Why Your Board Needs a Plan for AI Oversight