Board oversight & reporting

What the board is shown, how often, and whether it can tell a working system from a demo.

76documents on this topic
33organizations represented
8issues named
26sourced citations
22sourced statistics

The state of it

One of 7 topics within Governance & oversight.

Board oversight of AI is the most heavily addressed subject in this research: 222 of 268 documents engage with governance and oversight, and 76 documents from 33 organizations address what the board specifically sees and decides. That volume is not matched by agreement.

Reading them together, the material problem is not that boards lack frameworks. There are many, and they broadly concur: name an accountable owner, put AI on the agenda, build director literacy, audit what is deployed. The problem is that almost every framework assumes a board that can tell whether its own oversight is working, and the evidence suggests that assumption fails. Directors rate their AI literacy as adequate while the executives presenting to them do not; boards receive demonstrations rather than measured outcomes; and the single most basic input - a list of what AI the organization actually runs - is missing in most cases.

The strongest evidence in the set is BCG's Split Decisions survey, because it is the only one that asks both sides the same question. Its finding, that three-quarters of directors rate their AI understanding at or above their peers while roughly four in ten CEOs say their board lacks an informed view, is what makes the other seven issues durable: a board that believes it is already informed does not commission the fix.

The issues, by agreement

How many independent organizations name each issue as a problem. An issue is only as real as the number of separate publishers that identify it, so the count is the ranking. Bars are organizations, not documents. Where the count reads ours, no publisher here states the issue and the analysis is our own.

names it as a problemdisputes itqualifies it
Directors rate their own AI literacy as adequate; the executives reporting to them do not agree
5
Nobody has enumerated the AI the organization is already running
2
AI reaches the board when something happens, not on a fixed cadence
2
The board is shown demonstrations and cannot tell which systems are actually working
1
The board and the CEO disagree about the pace, and the disagreement is not on the agenda
1
What the board is told about AI comes only from the people who own the outcome
1
Oversight is added to an existing committee or role without changing its mandate
ours
There is no agreed threshold at which an AI failure reaches the board
ours

Who takes which position

The chart above counts positions; this shows whose they are. Read down a column for what one organization holds across the whole topic, and across a row for who lines up on one issue. Where a cell carries more than one position, the strongest is shown and the rest are in the tooltip.

Ddisputes it Qqualifies it Nnames it as a problem Pproposes a fix
Board oversight & reporting: 8 issues against the 12 organizations cited on them. The number under each name is how many of these issues it is cited on.
Issue Deloitte · 4 KPMG · 4 Boston Consulting Group · 3 UC Berkeley · 3 Infosys · 2 Anthropic · 1 EY · 1 Institute of Directors · 1 OpenAI · 1 Palantir · 1 PwC Malaysia · 1 Stanford Hoover Institution · 1
Directors rate their own AI literacy as adequate; the executives reporting to them do not agree N · N N · · N · · · N ·
Nobody has enumerated the AI the organization is already running · P · · · N · N · P · ·
AI reaches the board when something happens, not on a fixed cadence N · · N D · · · · · · ·
The board is shown demonstrations and cannot tell which systems are actually working · P N · · · · · P · · ·
The board and the CEO disagree about the pace, and the disagreement is not on the agenda · · N · · · · · · · · ·
What the board is told about AI comes only from the people who own the outcome P · · · N · · · · · · Q
Oversight is added to an existing committee or role without changing its mandate P P · P · · · · · · · ·
There is no agreed threshold at which an AI failure reaches the board · P · · · · · · · · · ·

A dot means this organization is not cited on that issue. It does not mean they are silent on it: an organization is cited where its document takes a position we could locate, and the absence of a citation is the absence of a finding, not a finding of absence. Who is represented lists everyone working on this topic, including those not cited above.

Where they disagree

Points where the research contradicts itself. These are the entries worth the most attention, because no single document reveals them - they only appear when the sources are read against each other.

AI reaches the board when something happens, not on a fixed cadence

AI appears on the agenda episodically - after a launch, an incident or a headline - which makes oversight reactive by construction.

The majority position

Deloitte — 31% say AI is not on the board agenda (down from 45% in the prior edition); 17% address it at every meeting; 19% take it up only once per year.

The dissent

Infosys — Puts 86% of boards taking AI as a scheduled agenda item - 72% at regularly scheduled meetings and 14% at every meeting - against 14% who take it only ad hoc, from 300 directors at North American companies above $1bn revenue.

Also naming it: UC Berkeley.

The issues in full

Each issue carries the organizations that name it, the numbers behind it, and the remedies proposed - with the concrete steps under each. Every citation points at a section of a named document, so any count here can be checked.

Issue 015 organizations name it2026 evidence

Directors rate their own AI literacy as adequate; the executives reporting to them do not agree

Boards assess their own AI understanding as on par with their peers, while the CEOs presenting to them say directors cannot separate hype from reality. Because the gap is invisible from inside the boardroom, nothing triggers a fix.

This is the issue that makes the others hard to solve. A board that believes it is informed does not commission training, does not recruit for the skill, and reads a management presentation as confirmation rather than as a claim to be tested. The gap shows up in the only place both sides were asked the same question: BCG surveyed 351 CEOs and 274 board members and found three-quarters of directors rating their AI knowledge at or above their peers, against roughly four in ten CEOs saying their board lacks an informed view of how AI is reshaping growth strategy.

79%Boards with limited to no AI knowledge, prior editionDeloitte · Apr 2024
66%Boards with "limited to no knowledge or experience" of AIDeloitte · Apr 2025
18%Boards agreeing they are well-informed on GenAIPwC Malaysia · Aug 2025
75%Board members rating their own AI knowledge at or above peersBoston Consulting Group · May 2026
37%CEOs saying boards lack an informed view of AI and growth strategyBoston Consulting Group · Aug 2026
How to fix it — 3 approaches, 9 steps

Ask both sides the same question

Run the board's AI self-assessment and the executive team's assessment of the board as the same instrument, then compare. The gap is the finding.

Done when One instrument has been issued to directors and to the executive team, the two distributions sit side by side in the nominations committee papers unattributed, and any gap wider than one band is minuted as a board effectiveness finding.

  1. Issue an identical short questionnaire to directors and to the executive team: can the board distinguish hype from reality, calibrate value timelines, and read the growth implications?0-30 daysCompany Secretary
  2. Report the two distributions side by side to the nominations committee, unattributed.0-30 daysNominations Committee
  3. Where the delta exceeds one band, treat it as a board effectiveness finding, not a training request.30-90 daysBoard Chair

The CEO leads the board's education personally

Delegating director education to the CTO or an external vendor reproduces the deference that caused the gap. The chief executive has to lead it personally.

Done when The board minutes record the chief executive personally presenting what AI changes for this company, one hands-on session has replaced a slide-based update, and the pack names where the company is keeping up rather than gaining advantage.

  1. CEO personally presents what AI does and does not change for this company's value creation, operating model and risk - not a vendor overview.0-30 daysCEO
  2. Replace one slide-based update per year with a hands-on session in which directors use the systems the company has deployed.30-90 daysCEO
  3. Name where the company is merely keeping up versus where AI creates advantage, explicitly.30-90 daysCEO

Change the board's composition, not just its reading list

Recruit directors with operating AI experience, or stand up a technology subcommittee with a real charter. Education alone does not survive turnover.

Done when The board skills matrix names AI operating experience and shows the gap, and either a director with delivery experience has been appointed or a technology committee exists with a charter that gives it decisions rather than advice.

  1. Add AI operating experience to the board skills matrix and identify the gap explicitly.0-30 daysNominations Committee
  2. Either recruit one director with delivery experience or charter a technology committee - not an advisory panel without authority.90-180 daysBoard Chair
  3. Sponsor continuing education for all directors, not only the technology committee.ongoingCompany Secretary
The evidence — 6 documents
OrganizationDocumentPosition
Boston Consulting GroupConsultancy · May 2026CEOs & Board DividedOur reading Survey of 625 leaders: 75% of board members rate their AI knowledge on par with or more advanced than peers; nearly 40% of CEOs say boards lack an informed view of how AI is reshaping growth strategy.Section: "Boards Think They Know AI. CEOs Challenge That Self-Assessment."names it
Boston Consulting GroupConsultancy · August 2026Closing the CEO–board knowledge gapOur reading 37% of CEOs say boards lack an informed view of how AI is reshaping growth strategy; 35% say boards overestimate AI's ability to replace rather than augment expertise.Section: "What the Numbers Say"names it
DeloitteConsultancyState of AI in the boardroomOur reading 66% say their boards still have "limited to no knowledge or experience" with AI, improved from 79% in the prior edition.Key themes from the surveynames it
EYConsultancyEY Board of the Future studyOur reading 35% of the research group feel existing ways of governance are not sustainable; a further 47% believe they are only somewhat sustainable.Foreword; 6E agendanames it
PwC MalaysiaConsultancyNavigating the AI dilemma: a leadership imperative for boardsOur reading Puts Malaysian directors who consider themselves well briefed on generative AI at 18% - one national market, not a global reading.Corporate Directors Survey findingsnames it
UC BerkeleyAcademic · May 2025An AI governance maturity matrix for boardsOur reading Names shortage of AI knowledge among board members as one of the most common hindrances to robust AI governance; oversight becomes cursory and directors defer to management.Dimension 2: People & Expertisenames it

Issue 022 organizations name it2026 evidence

Nobody has enumerated the AI the organization is already running

Oversight starts from a list of sanctioned projects, while the real estate - embedded vendor features, employee tools, models inside purchased software - has never been counted.

The board cannot govern what nobody has listed. An IoD members' survey found 80% of boards with no way to audit their own use of AI, against 86% of businesses running it somewhere the board could not see. The governed set and the deployed set are different sets, and only one of them appears in board papers.

80%Boards with no process to audit their use of AIInstitute of Directors · Jan 2022
86%Businesses using AI without the board being awareInstitute of Directors · Sep 2025
How to fix it — 2 approaches, 6 steps

Commission a one-off inventory of the deployed estate

Count what is running, including AI inside purchased software and tools employees adopted directly. Report the number to the board once, in full.

Done when One inventory has reached the board built from procurement records, network and SaaS telemetry and a no-penalty staff amnesty together, stating the unsanctioned share, with each entry classified by data exposure and decision impact.

  1. Inventory by three routes at once: procurement records, network and SaaS telemetry, and an amnesty survey of staff.0-30 daysCIO
  2. Report the total to the board including the unsanctioned share, without penalty for disclosure.30-90 daysCIO
  3. Classify each entry by data exposure and decision impact, not by which team built it.30-90 daysRisk

Keep a live register with a named owner per system

Convert the one-off inventory into a maintained register, with an accountable owner for every entry, reviewed on the same cadence as the risk register.

Done when A live register records owner, purpose, data classes and review date for every system, register entry is a precondition of production deployment, and additions and retirements appear at each risk committee.

  1. Stand up the register with owner, purpose, data classes touched, and review date.30-90 daysRisk
  2. Make register entry a precondition of production deployment.30-90 daysCIO
  3. Review additions and retirements at each risk committee.ongoingRisk
The evidence — 4 documents
OrganizationDocumentPosition
AnthropicFrontier lab · July 2026Anthropic’s CISO guide to agentic AIOur reading Puts the board's question - is any of this governed - against the reality that somebody has already wired an agent into a system without telling security, leaving an estate nobody can see into or switch off.Opening; governing internal risksnames it
Institute of DirectorsInstitutionAI in the boardroomOur reading Members' survey (2022): 80% had no way to audit their own use of AI, and 86% were running it somewhere in the business the board did not know about.Executive summary; essential questions for the next board meetingnames it
KPMGConsultancy · April 2026AI governance principles for boardsOur reading Places unsafe use of unauthorized tools among the risks the board must engage with deliberately.Active technology and security oversightproposes a fix
PalantirEnterprise · June 2026Palantir: Governing AI agentsOur reading Names seeing the estate as the precondition for governing it, and proposes use-case management that inventories and catalogues what is running, tracks each one along a lifecycle, and records whether it adheres to policy.Governing AI agentsproposes a fix

Issue 032 organizations name it1 disputes itnewest evidence May 2025

AI reaches the board when something happens, not on a fixed cadence

AI appears on the agenda episodically - after a launch, an incident or a headline - which makes oversight reactive by construction.

This is the issue with the widest disagreement in the research, and the disagreement is itself the finding. Deloitte's board survey puts fewer than one in five boards (17%) discussing AI at every meeting, with 19% taking it up once a year and 31% saying it is not on the agenda at all. Infosys, six months later, reports that 86% of boards receive AI updates on a regular schedule or at every meeting. Both are surveys of directors. They cannot both describe the same population.

45%Boards where AI is not on the agenda, prior editionDeloitte · Apr 2024
17%Boards addressing AI at every meetingDeloitte · Apr 2025
19%Boards addressing AI once per yearDeloitte · Apr 2025
31%Boards where AI is not on the agendaDeloitte · Apr 2025
86%Boards receiving AI updates on a regular schedule or at every meetingInfosys · Oct 2025
How to fix it — 2 approaches, 6 steps

Make it a standing item with a fixed owner

A standing agenda item with a named executive owner and a fixed reporting pack converts episodic attention into a cadence.

Done when AI is a standing item on the main board agenda rather than only a committee one, the same named executive has owned the pack across consecutive meetings, and the format is fixed enough to compare quarter on quarter.

  1. Add AI as a standing item on the main board agenda, not only the audit or risk committee.0-30 daysCompany Secretary
  2. Name the single executive accountable for the pack, and keep it the same person.0-30 daysCEO
  3. Fix the pack format so quarter-on-quarter comparison is possible.30-90 daysCIO

Set a forward-looking share of agenda time

Board agendas are dominated by the last quarter. Set an explicit target for time spent on what is coming rather than what happened.

Done when The retrospective and forward-looking split has been measured across at least two meetings, a target share is published in the board calendar, and the actual split is reviewed in board effectiveness.

  1. Measure the current split between retrospective and forward-looking agenda time for two meetings.0-30 daysCompany Secretary
  2. Set an explicit target share and publish it in the board calendar.30-90 daysBoard Chair
  3. Review the actual split annually as part of board effectiveness.ongoingBoard Chair
The evidence — 3 documents
OrganizationDocumentPosition
InfosysConsultancyThe board’s role in AI governanceOur reading Puts 86% of boards taking AI as a scheduled agenda item - 72% at regularly scheduled meetings and 14% at every meeting - against 14% who take it only ad hoc, from 300 directors at North American companies above $1bn revenue.Section: AI embedded on the board agenda (Figure 1)disputes it
DeloitteConsultancyState of AI in the boardroomOur reading 31% say AI is not on the board agenda (down from 45% in the prior edition); 17% address it at every meeting; 19% take it up only once per year.Key themes from the surveynames it
UC BerkeleyAcademic · May 2025An AI governance maturity matrix for boardsOur reading Places the lowest maturity stage where a board hears about AI only once a project has gone conspicuously right or conspicuously wrong.Dimension 1: Strategy & Visionnames it

Issue 041 organization name it2026 evidence

The board is shown demonstrations and cannot tell which systems are actually working

What reaches directors is a pilot count, a demo, or an anecdote. There is no agreed measure that separates a system creating value in production from one that presents well.

Boards receive AI updates in a format that cannot answer the only question that matters: is this working, at what scale, against what baseline. Half of the directors in Infosys's survey named insufficient data or analytics as a most-critical or second-most-critical obstacle to informed decisions. UC Berkeley's maturity matrix puts the same failure at the reactive stage: boards learn about AI projects only when they produce spectacular success or notable failure.

33%Respondents not satisfied or concerned with time their board spends on AIDeloitte · Apr 2025
50%Directors naming insufficient data or analytics as a top-two obstacle to informed decisionsInfosys · Oct 2025
How to fix it — 3 approaches, 8 steps

Define a promotion gate between pilot and production

Agree one written definition of what it means for an AI system to be in production, and report only against it. A pilot count stops being reportable.

Done when A written production gate names its four conditions, every initiative has been reclassified against it with the resulting drop shown once, and pilot counts no longer appear in board papers.

  1. Write the gate: a named owner, a measured baseline, a live user population, and a rollback path.0-30 daysCIO
  2. Reclassify every current initiative against the gate and report the new counts once, with the drop shown.30-90 daysCIO
  3. Stop reporting pilot counts to the board entirely.30-90 daysBoard Chair

Require a measured baseline before funding

No AI investment reaches the board without the pre-AI measurement of the same process. Without it, no later claim of improvement is checkable.

Done when The investment paper carries a mandatory field for the baseline, who measured it and when, at least one paper has been visibly rejected for lacking it, and value is reported against the original figure.

  1. Add "baseline measured, by whom, on what date" as a mandatory field in the investment paper.0-30 daysCFO
  2. Reject papers without it, visibly, at least once.0-30 daysBoard Chair
  3. Report value against the original baseline, not against a revised one.ongoingCFO

See the system, not the slide

Directors should periodically observe a deployed system in use against real work, including its failure modes.

Done when The board calendar shows a session in the last twelve months where directors watched a deployed system handle real cases including ones it got wrong, with the evaluation results shown rather than a curated selection.

  1. Schedule one session per year where directors watch the system handle real cases, including ones it gets wrong.90-180 daysCEO
  2. Require the team to show the eval results, not a curated highlight.90-180 daysCIO
The evidence — 3 documents
OrganizationDocumentPosition
Boston Consulting GroupConsultancy · August 2026Closing the CEO–board knowledge gapOur reading Reports chief executives saying that many of their directors cannot tell an inflated AI claim from a real one, or judge how quickly value ought to arrive - locating the difficulty in what the board can assess rather than in the papers it is sent.What's at Stake; the Split Decisions survey of 625 leadersnames it
KPMGConsultancy · April 2026AI governance principles for boardsOur reading Positions the board's role as deliberate engagement with strategic and transformational questions rather than managing AI or replacing executive judgment.Strategic oversight for long-term value creationproposes a fix
OpenAIFrontier lab · August 2026A scorecard for the AI ageOur reading Proposes a concrete measure that separates working systems from demonstrations: count only tasks meeting the quality bar, divide full cost - including employee time, human review, retries and rework - by that number, and track results as ready to use, needs correction, or needs escalation.The scorecard: cost per successful taskproposes a fix

Issue 051 organization name it2026 evidence

The board and the CEO disagree about the pace, and the disagreement is not on the agenda

Directors push for faster movement while the CEO believes the board is rushing. Because both sides report alignment in principle, the conflict never surfaces as an agenda item.

BCG found 61% of CEOs believe their boards are rushing AI transformations, while boards in the same survey favour faster implementation than their CEOs. This is not a communication problem - both sides are clear internally. It is a governance problem: surface-level agreement on principles hides a live disagreement about the risk appetite, and unresolved it drives directors toward taking operating decisions for the CEO.

42%CEOs personally using AI agents weeklyBoston Consulting Group · Jul 2026
35%CEOs who believe boards overestimate AI's ability to replace rather than augment expertiseBoston Consulting Group · Aug 2026
61%CEOs who believe their board is rushing the AI transformationBoston Consulting Group · Aug 2026
How to fix it — 2 approaches, 5 steps

Put a number on the risk appetite

Convert "move faster" and "be careful" into an agreed, written tolerance that both sides sign, so the disagreement becomes a decision.

Done when The board and executive team each stated an acceptable failure rate and delay separately, the two answers went to the full board side by side, and a single written tolerance is attached to the investment approval process.

  1. Ask the board and the executive team separately to state the acceptable failure rate and the acceptable delay.0-30 daysBoard Chair
  2. Publish the two answers side by side to the full board.0-30 daysCompany Secretary
  3. Agree a single written tolerance and attach it to the investment approval process.30-90 daysBoard Chair

Schedule the disagreement

Put pace on the agenda as its own item once a year, separate from any individual investment decision.

Done when The board calendar carries an annual item on pace and ambition with no project decision attached, and the minutes show the constraint case and the ambition case each put by a different person.

  1. Add an annual agenda item dedicated to pace and ambition, with no project decision attached.90-180 daysCompany Secretary
  2. Run it with the CEO presenting the constraint case and a director presenting the ambition case.90-180 daysBoard Chair
The evidence — 3 documents
OrganizationDocumentPosition
Boston Consulting GroupConsultancy · May 2026CEOs & Board DividedOur reading Boards favour faster AI implementation while CEOs are more measured about the pace of change; CEOs see AI ROI as a bigger factor in their performance evaluation than boards do.Survey findings: five areas of divergencenames it
Boston Consulting GroupConsultancy · August 2026Closing the CEO–board knowledge gapOur reading 61% of CEOs believe boards are rushing AI transformations. Frustrated directors can become heavy-handed and start making decisions for the CEO.What the Numbers Say; Why CEOs Must Close the Understanding Gap Nownames it
Boston Consulting GroupConsultancy · December 2025Targets Over Tools: The Mandate for AI TransformationOur reading Argues the board's role is to set the ambition level explicitly rather than react to management's pace.The role of boards in driving transformationproposes a fix

Issue 061 organization name it1 qualifies itnewest evidence Mar 2025

What the board is told about AI comes only from the people who own the outcome

AI performance and risk reporting reaches directors from the function that built and owns the systems, with no second-line or independent verification of the claims.

The three-lines model exists precisely because a function reporting on its own performance is not assurance. Accenture found only 39% saying governance responsibilities are effectively embedded as an integrated part of business management. For AI the gap is wider than for finance, because verifying a claim about model performance requires skills the second line often does not yet have.

How to fix it — 2 approaches, 6 steps

Give the second line the ability to check the claim

Assurance over AI requires people who can read an evaluation result. Build or buy that capability inside risk, not inside the delivery team.

Done when The second line has been tested on whether it can independently reproduce a model performance claim, the gap that revealed is funded as its own line, and no performance figure reaches the board without second-line sign-off.

  1. Assess whether the second line can independently reproduce a model performance claim today.0-30 daysRisk
  2. Fund the capability gap explicitly rather than relying on the first line to self-report.30-90 daysCFO
  3. Require second-line sign-off on any performance figure that reaches the board.ongoingRisk

Put AI in the internal audit plan

Add AI systems to the internal audit universe with a scheduled rotation, so the board receives at least one independent read a year.

Done when The register sits in the internal audit universe, at least one AI system audit is scheduled or complete this year chosen by risk classification, and its findings went to the audit committee like any other audit.

  1. Add the register from the estate inventory to the audit universe.30-90 daysAudit Committee
  2. Schedule at least one AI system audit per year, chosen by risk classification.90-180 daysAudit Committee
  3. Report findings to the audit committee on the same footing as any other audit.ongoingAudit Committee
The evidence — 3 documents
OrganizationDocumentPosition
InfosysConsultancyThe board’s role in AI governanceOur reading Surveying 300 directors at North American companies above a billion dollars in revenue, finds a slim majority whose boards hear how AI decisions are explained but leave watching over it to executives, and asks whether such a board is an adequate check - noting that the minority who oversee it directly reach for mechanisms including independent audit.AI decision explainability; oversight of explainability and transparencynames it
DeloitteConsultancyStrategic governance of AIOur reading Positions independent assurance over AI as an emerging oversight responsibility for audit committees.Roadmap: risk and performanceproposes a fix
Stanford Hoover InstitutionAcademic · March 2025The artificially intelligent boardroomOur reading Argues satisfying the formal fiduciary arrangement is not the same as adequate oversight, and points to examples of the arrangement proving insufficient.Fiduciary duty discussionqualifies it

Issue 07Our analysis2026 evidence

Oversight is added to an existing committee or role without changing its mandate

AI is assigned to audit, risk, or an existing executive as an extra topic, with no change to charter, skills, time allocation or reporting line.

The most common organizational response is the cheapest one. The Conference Board found 43% of organizations added AI oversight to an existing executive's role, against 46% that created a cross-functional team for it. Adding a topic to a full agenda without adding capacity produces the appearance of oversight while leaving the same people with the same time and the same expertise.

57%Chief AI Officers reporting to the CEO or the boardIBM · Jul 2025
43%Organizations adding AI oversight to an existing executive roleThe Conference Board · Dec 2025
46%Organizations creating a cross-functional team for AI oversightThe Conference Board · Dec 2025
How to fix it — 2 approaches, 6 steps

Change the charter, not just the agenda

If a committee takes AI, amend its terms of reference, its skills requirement and its time allocation at the same time.

Done when The committee charter names AI and the decisions it owns, the composition requirement names the skill, and the meeting record shows the allocated time was used on it.

  1. Amend the committee charter to name AI explicitly, with the decisions it owns.0-30 daysCompany Secretary
  2. Add the required skill to that committee's composition requirement.30-90 daysNominations Committee
  3. Allocate meeting time against the new charter and check it was used as allocated.ongoingBoard Chair

Write down who decides what

Separate the decisions the board takes, the ones it is informed of, and the ones management takes alone. Ambiguity here defaults everything to management.

Done when A one-page decision rights map is ratified at board level and attached to the committee charter, and it has been tested against a real past decision with the result written down.

  1. Draft a one-page decision rights map: deploy, suspend, exceed a risk threshold, publish externally.0-30 daysCompany Secretary
  2. Ratify it at board level and attach it to the committee charter.30-90 daysBoard Chair
  3. Test it against a real past decision to see whether it would have changed the outcome.30-90 daysRisk
The evidence — 3 documents
OrganizationDocumentPosition
DeloitteConsultancyStrategic governance of AIOur reading Sets out how AI oversight responsibilities should be allocated across the board and its committees rather than absorbed informally.Roadmap: governance structuresproposes a fix
KPMGConsultancy · April 2026AI governance principles for boardsOur reading Specifies that boards should not manage AI or replace executive judgment, but must engage deliberately - a mandate distinction the bolt-on arrangement erases.The work of the boardproposes a fix
UC BerkeleyAcademic · May 2025An AI governance maturity matrix for boardsOur reading Proposes a standing technology governance committee with continuing education rather than ad hoc recourse to external consultants at moments of crisis.Dimension 2: People & Expertiseproposes a fix

Issue 08Our analysis2026 evidence

There is no agreed threshold at which an AI failure reaches the board

No severity scale, trigger or clock defines when an AI incident becomes a board matter, so escalation is decided case by case by the people responsible for the system that failed.

Boards have well-drilled escalation for financial misstatement and cyber breach and nothing equivalent for a model that degrades, a system that produces a discriminatory outcome, or an agent that takes an action nobody authorized. PwC Malaysia found only 23% of Malaysian board members had participated in a tabletop exercise to test incident response readiness. Without a threshold, the first genuine incident is also the first time the escalation path is designed.

23%Board members who participated in an incident-response tabletop exercisePwC Malaysia · Aug 2025
96%Respondents expecting risk and compliance roles to expand as AI embedsMoody’s · Sep 2025
How to fix it — 2 approaches, 6 steps

Write the severity scale before you need it

Define, in advance, what makes an AI incident a board matter: affected population, reversibility, regulatory exposure, and elapsed time.

Done when A four-level severity scale is ratified at board level, each level carries an explicit board-notification trigger and a stated number of hours from detection to notification.

  1. Draft a four-level severity scale with an explicit board-notification trigger at each level.0-30 daysRisk
  2. Attach a clock: how many hours from detection to board notification at each level.0-30 daysRisk
  3. Ratify at board level so the trigger is not management's judgment call in the moment.30-90 daysBoard Chair

Run the tabletop with directors in the room

Rehearse a specific AI failure with the actual board, not a management-only exercise reported afterwards.

Done when A tabletop on a scenario drawn from the estate inventory has been run in the last twelve months with directors in the room, the escalation was timed, and what it broke has been fixed.

  1. Pick a plausible scenario from the estate inventory: a degraded model in a customer-facing decision.30-90 daysRisk
  2. Run it with directors present and time the escalation.90-180 daysBoard Chair
  3. Fix what the exercise breaks, and re-run annually.ongoingRisk
The evidence — 1 document
OrganizationDocumentPosition
KPMGConsultancy · April 2026AI governance principles for boardsOur reading Places cyber breach and unsafe use of unauthorized tools among the amplified risks requiring deliberate board engagement.Active technology and security oversightproposes a fix

Who is represented

This dossier is drawn from 34 organizations working on the subject, 12 of which are cited directly in the issues above.

Consultancy — 13

Boston Consulting Group 19 Deloitte 5 KPMG 3 EY 2 PwC Malaysia 2 Infosys 1 Capgemini 5 Accenture 4 L.E.K. Consulting 2 PwC 2 Genpact 1 McKinsey & Company 1 Teneo 1

Institution — 9

Institute of Directors 1 World Economic Forum 3 Cloud Security Alliance 2 Moody’s 2 NIST 2 Australian Institute of Company Directors 1 Equilar 1 IAB 1 Marketing AI Institute 1

Academic — 3

Stanford Hoover Institution 1 UC Berkeley 1 Carnegie Mellon SEI 1

Hyperscaler — 3

IBM 3 Google Cloud 1 ServiceNow 1

Frontier lab — 2

Anthropic 2 OpenAI 2

Enterprise — 1

Palantir 1

Vendor — 3

Palo Alto Networks 2 Eightfold AI 1 TechWolf 1