Author: IRPA AI Senior Analyst, Kieran Gilmurray
On many boards, AI still arrives the way a new product launch does: as an innovation briefing, delivered by management, received with interest, and filed under things to watch. That posture made sense when AI was a promising tool on the edge of the business. It makes far less sense now that AI shapes strategy, capital allocation, risk appetite, disclosure and enterprise value at the same time, and now that a hard regulatory deadline is approaching rather than receding.
This article argues that putting AI on the agenda is not the same as governing it, and that the distinction is about to matter more than it has before. It sets out why AI has become a question of board ownership rather than a technology topic, where boards are still behind, and what a credible board can do before the next deadline to move from discussing AI to actually overseeing it.
When AI is briefed, not governed
The reason the briefing posture persists is understandable. AI feels technical, it moves quickly, and most directors did not build their careers on it, so it is tempting to treat it as something management handles and the board notes. The cost of that posture is quiet but real: the board hears about AI without ever taking ownership of it.
The readiness data confirms the gap. Deloitte’s 2025 board survey found that two thirds of respondents described their boards as having limited to no knowledge of AI, even as the technology reached further into the business each quarter. A board that does not understand a force this material cannot challenge management’s choices about it, and a board that cannot challenge is not really overseeing. Knowledge is not the whole of governance, but it is the precondition for it.
Why AI is now an ownership question
The deeper shift is that AI no longer sits in one box on the risk register. It changes the business model and the cost base, which makes it a strategy question. It touches personal data, bias, intellectual property and safety, which makes it a risk question. It increasingly appears in what companies disclose to investors and regulators, which makes it a governance and accountability question. Few other topics land on so many parts of the board’s mandate at once.
That breadth is precisely why a technology-committee briefing cannot contain it. When a single force affects strategy, value, risk and disclosure together, ownership has to sit with the full board, with specialist oversight allocated to the relevant committees underneath, whether audit, risk or technology. Treating AI as a narrow technical update leaves the connective questions without a clear owner: how it changes competitive position, what risk appetite the company will accept, and what it will tell the market.
Directors increasingly sense this themselves. Gartner found that 80% of non-executive directors believe their current board practices and structures are inadequate to oversee AI effectively, even though most see it as an opportunity for shareholder value. The instinct that something needs to change is widespread. What is missing is a clear model for what good oversight actually requires.
The gap between talking and governing
The encouraging news is that boards are talking about AI far more than they were. The harder news is that talking is being mistaken for governing. Setting aside agenda time, inviting a briefing and recording a discussion can all happen without the board ever taking a position on how AI changes the company’s future.
NACD’s research captures the gap precisely. More than 62% of directors now set aside agenda time to discuss AI, yet only 23% of boards have assessed how AI disruption could affect their company’s strategy. The difference between those two numbers is the difference between attention and ownership. A board can be busy with AI and still hold no view on the question that matters most, which is what it does to the business.
The Oversight Test
If attention is not the same as ownership, boards need a simple way to tell the two apart. I find it useful to apply what I call the Oversight Test: for any material use of AI in the business, can the board answer three questions clearly? A use that fails any one of them is being deployed, but it is not being governed.
The first question is ownership. Is there a named executive accountable for AI governance, and a clear line from that person to the board, so that responsibility does not dissolve across the legal, risk, data and technology functions? Without a named owner, accountability is everyone’s in theory and no one’s in practice.
The second question is visibility. Does the board have a current inventory of where AI is actually being used, by whom, for which decisions, and at what level of risk? A board cannot oversee what it cannot see, and shadow AI spreading through a business unmapped is one of the clearest signs that visibility has been lost.
The third question is assurance. Can someone independent of the people building and using the systems demonstrate that the controls work, through testing, monitoring, logging and review. Assurance is the question boards skip most often, because it is the least visible and the most technical, yet it is the one that turns a policy on paper into a control in practice. A board that can answer ownership, visibility and assurance for its material AI is governing it. A board that cannot is, at best, discussing it.
The deadline is closer and costlier than it looks
This would matter even without a regulator setting the clock. As it happens, one is. The majority of the EU AI Act’s obligations begin to apply from 2 August 2026, with earlier duties on prohibited uses and AI literacy already live since February 2025 and rules for general-purpose models since August 2025. For any company with European exposure, the question is no longer whether to prepare but whether preparation is far enough along.
The penalties make this a board-level number rather than a compliance footnote. The Act provides for fines of up to €35 million or 7% of worldwide annual turnover for the most serious breaches, with lower but still substantial tiers for transparency and deployer failures. Figures of that scale belong in the boardroom by definition, because they bear directly on enterprise value and on the board’s duty to oversee material risk.
The picture is not static, and managing that is part of the task. A 2026 simplification agreement has moved some high-risk dates later, but the European Parliament noted in June 2026 that formal adoption was still pending, so the prudent course is to work to the current timetable while tracking the final legislative step. Boards do not need to master the legal text. They do need to ensure management is tracking it and reporting against it.
Governance is part of the value case, not a brake on it
It is tempting to frame all of this as a constraint, a set of obligations that slow the business down. The evidence points the other way. The companies struggling most with AI are not the ones held back by governance, they are the ones that deployed without the discipline to turn activity into value.
The scale of that struggle is striking. BCG found that only 5% of companies were capturing AI value at scale, while 60% were seeing no material value at all. Governance is what separates the two: a clear view of which use cases create value, which are stalled in pilots, who owns them and whether they can be trusted. Far from being a brake, disciplined oversight is how a board ensures that AI spending becomes AI value rather than a collection of efficiency anecdotes.
Investors are no longer waiting
External pressure is converging with the internal case. Investors have begun to treat board oversight of AI as a disclosure expectation rather than a nice-to-have, and proxy scrutiny is following. The board that has not formed a clear position risks being asked to explain its absence rather than describe its approach.
The expectation is now explicit. Analysis of 2025 proxy statements found that 65% of US investors believe all companies should clearly disclose how their boards oversee AI governance and ethics. That is a direct signal to directors: oversight is expected to be visible, documented and defensible, not informal and assumed. A board that can describe its AI ownership, inventory and assurance is well placed to meet that expectation. A board that cannot will struggle to.
The warning signs are specific
The useful part of all this is that the failure modes are now well understood, which makes them easier to check for. They include AI never reaching the agenda, no inventory of use cases, no agreed risk appetite, no named owner, weak director literacy, no oversight of third-party and embedded AI, and unclear measures of value. Any one of these is a signal that AI is running ahead of the board’s ability to see it.
Some of the sharpest risks are subtle. Lawyers at Skadden have warned that using AI to draft board minutes can create discoverable records of confidential discussions and may discourage the openness that good governance depends on. It is a small example of a larger principle: AI used inside the governance process itself needs the same guardrails the board would demand anywhere else, and arguably more.
The broader pattern is that genuine readiness remains rare. The World Economic Forum estimated that fewer than 1% of organisations have fully operationalised responsible AI in a comprehensive and anticipatory way. The gap between intention and operation is where most governance risk now lives, and closing it is squarely the board’s job.
What This Means for Leaders
The instinct to treat AI as a topic to monitor is no longer enough. With the regulatory clock running, investors watching and value at stake, the board’s task is to move from receiving briefings to owning the question. That does not mean directors need to become technologists. It means governing AI the way they govern any other force that touches strategy, risk and value at once.
In practice, that is a short and concrete list. Put a standing AI agenda in place rather than ad hoc updates. Name the accountable executive and the board owner. Commission an enterprise inventory of where AI is actually used. Review director literacy honestly against the company’s real exposure. And require management to bring both value metrics and assurance evidence, not one without the other. The Oversight Test is a useful filter for all of it: ownership, visibility, assurance.
None of this slows the business down. It is what allows a board to back AI with confidence rather than hope, and to tell investors, regulators and employees that the technology is not just being used but being governed. The technology creates the possibility. It is the board’s management of it that turns that possibility into durable value.
About the Author: Kieran Gilmurray
Kieran is a globally recognized authority on AI, automation, and digital transformation, having authored multiple influential books and hundreds of articles that have earned him prestigious accolades, including being named a Top 50 Global Thought Leader and Influencer on Generative AI in 2024, a Best LinkedIn Influencer for AI and Marketing, Top 50 Global Thought Leaders and Influencers on Manufacturing 2024, Top 14 people to follow in data and one of the World’s Top 200 Business and Technology Innovators.
CLICK HERE TO SCHEDULE AN ANALYST CHAT
Links:
Originally posted on 2026-07-06 in the IRPA AI Network — Announcements & Updates