Board Advisory
Boards are being asked to oversee technology they did not choose and cannot easily see into. AI is entering the business faster than policy can follow, cyber exposure grows with every new system and partner, and regulators, auditors and investors now expect directors to have a view on both. Ahmadeus gives boards and executive teams that view: an independent judgment on where the company actually stands, from a firm that also designs, builds and operates the systems it advises on.
What boards retain us for
Deciding how far and how fast to adopt AI, and what has to be in place before they do.
Protecting the information the business depends on, from customer and patient data to client confidences and proprietary know-how.
Understanding cyber exposure in terms a board can act on, not a technical report.
Oversight of third-party technology, outside vendors and the AI models the company relies on.
Technology diligence before an acquisition, and risk across a portfolio after it.
Preparing for the questions regulators, examiners and auditors are now asking about AI and cyber.
How engagements are structured
Board briefing. A closed session with the board or a committee on where the company stands and the decisions in front of it.
Independent assessment. A scoped review of AI use, cyber posture and data exposure, ending in a prioritized view the board can act on and defend.
Standing advisor. A continuing relationship with the board, audit or risk committee, or executive team as the business changes.
Transaction support. Technology diligence for acquirers and private equity sponsors, and oversight after closing.
Where an assessment leads to work that needs doing, the same firm can design, build and run it. Ahmadeus holds no equity, reseller or compensation arrangement with any technology vendor whose systems it evaluates.
The rise of risk
Every company we advise is in the middle of a digital transformation. AI is moving into how work gets done, and with it comes pressure to feed it the company's most valuable information: customer records, client confidences, proprietary data, the know-how that sets the business apart. Each step makes the company more capable and more exposed at once. We call this the rise of risk. Its signature is that exposure grows faster than the board's view of it. In every engagement below, the question came down to the same balance: how to move forward with AI without losing control of the information the business depends on.
Selected engagements
Client names are kept confidential.
Healthcare company with more than $1 billion in revenue. The company wanted AI working across its operations, but the data that made AI useful was the data it could least afford to lose: patient records protected by federal law, and operational information built up over years. A single breach would reach patients, regulators and partners at once. We gave the executive team an independent assessment of where AI could be put to work safely and where the exposure was real, which issues belonged in front of the board, and what had to be addressed first. Leadership came away with one prioritized view of cyber and AI risk they could act on and defend.
Regional bank with several billion dollars in assets. The bank was modernizing through outside technology: more vendors, more models, more digital channels, each touching customer financial data and the internal models and methods behind its lending and risk decisions. In a bank, an AI or cyber failure never stays operational; it becomes a matter for examiners and for the board. We advised directors and senior management on where AI could create value without putting customer information or proprietary models beyond the bank's control, including dependence on outside vendors and models, and on the oversight the board needed to exercise and document to meet supervisory expectations.
Insurance company. An insurer's advantage lives in its data: policyholder personal and health information, claims history, and the pricing and underwriting models that are its real competitive edge. AI promised faster underwriting and claims handling, but every use meant exposing that data to new systems, and regulators were asking directly whether the resulting decisions were fair and explainable. We advised leadership on governing AI in those decisions while keeping policyholder data and proprietary models protected, and on the cyber exposure that came with modernizing its systems.
Private equity firm. The firm's value-creation plans increasingly depended on technology, from digitizing portfolio operations to putting AI into newly acquired companies. Its own most sensitive information, deal data, confidential diligence material and investor records, sat alongside the proprietary data of every company it owned. We advised the partners on technology risk across the portfolio: what to examine in diligence before closing, where existing holdings were exposed, and how portfolio companies could adopt AI without putting their proprietary information, or the firm's, at risk. The result was a consistent standard the firm could apply from acquisition to exit.
Law firm. Lawyers across the firm had started using AI tools before the firm had decided how to govern them. For a law firm the sensitive information is the client's: confidential matters, privileged communications and the strategy behind them, where one careless use can breach a duty the firm cannot undo. We advised leadership at the level of the partnership: which uses to permit, where AI came into contact with client confidential and privileged information, what professional rules required of supervising lawyers, and how the firm would show clients its confidences were safe.