Discussing AI Is Not the Same as Governing It

AI has moved from innovation briefing to board-level responsibility, affecting strategy, risk, disclosure and enterprise value at the same time. This episode examines why directors must shift from discussing AI to actively governing it as regulatory, investor and value pressures converge. 

It explores the practical tests boards can use to assess real AI oversight.

TLDR / At a Glance

• Board ownership of AI
 • Strategy, risk and disclosure alignment
 • EU AI Act readiness
 • Ownership, visibility and assurance
 • Investor expectations on AI governance
 • Value creation through disciplined oversight

The key takeaway is clear: AI governance is now central to board accountability, confidence and durable business value.

Transcript

Briefing AI Versus Governing AI

SPEAKER_00 0:00

Discussing AI is not the same as governing it. On many boards, AI still arrives the way a new product launch does, as an innovation briefing, delivered by management, received with interest, and filed under things to watch. That posture made sense when AI was a promising tool on the edge of the business. It makes far less sense now that AI shapes strategy, capital allocation, risk appetite, disclosure, and enterprise value at the same time, and now that a hard regulatory deadline is approaching rather than receding. This article argues that putting AI on the agenda is not the same as governing it, and that the distinction is about to matter more than it has before. It sets out why AI has become a question of board ownership rather than a technology topic, where boards are still behind and what a credible board can do before the next deadline to move from discussing AI to actually overseeing it. When AI is briefed, not governed. The reason the briefing posture persists is understandable. AI feels technical, it moves quickly, and most directors did not build their careers on it, so it is tempting to treat it as something management handles and the board notes. The cost of that posture is quiet but real. The board hears about AI without ever taking ownership of it. The readiness data confirms the gap. Deloitte's 2025 board survey found that two-thirds of respondents described their boards as having limited to no knowledge of AI, even as the technology reached further into the business each quarter. A board that does not understand a force, this material cannot challenge management's choices about it, and a board that cannot challenge is not really overseeing. Knowledge is not the whole of governance, but it is the precondition for it.

Why AI Belongs To The Board

SPEAKER_00 1:52

Why AI is now an ownership question? The deeper shift is that AI no longer sits in one box on the risk register. It changes the business model and the cost base, which makes it a strategy question. It touches personal data, bias, intellectual property and safety, which makes it a risk question. It increasingly appears in what companies disclose to investors and regulators, which makes it a governance and accountability question. Few other topics land on so many parts of the board's mandate at once. That breadth is precisely why a technology committee briefing cannot contain it. When a single force affects strategy, value, risk, and disclosure together, ownership has to sit with the full board, with specialist oversight allocated to the relevant committees underneath, whether audit, risk, or technology. Treating AI as a narrow technical update leaves the connective questions without a clear owner, how it changes competitive position, what risk appetite the company will accept, and what it will tell the market. Directors increasingly sense this themselves. Gardner found that 80% of non-executive directors believe their current board practices and structures are inadequate to oversee AI effectively, even though most see it as an opportunity for shareholder value. The instinct that something needs to change is widespread. What is missing is a clear model for what good oversight actually requires. The gap between talking and governing. The encouraging news is that boards are talking about AI far more than they were. The harder news is that talking is being mistaken for governing. Setting aside agenda time, inviting a briefing, and recording a discussion can all happen without the board ever taking a position on how AI changes the company's future. NACD's research captures the gap precisely. More than 62% of directors now set aside agenda time to discuss AI, yet only 23% of boards have assessed how AI disruption could affect their company's strategy. The difference between those two numbers is the difference between attention and ownership. A board can be busy with AI and still hold no view on the question that matters most, which is what it does to the business. The

The Oversight Test Explained

SPEAKER_00 4:20

oversight test. If attention is not the same as ownership, boards need a simple way to tell the two apart. I find it useful to apply what I call the oversight test. For any material use of AI in the business, can the board answer three questions clearly? A use that fails, any one of them is being deployed, but it is not being governed. The first question is ownership. Is there a named executive accountable for AI governance and a clear line from that person to the board so that responsibility does not dissolve across the legal, risk, data, and technology functions? Without a named owner, accountability is everyone's in theory and no one's in practice. The second question is visibility. Does the board have a current inventory of where AI is actually being used, by whom, for which decisions, and at what level of risk? A board cannot oversee what it cannot see, and shadow AI spreading through a business unmapped is one of the clearest signs that visibility has been lost. The third question is assurance. Can someone independent of the people building and using the systems demonstrate that the controls work through testing, monitoring, logging, and review? Assurance is the question boards skip most often because it is the least visible and the most technical, yet it is the one that turns a policy on paper into a control in practice. A board that can answer ownership, visibility, and assurance for its material AI is governing it. A board that cannot is, at best, discussing it.

EU AI Act Deadlines And Fines

SPEAKER_00 5:56

The deadline is closer and costlier than it looks. This would matter even without a regulator setting the clock. As it happens, one is. The majority of the EU AI Act's obligations begin to apply from August 2, 2026, with earlier duties on prohibited uses and AI literacy already live since February 2025, and rules for general purpose models since August 2025. For any company with European exposure, the question is no longer whether to prepare but whether preparation is far enough along. The penalties make this a board level number rather than a compliance footnote. The Act provides for fines of up to €35 million or 7% of worldwide annual turnover for the most serious breaches, with lower but still substantial tiers for transparency and deployer failures. Figures of that scale belong in the boardroom by definition because they bear directly on enterprise value and on the board's duty to oversee material risk. The picture is not static and managing that is part of the task. A 2026 simplification agreement has moved some high risk dates later, but the European Parliament noted in June 2026 that formal adoption was still pending, so the prudent course is to work to the current timetable while tracking the final legislative step. Boards do not need to master the legal text. They do need to ensure management is tracking it and reporting against it.

Governance Turns Spend Into Value

SPEAKER_00 7:31

Governance is part of the value case, not a break on it. It is tempting to frame all of this as a constraint, a set of obligations that slow the business down. The evidence points the other way. The companies struggling most with AI are not the ones held back by governance. They are the ones that deployed without the discipline to turn activity into value. The scale of that struggle is striking. BCG found that only 5% of companies were capturing AI value at scale, while 60% were seeing no material value at all. Governance is what separates the two, a clear view of which use cases create value, which are stalled in pilots, who owns them and whether they can be trusted. Far from being a break, disciplined oversight is how a board ensures that AI spending becomes AI value rather than a collection of efficiency anecdotes.

Investor Pressure And Disclosure Expectations

SPEAKER_00 8:28

Investors are no longer waiting. External pressure is converging with the internal case. Investors have begun to treat board oversight of AI as a disclosure expectation rather than a nice to have, and proxy scrutiny is following. The board that has not formed a clear position risks being asked to explain its absence rather than describe its approach. The expectation is now explicit. Analysis of 2025 proxy statements found that 65% of US investors believe all companies should clearly disclose how their boards oversee AI governance and ethics. That is a direct signal to directors. Oversight is expected to be visible, documented, and defensible, not informal and assumed. A board that can describe its AI ownership, inventory, and assurance is well placed to meet that expectation. A board that cannot will struggle to.

Common AI Governance Warning Signs

SPEAKER_00 9:25

The warning signs are specific. The useful part of all this is that the failure modes are now well understood, which makes them easier to check for. They include AI never reaching the agenda, no inventory of use cases, no agreed risk appetite, no named owner, weak director literacy, no oversight of third party and embedded AI, and unclear measures of value. Any one of these is a signal that AI is running ahead of the board's ability to see it. Some of the sharpest risks are subtle. Lawyers at Scadden have warned that using AI to draft board minutes can create discoverable records of confidential discussions and may discourage the openness that good governance depends on. It is a small example of a larger principle. AI used inside the governance process itself needs the same guardrails the board would demand anywhere else, and arguably more. The broader pattern is that genuine readiness remains rare. The World Economic Forum estimated that fewer than 1% of organizations have fully operationalized, responsible AI in a comprehensive and anticipatory way. The gap between intention and operation is where most governance risk now lives, and closing it is squarely the board's job.

Practical Steps Boards Can Take

SPEAKER_00 10:45

What this means for leaders. The instinct to treat AI as a topic to monitor is no longer enough. With the regulatory clock running, investors watching and value at stake, the board's task is to move from receiving briefings to owning the question. That does not mean directors need to become technologists. It means governing AI the way they govern any other force that touches strategy, risk, and value at once. In practice, that is a short and concrete list. Put a standing AI agenda in place rather than ad hoc updates. Name the accountable executive and the board owner. Commission an enterprise inventory of where AI is actually used. Review director literacy honestly against the company's real exposure, and require management to bring both value metrics and assurance evidence, not one without the other. The oversight test is a useful filter for all of it. Ownership, visibility, assurance. None of this slows the business down. It is what allows a board to back AI with confidence rather than hope, and to tell investors, regulators, and employees that the technology is not just being used, but being governed. The technology creates the possibility. It is the board's management of it that turns that possibility into durable value.

Closing And Where To Read More

SPEAKER_00 12:08

This concludes the article. You can also read this article on my LinkedIn page where I share regular insights on AI, strategy, and emerging technologies.