Acme Inc, Q2 2026 board AI subcommittee, 14:00 sharp. The chair, twenty-two minutes on the wall clock, audit-committee handover queued at 14:25, full-board summary at 15:10, opens with a piece of institutional history: "My predecessor brought sixty slides every quarter. I read twelve of them. Today we have one of two outcomes. Either Maya hands me six slides that fit my twenty-two minutes and let us make three decisions before the audit handover, or I send her back to the AIGC and we redo this in three weeks." Maya Okafor, Chief AI Risk Officer, eleven months into the seat ratified in lesson 097, two quarters past the board-approved AI risk appetite (lesson 098), one quarter past her first published "no" (lesson 099), slides a single PDF across the table: Acme Inc, Quarterly AI Risk Brief, Q2 2026, 6 slides, 22 minutes, 3 decisions. Behind it is a 31-page appendix nobody will read aloud. This, the milestone hundredth lesson of the AI Governance, Risk and Red Teaming program, is the executive-tier playbook for the artifact that complements but does not duplicate the lesson 087 twelve-KRI dashboard. The dashboard is the data; the 6-slide brief is the narrative. We walk the six slides, headline, heat-map, FAIR ALE + reserve sufficiency, compliance posture, three decisions, emerging concern, with the per-slide construction discipline (one number, one chart, three bullets, one ask), the 3-week preparation cadence, the CAIRO + CAIO co-presentation model with audit-committee chair in the room, the dependency on the lesson 035 board literacy program, the seven failure patterns that send CAIROs back to the AIGC, and the Acme Q2 2026 worked brief that lets the chair close at minute 19 of 22 with a vendor-diversification budget approved, a notified-body engagement ratified, and a healthcare adjacency surfaced for Q3 deep-dive. The brief is the artifact a class-action plaintiff subpoenas first and an EU AI Office inspector reads before a supervisory visit. Quality materially shapes regulator and litigation disposition. The chair signs the minutes at 14:20. The CRO predecessor's sixty-slide ghost is laid to rest.

Why a 6-Slide Standard Is the 2026 Board AI Briefing Form

The board AI subcommittee was not standard organ in 2023. By Q2 2026 it is the named recipient of AI risk reporting in roughly half of S&P 500 companies (Spencer Stuart Board Index 2025 + EY Center for Board Matters 2026), in every G-SIB and D-SIB under SR 11-7 and PRA SS1/23 aggregation expectations, in every EU AI Act high-risk provider obliged to demonstrate Article 17 top-management responsibility, and in every ISO/IEC 42001 certified body. The committee meets quarterly for 20-45 minutes on AI, typically 30, with hand-off slots compressing presentation to 18-22 minutes. The CAIRO (lesson 097) gets that window. Everything the CAIRO has done in 90 days, every red-team finding, Article 73 incident, PMM drift signal, FRIA closure, vendor SOC 2 lapse, regulator letter, appetite breach, "no" delivered (lesson 099), must distill into it. The 6-slide standard is the discipline that makes the distillation defensible and repeatable.

• Time-box reality. 22 minutes at roughly 3.5 minutes per slide leaves 90 seconds buffer for chair interruptions per slide. Six is the cognitive ceiling for board absorption in that window. Fewer (four) sacrifices coverage of the four mandatory tiers: trajectory, posture, money, decisions. More (eight-or-ten) breaks the time-box and forces the chair to truncate or push deep-dives, the failure pattern that earned Maya's predecessor his sixty-slide reputation.
• Standardization across quarters enables trend visibility. Structure does not change quarter-on-quarter. Slide 1 is always headline; slide 2 always heat-map; slide 3 always FAIR ALE plus reserve sufficiency. The chair develops pattern recognition, by Q4 a director who saw Q1-Q3 briefs reads slide 3 in nine seconds and notices a reserve ratio slipped from 1.20× to 1.05× without the CAIRO speaking. Pattern recognition is the regulator-grade evidence stream EU AI Office inspectors and Big-Four auditors pull on first. Quarter-on-quarter visual variation destroys it (briefing failure 2).
• Complementary to the 12-KRI dashboard (lesson 087), distinct in form. The lesson 087 dashboard is the one-page data artifact: twelve numbers, four quadrants, anchored thresholds, source-of-truth references. The 6-slide brief is the narrative wrapper: what the numbers mean, what is changing, what the board is being asked to decide, where the CAIRO is worried, what comes next quarter. Dashboard answers "what is true." Brief answers "what should we do about it." Both belong on the agenda; both belong in the audit committee's 10-K disclosure binder.
• Regulator and litigation discovery posture. The brief is the artifact a regulator requests first (EU AI Office, FCA, BaFin, Federal Reserve), a class-action plaintiff subpoenas first, a Conformity Assessment Body reviews first. Quality materially affects supervisory disposition. Article 17 + 9 + 26 quality-of-oversight failures cascade into Article 99(3) €15M / 3% bands when briefing records demonstrate the board could not have made informed decisions on the inputs received.
• Co-presentation reduces single-executive-voice risk. Delivered jointly: CAIRO (slides 1, 2, 3, 4, 6) and CAIO (slide 5 decisions). Audit-committee chair attends and asks. Two voices, risk owner and value owner, plus a third interrogator. The structural defense against the L4 anti-pattern of CAIO-only AI reporting that buried risk under value narrative through 2024.
• EU AI Act Articles 17, 26, 27, 71, 72, 73, 99 + NIST Govern 1.5 + 5.1 + ISO 42001 Clause 9 + A.3 + A.9 + SR 11-7 board cadence + SEC Items 105 / 303 / 407 + Form 8-K Item 1.05. Cross-walk is direct. Article 17 + 9 board oversight; Articles 26 + 27 deployer obligations to slide 4; Article 72 PMM drift to slides 3 + 4; Article 73 to slide 4; Article 71 regulator engagement to slide 6. NIST Govern 1.5 (oversight mechanisms) and 5.1 (policies/practices) anchor the framework. ISO 42001 Clause 9 + Annex A.3 + A.9 anchor the management system. SR 11-7 § 6 anchors prudential. SEC Item 407 oversight attestation and Item 105 risk factors pull from the brief verbatim.
• The discovery test. Before any brief lands on the agenda, the CAIRO applies it: if this were subpoenaed tomorrow and read aloud in court by a plaintiff's lawyer, what does it say about the board's quality of oversight? A passing brief has anchored numbers, named decisions, owned mitigations, four-quarter trends, visible bad news (not hidden in appendix, failure 4). A failing brief has narrative without numbers, numbers without context, or, worst, bad news in appendix page 31.

Why six. Four cuts a mandatory tier. Eight breaks time-box. Six distributes the 22 minutes as: 2 min slide 1 / 4 min slide 2 / 4 min slide 3 / 3 min slide 4 / 5 min slide 5 / 3 min slide 6 + 1 min close. The five-minute slide 5 is the deliberate widest slot, the board's job is to decide, not receive.

The Six Slides Walked - Content, Source, Audience Test

Each slide has a fixed purpose, data source, audience question, and construction template. The CAIRO does not reinvent the structure quarter to quarter. The structure is constant. The data fills in. The construction discipline, one headline number, one chart, three bullets, one ask, no more than five data points per slide, is the L5 distillation rigor that separates briefings the board acts on from briefings the board endures.

Slide 1 - Headline / Risk Trajectory.

Purpose: one-sentence summary of where AI risk is this quarter vs last and vs appetite. Audience question: "Are we in better or worse shape than 90 days ago, and are we within appetite?" Source: AI Risk Index (0-10 weighted aggregate from the lesson 087 dashboard) + AIRA breach signal from lesson 074. Content: (a) one-line headline (e.g., "AI Risk Index 7.4 / 10, down 0.5 from Q1, within appetite, 1 amber breach"); (b) 4-quarter sparkline; (c) three bullets, what improved, what worsened, what changed structurally; (d) no ask (orientation only). Two minutes spoken. The chair must be able to repeat the headline verbatim in the audit-committee handover at 14:25.

Slide 2 - Heat-Map This Quarter.

Purpose: visual of regulator-grade AI risk scenarios on a 5×5 likelihood × impact grid with movement arrows since last quarter. Audience question: "Where is our biggest exposure, and what is moving?" Source: lesson 085 audit-committee heat-map. Content: (a) headline, count of red + crimson cells (e.g., "2 red, 0 crimson, down from 3, 0 in Q1"); (b) the 5×5 grid with scenarios plotted, arrows, and 4-cell color band; (c) three bullets, top 3 scenarios with one-line context each (cell, direction, action); (d) no ask. Four minutes spoken. The chair reads the heat-map in eight seconds because the layout is identical to Q1, Q4 2025, Q3 2025, pattern recognition (failure 2 avoided).

Slide 3 - FAIR ALE + Reserve Sufficiency.

Purpose: aggregate financial exposure (FAIR 95th-percentile Annualized Loss Expectancy) and reserve coverage. Audience question: "How much could AI risk cost us in a bad year, and have we reserved enough for it?" Source: lesson 086 FAIR loss-event reserve model. Content: (a) headline, ALE₉₅ € (e.g., "€11.8M ALE₉₅, reserve €13M, coverage 1.10×"); (b) 4-quarter ALE₉₅ bar chart with reserve line overlay; (c) three bullets: top contributor, biggest tail-risk scenario, reserve-policy commentary (target / current / replenishment cadence); (d) implicit ask ("reserve adequate at current ratio; recommend continued review"). Four minutes spoken. The audit-committee chair reads the reserve ratio first because that is the number the 10-K disclosure binder cites.

Slide 4 - Compliance Posture.

Purpose: green/amber/red status of four primary compliance streams: EU AI Act readiness (Annex IV TDF currency, Article 73 incidents, FRIA pipeline), ISO 42001 surveillance, NIST AI RMF maturity, SR 11-7 / PRA SS1/23 alignment. Audience question: "Are we current on every external-facing obligation, and what is at risk?" Source: KPIs 5-8 from lesson 087 dashboard + Internal Audit (3L) findings ledger. Content: (a) headline, green count (e.g., "3 of 4 green; 1 amber, vendor concentration"); (b) 4-row × 3-column status table (stream / status / one-line context); (c) three bullets, biggest amber, ISO surveillance status, Article 73 YTD + 15-day timeliness; (d) conditional ask (escalation only if Article 73 incident open and unreported). Three minutes spoken. Big-Four external auditor sees the green count and triangulates against ISO 42001 surveillance scheduling.

Slide 5 - Three Critical Decisions Needed.

Purpose: the board decides. Three asks framed approve / defer / no-go with CAIRO recommendation per decision. Audience question: "What do you need from us?" Source: CAIRO decision-rights register (lesson 097) + AIGC monthly minutes + open appetite breaches (lesson 074). Content: (a) headline, "Three decisions requested today"; (b) decision table, 3 rows × 4 columns (decision / context / CAIRO recommendation / target close); (c) three bullets, one per decision (business context, risk implication, recommendation, residual risk if deferred); (d) three explicit approve/defer/no-go requests captured in minutes. Five minutes spoken, widest slot deliberately. Co-presentation: CAIO presents (not CAIRO): value owner asks, risk owner has framed in slides 1-4, board hears both. Without this slide the board hears but does not act (failure 3). Decisions are the artifact that demonstrates oversight under SEC Item 407 and ISO 42001 Annex A.3.

Slide 6 - Emerging Concern + Next Quarter Focus.

Purpose: one emerging concern not yet a board-level decision but headed there in Q+1 or Q+2, plus three priorities the AI Risk Office will execute next quarter. Audience question: "What is over the horizon, and what will you bring back?" Source: CAIRO 90-day forward plan + emerging-risk register + regulator monitoring stream (EU AI Office circulars, NIST CAISI bulletins, ISO/IEC JTC1/SC42 output). Content: (a) headline, one named concern (e.g., "Annex III §5(c) extension into healthcare adjacency, Q3 deep-dive"); (b) horizon-scan timeline (6m / 12m / 24m watch items); (c) three bullets, Q+1 priorities 1/2/3 with named owners and milestones; (d) implicit pre-commitment ("CAIRO returns with deep-dive at Q3 subcommittee"). Three minutes + one-minute close. The artifact the chair carries into the audit-committee handover as the "what is coming" frame.

The four-element rule. Every slide has exactly four construction elements: one headline number (or named item), one chart (or table), three bullets, one ask (explicit or implicit). No more than five data points per slide. Five is the cognitive absorption ceiling for a non-AI-specialist director scanning in 25-40 seconds. Beyond five the slide becomes a register printout (failure 6). Enforced by AIGC at T-10d. Any slide with seven bullets, three charts, or twelve data points goes back for redrafting.

The appendix rule. Every datum, cross-walk, threshold-revision history, source-of-truth, Article cross-reference, NIST subcategory mapping, ISO control reference, Big-Four reconciliation, belongs in the appendix. The appendix runs 25-35 pages, filed with minutes, reviewed by Conformity Assessment Bodies and EU AI Office inspectors. It is not spoken aloud. The 6 slides are the entire spoken narrative. A CAIRO who reads from the appendix has failed the time-box and signals they cannot distill (failure 1).

Fifteen Standard Board Questions Pre-Rehearsed at T-3d Dry-Run

A CAIRO who has not pre-rehearsed the fifteen standard board questions burns three of the twenty-two minutes generating answers in real-time and loses the time-box. Maya rehearses with the AIGC + CFO + General Counsel as proxy board at T-3d. Every question below is answerable from material visible on one of the six slides; none requires the CAIRO to ad-lib; none requires the appendix opened in-meeting.

• Q1 "How does Q2 compare to Q1?" → slide 1 sparkline + one driver. Q2 "Where is our biggest exposure?" → slide 2 top red-cell + slide 3 €-quantified contribution. Q3 "Are we within appetite?" → slide 1 AIRA breach count + lesson 074 runbook status.
• Q4 "Worst-case scenario?" → slide 3 ALE₉₉ tail (appendix) + one-paragraph narrative. Q5 "What do you need from us?" → slide 5 three decisions verbatim. Q6 "Adequately reserved?" → slide 3 reserve ratio + policy commentary.
• Q7 "What is the trend?" → slide 1 sparkline + slide 3 ALE trajectory. Q8 "How vs peers?" → slide 4 ISO/NIST maturity + peer 10-K cross-walk (appendix). Q9 "What did we say last quarter, did we do it?" → Q-1 decision register (appendix); CAIRO walks closure list.
• Q10 "Regulator changes?" → slide 6 horizon + appendix regulator log. Q11 "Talent?" → lesson 097 FTE position + hiring plan (appendix). Q12 "Where could we be sued?" → slide 2 top red-cell + slide 3 ALE₉₅ + appendix legal-risk register.
• Q13 "Worst news in this brief?" → explicit on slide 4 or 5; never hidden (failure 4). Q14 "What worries you that is not on these slides?" → slide 6 emerging concern verbatim, the honest answer is the trust-builder. Q15 "When will you deep-dive [X]?" → slide 6 priorities + appendix forward calendar.

Dry-run test: if Maya cannot answer all fifteen from slide-visible material in under 90 seconds each, the brief is re-cut between T-3d and T-1d.

Preparation Cycle - Three Weeks From Data Freeze to Delivery

The brief is built on a 3-week cadence with seven milestone gates. Each gate has named owner, deliverable, and criterion. Missing any gate slips the brief or ships an under-rehearsed version that fails the 22-minute time-box.

• T-21d - Data freeze. Owner: AI Risk Office head. Deliverable: all twelve KRIs (lesson 087) frozen at month-end; lesson 085 heat-map refreshed; lesson 086 FAIR ALE recalculated; Article 73 YTD log closed; FRIA register frozen; vendor concentration snapshot. Criterion: every source timestamped + signed-off. No data changes after T-21d without lesson 087 emergency-refresh trigger.
• T-14d - Slide draft v1. Owner: CAIRO + CAIO joint. Deliverable: six slides in template form + 31-page appendix v1. Criterion: every slide passes the four-element rule; no slide exceeds five data points; discovery test passes CAIRO + General Counsel read.
• T-10d - AIGC review. Owner: AIGC chair (lesson 014). Deliverable: formal review + red-line edits. Criterion: AIGC sign-off + redraft instructions in minutes. Typical revision is on slide 5: refining ask framing, sometimes splitting a single decision into two, sometimes deferring a decision because pre-decision work is incomplete.
• T-7d - Chair pre-read. Owner: CAIRO. Deliverable: v2 + appendix v2 to chair as Sunday-evening pre-read. Criterion: chair acknowledges; flags anticipated questions for pre-rehearsal; signals if any slide 5 decision needs 1:1 pre-meeting discussion.
• T-3d - Dry-run. Owner: CAIRO. Deliverable: full 22-minute dry-run with CAIO + CFO + General Counsel + AIGC chair as proxy board. Criterion: CAIRO completes 22 minutes in 22 (not 28, not 18); all 15 anticipated questions answered from slide-visible material in under 90 seconds; CAIO delivers slide 5 cleanly. Failed dry-runs trigger re-cut between T-3d and T-1d.
• T-1d - Lock. Owner: CAIRO. Deliverable: locked PDF distributed to subcommittee + appendix + prior-meeting closure log. No edits except material new information (triggers at-meeting addendum recorded in minutes).
• T - Delivery. 22-minute presentation, 3 decisions, chair signs minutes, audit-committee handover at T+22. Post-meeting: CAIRO publishes board-approved minutes to AIGC within 48 hours; decisions captured in CAIRO decision-rights register; slide 5 outcomes flow to AIGC monthly tracking.

The 3-week cadence is non-negotiable. A brief built in five days is the failure-pattern brief: under-rehearsed, slides cut from operational dashboards without distillation, no dry-run, no co-presentation, no chair pre-read. The CAIRO who normalizes "we will pull this together next week" trains the board to expect substandard briefings.

Co-Presentation, Audit Chair Attendance, Board Literacy Dependency

The 6-slide standard presumes three structural conditions. Without all three the briefing devolves into education and decisions don't get made (failures 3 + 5).

CAIRO + CAIO co-presentation.

CAIRO presents slides 1, 2, 3, 4, 6 (risk frame); CAIO presents slide 5 (value frame, the three decisions). The board sees both voices in the same room. Structural defense against the L4 anti-pattern of CAIO-only AI reporting that buried risk under value through 2024, the same anti-pattern that made the lesson 097 CAIRO charter necessary. Slide 5 is also cleaner: value owner asks for budget, risk owner has framed residual risk, board makes a calibrated decision. CAIRO-alone slide 5 reads as risk-office advocacy; CAIO-alone reads as value-side capture; both voices reads as governance.

Audit Committee chair attends and asks.

The audit-committee chair attends as permanent observer with question-asking rights. Structural bridge that makes the audit-handover at T+22 a 30-second confirmation rather than re-presentation. The chair carries the brief verbatim into the audit-committee meeting and pulls slide 3 (ALE + reserve) and slide 4 (compliance) directly into the SEC Item 105 / 303 / 407 disclosure binder for the 10-K. Without attendance, the CAIRO presents the same brief twice, burning 44 quarterly minutes and signaling the two committees are not coordinated.

Board AI literacy is the precondition (lesson 035).

The standard assumes the board has done the Article 4 literacy program, the 90-minute briefing from lesson 035 plus annual refresh. Without it, slide 2 requires explaining a 5×5 likelihood × impact grid; slide 3 requires Monte Carlo 95th-percentile translation; slide 4 requires ISO 42001 surveillance translation into board English. Each translation costs three minutes; three translations cost the entire window. The briefing then devolves into education and the slide 5 decisions don't get made (failure 3). A CAIRO inheriting a board without Article 4 literacy must first run the lesson 035 90-minute briefing as a one-time foundation session before the 6-slide standard is viable. Maya, lucky in this respect, inherited a board that completed the program in Q4 2025; she shipped the 6-slide standard from Q1 2026 onward.

Seven Quarterly Briefing Failure Patterns

• 1 - The 60-slide deck. Maya's predecessor's pattern. CRO + CISO + CCO joint deck assembled from operational dashboards, no distillation, no time-box, no decisions. Board absorbs nothing; chair tunes out at slide 11; audit handover is re-presentation; decisions get pushed to AIGC monthly and never land at the board. Fix: hard cap at 6 slides; appendix carries depth; AIGC at T-10d rejects any draft over 6 slides.
• 2 - Different visuals each quarter. CAIRO redesigns the heat-map palette in Q2, swaps the ALE chart from bar to line in Q3, replaces compliance status table with radar in Q4. Board cannot develop pattern recognition; every quarter is a first-quarter read; trend visibility lost. Fix: brand-consistent visual language: same palette, same chart types, same KPI names quarter-over-quarter; visual changes require AIGC sign-off announced one quarter ahead.
• 3 - No decision asks. Informational only, six slides of "here is the state of AI risk" with no slide 5 approve/defer/no-go. Board hears but does not act; audit handover is transmission not vote; SEC Item 407 oversight attestation is weakened (record of oversight is hollow). Fix: slide 5 mandatory with exactly three decisions framed; AIGC rejects any draft without it.
• 4 - Hiding bad news in appendix. CAIRO buries Article 73 late-report on appendix page 19, SOC 2 qualified opinion page 22, appetite breach page 26. Board discovers later, typically when a regulator letter arrives, and trust collapses. Chair stops trusting future briefings; regulator views the firm as evasive; class-action plaintiff cites the burial as evidence of board misleading. Fix: bad news on slide 1 or slide 4: visible, named, owned, with mitigation; the discovery test is the discipline.
• 5 - Over-quantifying without narrative. Every slide has twelve data points, four sub-charts, eight footnotes. Board reads numbers but cannot construct meaning. Chair asks "so what?" and CAIRO cannot answer in one sentence. Fix: four-element rule + no more than five data points per slide; every slide passes the "so what?" test before AIGC sign-off.
• 6 - Under-quantifying (no anchored data). Opposite failure. Narrative-only, "vendor concentration is high; we are working on it." No percentage, no appetite threshold, no €-quantified ALE, no four-quarter trend. Big-Four auditor and EU AI Office inspector cannot test claims; board cannot calibrate; discovery test fails because the brief is unfalsifiable. Fix: every slide carries at least one anchored number tied to the lesson 087 dashboard's source-of-truth.
• 7 - Skipping the 4-quarter trend. CAIRO presents Q2 numbers as if Q2 exists in isolation: no sparkline on slide 1, no trend chart on slide 3, no Q1 comparison on slide 4. Board cannot see trajectory; chair asks "is this getting better or worse?" and CAIRO constructs the answer real-time. Fix: 4-quarter sparkline on slide 1; bar chart on slide 3; quarter-over-quarter delta on slide 4.

Failure-pattern map. Failures 1, 5, 6 = volume calibration. Failures 2, 7 = continuity. Failure 3 = action. Failure 4 = honesty. The seven together are AIGC's T-10d rejection criteria and General Counsel's T-3d discovery test.

Worked Example - Acme Inc Q2 2026 Six-Slide Brief

Acme.Corp, Q2 2026: 17 production AI systems (lesson 087 dashboard); AIRA refreshed Feb 2026 (lesson 074); heat-map and FAIR ALE refreshed May 2026 (lessons 085 + 086); CAIRO Maya Okafor in seat eleven months (lesson 097); 3-year AI risk plan ratified Q1 2026 (lesson 098); first published "no" delivered Q2 2026 (lesson 099, healthcare diagnostic startup acquisition). The 6-slide brief delivered to the board AI subcommittee on Thursday, 14 May 2026 at 14:00.

Slide 1 - Headline / Risk Trajectory.

Headline: "AI Risk Index 7.4 / 10, down 0.5 from Q1 7.9, within appetite ceiling 8.5, 1 amber breach (vendor concentration, open)." Chart: 4-quarter sparkline 8.1 → 7.9 → 7.9 → 7.4. Bullets: (1) Index improved 0.5 driven by Article 73 trigger-categorization remediation closing + KPI 9 red-team finding closure; (2) Vendor concentration breach remains open (KPI 11 at 68% above 60% appetite); (3) Inventory grew 6% (17 systems from 16; 1 new Tier-3 customer-service deployment). Ask: none. Two minutes spoken.

Slide 2 - Heat-Map This Quarter.

Headline: "2 red cells, 0 crimson, down from 3 red, 0 crimson in Q1." Chart: 5×5 likelihood × impact grid with 17 scenarios plotted; 2 red cells highlighted; arrows showing 4 improving, 11 stable, 2 deteriorating. Bullets: (1) Red cell 1, Vendor lock-in scenario (S5): single foundation-model provider supplies 11 of 17 systems; diversification contract signed June 30 will move to amber by Q3; (2) Red cell 2, Article 73 late-report scenario (S7): trigger-categorization gap closed in May; operational test 30 June; (3) Deteriorating arrows: S9 model-drift on credit-scoring (under investigation, PMM owner engaged); S12 third-party data-quality on customer-service (under monitoring, vendor remediation Q3). Ask: none. Four minutes spoken.

Slide 3 - FAIR ALE + Reserve Sufficiency.

Headline: "ALE₉₅ €11.8M, reserve €13M, coverage ratio 1.10×, within reserve-policy floor of 1.05×." Chart: 4-quarter ALE₉₅ bar chart (€10.2M → €11.1M → €11.5M → €11.8M) with reserve line overlay at €13M (held flat). Bullets: (1) Top ALE contributor: Scenario 7 (Article 73 late-report tail) at 28% of aggregate, declining as remediation operationalises; (2) Biggest tail-risk: Scenario 5 (vendor lock-in cascade) at ALE₉₉ €34M, the diversification plan reduces tail by an estimated €18M by Q1 2027; (3) Reserve policy: 1.05× floor, 1.25× ceiling, replenishment quarterly via FP&A accrual; current 1.10× ratio adequate with vendor diversification expected to lift coverage to 1.18× by Q4 as ALE₉₅ declines. Ask: implicit, reserve coverage adequate; recommend continued quarterly review. Four minutes spoken.

Slide 4 - Compliance Posture.

Headline: "3 of 4 streams green; 1 amber, vendor concentration cascading into Article 25/26 deployer obligations." Chart: 4-row status table: EU AI Act (green: Annex IV TDF currency 96%, FRIA closure 93%, Article 73 YTD 1 incident reported on day 19 with remediation operational test scheduled, 15-day timeliness 100% prospective from 1 July), ISO 42001 (green: surveillance readiness 88, October cycle on track, 0 open Major Findings), NIST AI RMF (green: maturity composite 3.6 / 5, target 3.8 by year-end), SR 11-7 / PRA SS1/23 (amber: vendor concentration triggers KRI 11 cascade into Article 25(1)(a) deployer obligation review for top provider). Bullets: (1) Biggest amber: vendor concentration 68% above 60% appetite (covered in slide 5 decision 1); (2) ISO 42001 surveillance: October cycle, pre-check April clean, 3 minor findings all remediated; (3) Article 73 YTD: 1 incident, reported late by 4 days (root cause categorization gap, remediation playbook signed, operational test 30 June, prospective timeliness 100%). Ask: none. Three minutes spoken.

Slide 5 - Three Critical Decisions Needed.

Headline: "Three decisions requested today", presented by CAIO (not CAIRO). Chart: decision table, 3 rows × 4 columns. Decision 1 - Approve €1.2M Q3 vendor diversification budget. KPI 11 at 68% above 60% appetite; multi-supplier plan ratified by AIGC March; first contract signed June 30; €1.2M funds second contract Q4 (hiring-AI Tier-1 migration). Recommendation: Approve. Residual risk if deferred: KPI 11 remains amber/red through Q4; SR 11-7 prudential-examiner concern; ALE₉₉ tail at €34M does not decline. Decision 2 - Ratify CAIRO engagement with EU notified body on Annex III §5(c) healthcare adjacency assessment. Q2 acquisition pipeline included healthcare-diagnostic startup; CAIRO published "no" (lesson 099); CAIRO recommends proactive notified-body engagement to scope Article 43 pathway for 2027 healthcare AI use cases the strategy team is exploring. Recommendation: Approve; budget €450K for engagement + external counsel. Target close: engagement letter Q3; scoping report Q1 2027. Decision 3 - Defer healthcare-adjacency strategic deep-dive to Q3 subcommittee. CAIRO and CSO need 90 days to complete strategic option analysis. Recommendation: Defer to Q3 with full deep-dive. Residual if deferred to Q4: strategy decisions lose 90 days of board input. Ask: three explicit approve / approve / defer-to-Q3 requests. Five minutes spoken, co-presented by CAIO with CAIRO interjections on residual-risk framing.

Slide 6 - Emerging Concern + Next Quarter Focus.

Headline: "Annex III §5(c) extension into healthcare adjacency, Q3 deep-dive." Chart: 6-month / 12-month / 24-month horizon scan timeline, 6m: notified-body engagement Q3 (decision 2); 12m: scoping report Q1 2027; 24m: healthcare-AI conformity assessment ready for 2027 pipeline. Bullets: Q3 priorities, (1) Execute vendor diversification contract 1 (closing KPI 11); (2) Complete Article 73 trigger-categorization operational test (closing slide 4 amber); (3) Scope healthcare-adjacency notified-body engagement (executing decision 2). Each priority has a named owner (CAIRO direct + Vendor Management head + Article 73 IR lead + healthcare-adjacency program manager) and a Q3 milestone. Ask: implicit pre-commitment, Q3 board AI subcommittee will receive deep-dive on healthcare adjacency and closure report on the three Q3 priorities. Three minutes spoken plus one-minute close.

Meeting outcome.

Chair signs decisions: (1) Approve €1.2M vendor diversification budget; (2) Approve €450K notified-body engagement on healthcare adjacency; (3) Defer healthcare-adjacency strategic deep-dive to Q3 board AI subcommittee. Audit-committee chair (in attendance) confirms slide 3 ALE figures will flow into Q2 10-K disclosure draft for Items 105 + 303; pulls slide 4 compliance table into Item 407 oversight attestation. Chair closes the agenda at minute 19 of 22, three minutes spare to discuss the lesson 035 board literacy refresh scheduled for Q4. Audit-committee handover at 14:25 is a 30-second confirmation. Maya files the brief + appendix + meeting minutes with the AIGC by Saturday 16 May; decisions captured in CAIRO decision-rights register; Q3 dry-run already scheduled for 6 August (T-3d to 9 August board AI subcommittee). The 22 minutes have produced three approved decisions, one ratified deferral, one regulator-grade audit-committee disclosure stream, and one Q3 forward calendar, the maximum yield the board AI subcommittee can extract from its quarterly window.

Cross-Walk and Penalty Exposure

The 6-slide brief is the load-bearing narrative artifact at the intersection of every governance, supervisory, and assurance lens. The cross-walk, reproduced in the appendix of every quarterly brief, names the primary mapping per slide plus the Article 99 penalty exposure linked to briefing-quality failures.

• Slide 1 (Headline / Trajectory): Article 17(1)(a)(b) QMS + risk-management strategy; NIST Govern 1.5 oversight mechanisms; ISO 42001 Clause 9.1 monitoring + Annex A.3 leadership. Indirect 99(3) €15M / 3% via Article 17 oversight cascade.
• Slide 2 (Heat-Map): Article 9 continuous risk management; NIST Govern 5.1 + Map 5.1 risk-mapping; ISO 42001 Clause 6.1.2. 99(3) €15M / 3% via Article 9 failure.
• Slide 3 (ALE + Reserve): Article 9(2)(a) risk quantification; NIST Measure 2.6 quantification; ISO 42001 Clause 6.1.2; SR 11-7 aggregation principle. Indirect via Article 9 + insurance / reserve adequacy.
• Slide 4 (Compliance Posture): Articles 11 (TDF) + 17 (QMS) + 26 (deployer) + 27 (FRIA) + 71 (regulator) + 72 (PMM) + 73 (serious incidents); NIST Govern 1.6 + Manage 4.3; ISO 42001 all Clauses + Annex A. 99(3) €15M / 3% per cited Article.
• Slide 5 (Decisions): Article 17 top-management responsibility; NIST Govern 1.5 + 5.1; ISO 42001 Annex A.3 leadership + Clause 5; SEC Item 407 oversight attestation. Indirect 99(3) via oversight-adequacy cascade; SEC enforcement exposure on Item 407 misrepresentation.
• Slide 6 (Emerging + Next Quarter): Article 9 continuous improvement; NIST Govern 1.7; ISO 42001 Clause 9 + 10 continual improvement; CAIRO 90-day forward plan (lesson 097). Indirect via continuous-improvement evidence stream.

Penalty exposure is indirect but material. The brief itself does not trigger an Article 99 fine. Briefing quality materially shapes supervisory and litigation disposition when an underlying breach occurs. A regulator investigating an Article 73 late-report who reviews the prior four briefs forms one view if the briefs named the risk on slide 4, framed a decision on slide 5, captured a board-ratified remediation, and tracked closure next quarter, likely applies the low end of Article 99(3) or refrains entirely. The same regulator forms a different view if the briefs buried the risk in appendix page 22, framed no decision, let the issue accumulate, applies the high end of the band, potentially escalating into Article 99(1) deeming criteria. The brief is the difference. The class-action plaintiff reads the briefs with the same logic. Quality materially affects every downstream supervisory and litigation outcome.

Key Takeaways

• The 6-slide standard is the 2026 board AI subcommittee briefing form. Time-boxed at 22 minutes, distributed as 2/4/4/3/5/3+1 minutes across six slides; complementary to but distinct from the lesson 087 twelve-KRI dashboard (data), the brief is the narrative wrapper. The standard exists because the cognitive ceiling for board absorption in the quarterly window is six slides with three decisions and one emerging concern; more breaks time-box, less sacrifices the four mandatory tiers (trajectory, posture, money, decisions).
• Slide-by-slide structure is constant quarter-on-quarter. Slide 1 headline / trajectory; slide 2 heat-map (lesson 085); slide 3 FAIR ALE + reserve sufficiency (lesson 086); slide 4 compliance posture; slide 5 three decisions framed approve / defer / no-go; slide 6 emerging concern + Q+1 priorities. Constancy enables pattern recognition, by Q4 the board reads slide 3 in nine seconds and notices reserve ratio drift without the CAIRO speaking.
• Four-element construction discipline per slide. One headline number, one chart, three bullets, one ask (explicit or implicit). No more than five data points per slide. Discipline enforced at AIGC review T-10d. Without the discipline the slide becomes a register printout (briefing failure 6) and the board absorbs nothing.
• 3-week preparation cadence from data freeze to delivery. T-21d data freeze; T-14d slide draft v1; T-10d AIGC review; T-7d chair pre-read; T-3d dry-run with proxy board; T-1d locked PDF; T delivery. The dry-run is the load-bearing gate, if the CAIRO cannot complete 22 minutes in 22 minutes with 15 anticipated questions answered from slide-visible material in under 90 seconds each, the brief is re-cut.
• Co-presentation CAIRO + CAIO with audit chair attending. CAIRO presents slides 1-4 and 6 (risk frame); CAIO presents slide 5 (decisions / value frame); audit-committee chair attends and asks. Two voices in the room is the structural defense against single-executive capture; audit-chair attendance makes the audit-committee handover a 30-second confirmation rather than a re-presentation.
• Board AI literacy (lesson 035) is the precondition. The 6-slide standard assumes the board has done the Article 4 literacy program. Without it, slides 2-4 require translation in real-time; education burns the 22-minute window; decisions on slide 5 do not get made. A CAIRO inheriting a board without literacy must run the lesson 035 90-minute briefing as a one-time foundation session before the 6-slide standard is viable.
• Seven failure patterns rejection criteria. (1) 60-slide deck; (2) different visuals each quarter; (3) no decision asks; (4) hiding bad news in appendix; (5) over-quantifying without narrative; (6) under-quantifying with no anchored data; (7) skipping the 4-quarter trend. AIGC at T-10d applies the rejection criteria; General Counsel at T-3d applies the discovery test (subpoena read-aloud).
• Penalty exposure is indirect but material. The brief itself does not trigger Article 99. Briefing quality materially affects supervisory and litigation disposition when an underlying breach occurs: a regulator reading four quarters of clean briefs with named risks, framed decisions, board-ratified remediations, and tracked closures forms a different view than one reading buried bad news. The brief is the artifact a regulator requests first, a class-action plaintiff subpoenas first, and a Conformity Assessment Body reviews first. Quality matters.
• Acme Q2 2026 worked brief produces three decisions in 19 of 22 minutes. €1.2M vendor diversification budget approved; €450K notified-body engagement on healthcare adjacency approved; Q3 healthcare-adjacency strategic deep-dive deferred to Q3 with full agenda. Audit-committee handover at 14:25 a 30-second confirmation; SEC Item 105 / 303 / 407 disclosure binder updated from slide 3 + 4 verbatim. The chair signs the minutes; the CRO predecessor's sixty-slide ghost is laid to rest; the 22-minute window has produced the maximum yield the board AI subcommittee can extract.