Many boards believe they’re governing AI risk because they review policies and receive quarterly reports filled with charts and maturity scores.