What boards should demand from AI: assessment, audit, and assurance