Board Questions About Superintelligence and Honest Answers

When a board of directors discusses superintelligence, it usually wants three things answered: whether the technology is available to the company today, what risks it brings, and what leadership needs to decide now. The honest answer is that superintelligence, understood as systems that would outperform people on most intellectual tasks, is not a product you can buy today. Assistants and AI agents that answer customers, summarize documents and fill in forms already exist, and they need their own governance. This article collects the questions board members tend to ask and answers each one by separating what is concrete from what is hypothesis.

Key takeaways

• Superintelligence is a debate topic, not an off-the-shelf product. The board's decision should focus on the AI systems the company uses or plans to use.
• The concrete risks today are data leaks, wrong answers delivered with an air of certainty, improper actions by agents, and dependence on a single supplier.
• Governance works in stages: map the process, limit data and actions, pilot a real workflow with logs, then decide whether to expand, adjust or stop.
• Long-term questions should become a monitoring routine with periodic review, without paralyzing daily operations.
• The most useful question for the board is who is accountable for decisions made with AI support and how each decision is recorded.

Is superintelligence already inside our company?

No, and the distinction matters for the agenda. A language model that writes text or answers questions is a powerful but limited tool. It makes mistakes, depends on the context it receives, and has no goals of its own beyond the task. If you want to separate these concepts more clearly, read Is ChatGPT Superintelligence? What It Is and What It Is Not and Difference Between AGI, ASI and AI Agents: What You Can Run.

In practice, what a company operates today is a set of systems with defined scope: an agent that answers order questions on WhatsApp, a classifier that sorts support requests, an automatic summary of meetings. Each one has known inputs, outputs and failure points. That is the right starting base for the board conversation, because it lets the board ask about a specific system instead of debating a scenario with no boundaries.

Which risks are real today and which are hypotheses?

The most common mistake in board meetings is treating long-term risks as today's emergencies, or the opposite, ignoring present risks because they seem small. It helps to keep the two lists separate.

Concrete risks that already appear in ordinary systems:

• Personal data sent to tools without a legal basis, a clear purpose or an adequate contract.
• Incorrect answers given to customers in a confident tone, with no signal of uncertainty.
• Agents with permission to act (issue a refund, change an order, send a message) without a value limit or human approval.
• Instruction injection, where emails or customer messages try to change how the agent behaves. The OWASP Top 10 for LLM Applications describes these risks in detail.
• Dependence on a single model provider, with no plan to switch models or pause the service.

Long-term hypotheses deserve monitoring, not an immediate decision: deep changes in the labor market, power concentrated in a few providers, and systems capable of exceeding human oversight across broad domains. Governments and researchers debate these questions, but none of them requires the company to change its customer service or billing process today.

How do LGPD and regulation fit into this conversation?

Brazil's LGPD already applies to any AI system that processes personal data of customers, employees or suppliers, regardless of how large the model is. So the board's question should be concrete: which data goes into the system, for what purpose, where it is processed and how long it is kept. The Autoridade Nacional de Proteção de Dados (ANPD) is the institutional reference for following this topic in Brazil.

When an automated decision affects a customer, such as denying a request or routing a service request based on a profile, the company needs a way to explain the criteria and offer human review. This connects to the right to review automated decisions in the LGPD. For the board, the job is to make sure someone is responsible and that a path for contesting decisions exists. It is not to study the text of the law in depth.

On the specific legal framework for AI, the prudent approach is to track the legislative process and assess the impact on the systems the company already runs. A practical summary is in Brazil AI Regulation: What Companies Should Watch and Do Now. For structuring risk management, the NIST AI Risk Management Framework offers a useful, voluntary vocabulary, and the OECD AI Principles reinforce transparency, accountability and human oversight.

What should the board ask management?

A board does not need to understand the technical architecture to ask good questions. A simple decision guide helps turn the discussion into action:

• Which company processes use AI today, and who owns each one?
• Which data do these processes access, and is there a legal basis and a record of it?
• Which actions can the system take without human approval, and what is the limit?
• How is an error detected, recorded and corrected, and how quickly?
• Is there a test that shows the expected behavior before each change?
• If the provider changes models or ends the service, how long can the operation keep running?
• What metric defines that the pilot worked, and who decides whether to expand, adjust or stop?

Vague answers to these questions are the clearest sign that the company is not yet ready to expand its use, regardless of any debate about the future of the technology.

A four-step path out of the abstract debate

The safest way to answer the board is to turn the agenda into a plan with stages and exit criteria. As a working method, we follow four moves: map, limit, pilot and hand over.

• Map: describe the current process, the volume of requests or orders, the most common errors and the baseline before any automation.
• Limit: define which data the system can see, which actions it can execute and in which situations it must pass the case to a person.
• Pilot: choose a real workflow, log every decision and agree on a success metric before starting.
• Hand over: deliver the workflow with documentation, named owners and a formal decision to expand, adjust or close it.

This method does not depend on assumptions about superintelligence. It works equally well for a WhatsApp agent, a triage system or an internal assistant, and it gives the board the evidence it needs to decide. When a company wants to outsource ongoing operation, Be Human is the structure through which managed follow-up is delivered.

Illustrative scenario: an agent that approves purchases on its own

Illustrative scenario: a distributor wants an agent to approve restocking orders. In the board presentation, the proposal looks efficient, but the operations team asks what happens when a supplier sends a quote with a changed delivery date buried in the middle of the text.

The mature answer is neither to reject the project nor to accept everything. The agent can compare quotes and prepare a recommendation, but approval above a defined amount stays with a person. Each recommendation is logged with the data used and the reason for it. The pilot starts with one product category only, with a weekly review of errors. If the board wants to expand, the decision comes with the pilot's history, not with expectations.

This example shows how the board's question shifts from 'Is superintelligence dangerous?' to 'Which decisions can this system make alone, and who answers for them?'

Frequently asked questions

Should the board approve a specific plan on superintelligence? No. The practical recommendation is to approve an AI use policy that covers the systems in operation and those under evaluation. The policy sets owners, permitted data, actions that require human approval and the review routine. If news about more capable systems emerges, the policy already has a mechanism to assess it without reopening the whole discussion. A related example of what such a policy covers is Company Policy for Employee ChatGPT Use: What to Allow and Ban.

Is superintelligence an immediate threat to our business? For most companies, the immediate risk is not that. It is the disorganized use of current tools, with sensitive data, unreviewed answers and excessive permissions. Debate about long-term risks is legitimate and can be followed through reading and monitoring, but it should not replace managing what is already running. Myths on this topic and how they distort decisions are covered in Superintelligence Myths for Business Leaders.

How do we answer the board without promising results? A safe answer describes what will be done, what the success criteria are and which limits will be respected. Avoid projections of gains or timelines that cannot be verified. A pilot with a decision log and an agreed metric lets the board decide on evidence rather than on vendor promises.

What is the first step if the company does not yet use AI in an organized way? The first step is a simple inventory: list where team members already use AI tools, with which data and for which tasks. From that survey, leadership chooses a high-volume, low-risk process to map and pilot, and only then defines the use policy. Starting with what already happens in operations is usually more useful than starting with a debate about the future.

Sources

• NIST AI Risk Management Framework
• OECD AI Principles
• OWASP Top 10 for LLM Applications