AI oversight at board level

Board oversight of AI means four concrete things: knowing which AI systems the organization runs, knowing who owns each one, seeing risk assessed with evidence rather than asserted, and holding a budget and policy set that match the exposure. A board that cannot answer those four questions does not yet have oversight of AI, regardless of how often AI appears on the agenda.

Board oversight of AI is a governance discipline rather than a technical one. The established failure mode, familiar from other risk domains, is that the board receives assurance rather than evidence and discovers the difference only after an incident.

Why this reaches the board at all

Three things move AI from an operational matter to a board one.

• It creates liability the organization cannot delegate. Under the EU AI Act, a company that uses a bought-in AI system under its own authority is a deployer, with obligations of its own. A vendor can share the work but cannot take the accountability. The same is true of discrimination, privacy and consumer protection law in Canada and the US: "the model did it" is not a defence.
• It crosses functions. AI sits across IT, security, privacy, legal, risk and the business lines that actually deploy it, which means nobody below the board owns the whole of it.
• It is frequently adopted without procurement. Exposure accumulates through embedded features in existing software and staff use of public tools, without a decision anyone remembers making.

Disclosure data reflects this. The Conference Board found that the share of S&P 500 companies disclosing AI as a material risk jumped from 12% in 2023 to 83% in 2025. In the same research, only 23% of surveyed executives described their board as highly fluent in AI (The Conference Board, April 2026). Risk disclosure has moved faster than oversight capability.

Director duties: the legal floor

Existing director duties apply to AI without any AI-specific statute.

• United States: Caremark. Under Delaware's In re Caremark line of cases, directors breach the duty of loyalty if they make no good-faith effort to put a reporting system in place, or consciously ignore red flags it produces. Marchand v. Barnhill (Del. 2019) held that the board must oversee risks that are "mission critical" to the business. In re Boeing (Del. Ch. 2021) let a claim proceed where the board had no committee or routine reporting on airplane safety. Where AI drives revenue, pricing or safety, a board with no AI reporting line matches the fact pattern in these cases. In re McDonald's (Del. Ch. 2023) extended a similar oversight duty to officers.
• Canada: fiduciary duty and duty of care. Section 122 of the Canada Business Corporations Act requires directors to act honestly and in good faith with a view to the best interests of the corporation, and with the care, diligence and skill of a reasonably prudent person. BCE Inc. v. 1976 Debentureholders (SCC 2008) confirms that the best interests of the corporation include the interests of stakeholders affected by its decisions. An AI system that harms customers at scale engages both.
• Regulated sectors. In federally regulated Canadian financial institutions, OSFI Guideline E-23 (effective 1 May 2027; not yet in effect as of October 2026) requires senior management to report model risk, explicitly including AI/ML, to the board. Québec's AMF AI guideline (in force 1 May 2027) goes further and expects the board's collective competence to be sufficient to understand AI risk. See AI risk in financial services.

Disclosure, AI-washing and what investors now expect

Securities regulators treat AI claims like any other material statement.

• AI-washing enforcement. The SEC's first cases settled in March 2024 against investment advisers Delphia and Global Predictions, for $225,000 and $175,000, for claiming AI capabilities they did not have (SEC). In January 2025 the SEC brought its first AI-washing case against a public company, Presto Automation. In April 2025 the SEC and DOJ charged the founder of Nate with raising over US$42 million on false claims that its app was AI-driven. In February 2025 the SEC created a Cyber and Emerging Technologies Unit to pursue this kind of fraud.
• Canadian securities law. CSA Staff Notice and Consultation 11-348 (December 2024) applies existing securities law to AI. It warns issuers against overstating or understating AI use, and expects disclosure of material AI risks and of how AI is governed.
• What proxy disclosure now shows. In the 2026 proxy season, 37% of S&P 500 companies cited AI experience for at least one director, up from 11% in 2022. Only 5% of individual directors were so described. 17% of S&P 500 boards now have a technology committee (EY Center for Board Matters, 2026). EY also notes that investors now use AI tools to read filings: "there is no hiding in the footnotes anymore."

The board approves the risk factors and the description of its own oversight. Where the proxy states that the audit committee oversees AI, the committee's minutes are the supporting evidence.

Role clarity, and why it stalls

The board's first job is deciding who is accountable for what — across management, IT, security, privacy, legal, audit and enterprise risk. Although procedural, it is the point at which AI programs commonly stall.

The positions typically conflict. Security seeks a gate. The business seeks speed. Legal seeks a position nobody has yet written. Data science treats governance as friction. While ownership is contested, two things happen at once: nothing is formally approved, and teams deploy anyway. The result is unowned AI.

The board is positioned to resolve it because it sits above all the parties. Clear allocation of accountability is the precondition for moving quickly with a defensible position. For the operating model below the board, see AI accountability.

Where AI sits in the committee structure

There is no single right answer, but there must be an answer, written into a charter.

• Full board owns AI strategy and risk appetite, including what the organization will not do with AI. See AI strategy.
• Audit (or risk) committee usually owns AI risk reporting, control assurance and the accuracy of AI-related disclosure. EY reports that most S&P 500 boards have expanded an existing committee, usually audit, rather than creating a new one.
• Technology committee, where one exists, owns AI architecture, security and third-party model dependencies.
• Human resources or compensation committee owns AI in hiring, performance management and workforce change, which is where discrimination litigation is concentrating.
• Governance or nominating committee owns board AI fluency: director education, skills matrix and the use of external advisers.

Whatever the split, write down who receives the AI reporting pack, and make sure one committee is not assuming another has it.

What the board should receive

AI board papers often describe activity — pilots launched, training delivered, tools evaluated — rather than exposure. Activity is not oversight. A useful pack contains:

• The inventory, with movement. How many AI systems are in use, how many are new since the last meeting, how many were retired. A count that never changes means nobody is maintaining it.
• Named owners. Not departments — people. Any system without one is the finding.
• Systems by risk tier, and specifically how many fall into a high-risk category under regulation that applies to the organization. For EU exposure, that means Annex III uses such as employment, credit and insurance.
• Assessment coverage. What proportion of systems have a completed risk assessment and, where required, an impact assessment. Coverage gaps matter more than the findings inside completed ones.
• Third-party exposure. How many systems depend on a model the organization did not train and cannot inspect. This is usually the largest and least-understood category.
• Incidents and near misses, including the ones caught before harm. Zero incidents reported over a long period indicates a reporting problem, not a safety record.
• Open items with owners and dates. Risk accepted rather than treated should be explicitly recorded as accepted, by name.
• Regulatory horizon. Deadlines that change obligations. As of October 2026: EU AI Act Article 50 transparency has applied since 2 August 2026, machine-readable marking for generative systems already on the market is due 2 December 2026, Annex III high-risk obligations apply from 2 December 2027, and sector rules such as OSFI E-23 take effect 1 May 2027.

Most of these are counts rather than narratives. Counts are checkable, move between meetings, and are hard to write around, which makes them useful for oversight.

Questions worth asking

• How many AI systems do we run, and how confident are we in that number?
• Which of them make or materially influence decisions about people — hiring, credit, pricing, access to a service?
• Who personally owns our highest-risk system, and when did they last review it?
• Which systems depend on a third-party model, and what happens if that provider changes or withdraws it?
• If a regulator asked for the documentation on one system tomorrow, could we produce it — and how long would it take?
• Does every public statement we make about AI match what our systems actually do?
• Are any of our AI uses deployer obligations under the EU AI Act, and who is tracking the 2026–2028 deadlines?
• What have we decided not to do with AI, and is that written down anywhere?

Budget, policy and oversight

Budgeting for AI risk is difficult because both the technology and the risk move faster than a planning cycle. A workable approach is to let assessment drive the number: use risk assessments and audit findings as the evidence base, rather than setting a figure and discovering later what it bought.

On policy, an AI acceptable use policy is the floor, not the ceiling: which tools are permitted, what data may go into them, who approves exceptions. Above it sit the questions that reach the board directly: data residency, consent for training use, transparency to customers, and sector rules that constrain where and how systems may operate.

Oversight also requires something management cannot supply: independent review. Regular reporting from the team running AI tells the board how that team sees its own work. Periodic assessment by qualified reviewers outside that line, usually internal audit or an external assessor, is what makes the reporting testable. See AI audit and what IT auditors should know about it.

What the EU AI Act asks of a deployer's board

The Act places duties on organizations, not on directors personally, but the board should be able to see each one being met. For deployers of high-risk systems, Article 26 requires:

• use in line with the provider's instructions, with technical and organizational measures to make that so;
• human oversight assigned to people with the competence, training, authority and support to exercise it;
• relevant and representative input data, where the deployer controls it;
• monitoring and reporting, including suspending use and informing the provider and authorities of serious incidents;
• log retention for at least six months;
• informing workers before a high-risk system is used in the workplace, and informing affected people where decisions about them are made or assisted by such systems.

Public bodies, private providers of public services, and deployers using AI for credit scoring or life and health insurance pricing must also run a fundamental rights impact assessment (Article 27) before first use.

Timing after the Digital Omnibus on AI (Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026, in force 27 July 2026):

Obligation	Applies from	Status (October 2026)
Prohibited practices; AI literacy (Art. 4, now a duty to "take measures")	2 February 2025	Applies
General-purpose AI model obligations	2 August 2025	Applies
Article 50 transparency (chatbots, deepfakes)	2 August 2026	Applies
Machine-readable marking for generative systems already on the market	2 December 2026	Upcoming
Annex III high-risk (employment, credit, insurance, education and others)	2 December 2027	Upcoming (deferred by the Omnibus)
Annex I high-risk (AI in regulated products)	2 August 2028	Upcoming (deferred by the Omnibus)

Sources: Council press release, 29 June 2026; Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744. The Omnibus also added prohibitions on AI "nudifier" applications and AI-generated child sexual abuse material.

Frameworks and guidance the board can anchor to

Boards do not need to choose a framework, but they should know which one management is working to and be able to ask against it.

• NIST AI RMF is the usual starting structure. Its Govern function maps closely onto board responsibility: inventory, ownership, review cadence, executive accountability.
• ISO/IEC 42001 matters when customers or regulators want a certificate rather than an assertion.
• ISO/IEC 38507:2022 is the standard written for the governing body itself. It covers the governance implications of an organization's use of AI, and is the most direct standards reference for board-level questions.
• The EU AI Act matters where it applies, because it is the only one of these with statutory penalties: up to €35 million or 7% of worldwide turnover for prohibited practices.

Director bodies have also published practical guidance:

• NACD (US) maintains an AI oversight resource centre, including an AI discussion guide in its 2026 Director's Handbook on Cyber-Risk Oversight and an "Effective AI Oversight" certificate program.
• The Institute of Directors (UK) publishes AI Governance in the Boardroom, built on 12 principles. Examples include monitoring the regulatory environment, board accountability, impact assessments, an independent cross-functional review committee, and regular review of systems and policies.
• The Institute of Corporate Directors (Canada) has made AI oversight a recurring theme of its director education, for example its 2026 session on AI governance and board oversight.
• The AICD (Australia) released version 2 of A Director's Guide to AI Governance in June 2026, with an SME and not-for-profit checklist, and serves as a comparative benchmark for Canadian boards.

A comparison of the main frameworks is in AI security frameworks compared; for selection guidance see choosing an AI security framework.

Related references

Sources and references

• Regulation (EU) 2024/1689 (AI Act): https://eur-lex.europa.eu/eli/reg/2024/1689/oj
• Regulation (EU) 2026/1744 (Digital Omnibus on AI), published in the Official Journal 24 July 2026, in force 27 July 2026
• Council of the EU, Digital Omnibus on AI final adoption (29 June 2026): https://www.consilium.europa.eu/en/press/press-releases/2026/06/29/artificial-intelligence-council-gives-final-green-light-to-simplify-and-streamline-rules/
• The Conference Board, Governing AI (22 April 2026): https://www.conference-board.org/press/governing-AI-2026
• EY Center for Board Matters, 2026 proxy season review: https://www.ey.com/en_us/board-matters/proxy-season-review-2026
• SEC, Delphia and Global Predictions AI-washing settlements (18 March 2024): https://www.sec.gov/news/press-release/2024-36
• OSFI Guideline E-23, Model Risk Management (2027): https://www.osfi-bsif.gc.ca/en/guidance/guidance-library/guideline-e-23-model-risk-management-2027
• ISO/IEC 38507:2022: https://www.iso.org/standard/56641.html
• NACD AI oversight resources: https://www.nacdonline.org/all-governance/governance-resources/trending-oversight-topics/artificial-intelligence/
• AICD, A Director's Guide to AI Governance v2 (29 June 2026): https://www.aicd.com.au/news-media/research-and-reports/a-directors-guide-to-ai-governance.html
• ICD, AI Governance and Board Oversight (January 2026): https://www.icd.ca/en/events/events-calendar/2026/ai-governance-and-board-oversight-risks-responsibilities-and-readiness