible persons carry personal duties — the minute names them, and the board records its challenge. | PASS |
| L5 · Coherence check | APRA-EXP-2026, ASIC-912A, AgedCare-s180, NSQHS-1.19, APP-1.7 — each limb of the decision maps to a cited duty. | VERIFY |
| L6 · Integration gate | Cross-layer consistent: decision inventory, disclosure, resourcing, safety and quality — all four return with evidence. | PASS |
| L7 · Audit generation | The minute records conditions, return dates and escalation triggers — append-only. | PASS |
| L8 · Output certification | The chair signs; the board is Node 9 — management returns with evidence, not assurances. | PASS |
OVERALL VERDICT · HOLD → VERIFY → CERTIFIED RELEASE
HOLD → CERTIFIED RELEASE — conditional approval, with the conditions in the minute.
PERMISSION GATE · NODE 9 — RELEASE AUTHORITY
The board holds release authority. Management returns with a decision inventory, a privacy disclosure assessment, a risk and resourcing assessment, and a safety-and-quality governance plan — or the release does not proceed.
[00:00:00.000] L1 gaps verified · inventory · disclosure · resourcing · safety
[00:00:01.000] L2 approval framed · in principle ≠ approved
[00:00:02.000] L3 harm weighed · no gates = no release
[00:00:03.000] L4 duties named · responsible persons · recorded challenge
[00:00:04.000] L5 controls mapped · APRA · ASIC · s180 · NSQHS · APP 1.7
[00:00:05.000] L6 integration passed · four evidence gates, one minute
[00:00:06.000] L7 audit appended · conditions + dates + triggers
[00:00:07.000] L8 chair signs · board is NODE9 · EXIT = CERTIFIED ONLY
Governed answer
Approve in principle only with conditions that carry return dates and escalation triggers — management returns with a decision inventory, a privacy disclosure assessment (APP 1.7), a resourcing and risk assessment (ASIC-912A), and a safety-and-quality governance plan (NSQHS-1.19), with responsible persons named where duties are personal (AgedCare-s180). The minute is the record of the board's challenge — the board is Node 9, and management returns with evidence, not assurances.
Cited controls: APRA-EXP-2026 · ASIC-912A · AgedCare-s180 · NSQHS-1.19 · APP-1.7
Provenance. This governed response was drafted with AI assistance and gated against the
cited source documents. It is a training artefact of the BestYou·AI scenario layer and carries no endorsement;
the governed verification pipeline status of the source course (BY-BX1) applies as stated on its course page.
Nothing here is legal advice.