If your regulator called tomorrow and asked you to describe your AI risk profile, what would you say? Not what management presented last quarter. What you actually know. For most boards, the honest answer is very little. That is a governance gap, not a reporting gap.