It is Sunday evening, and Thursday’s board pack runs to 140 pages. You have read packs like it for years. This time you paste the two longest appendices into a chatbot and ask what you should be worried about. It returns five issues in 90 seconds. Two of them are worth considering. On Thursday you raise both, and the discussion is productive.
Nobody in the room knows you used AI to go through the pack. Nothing you did was against any rule. And no one, including you, can say what the model left out.
You are not unusual. A June 2026 survey by Diligent Institute and Corporate Board Member found that 82% of 104 US public-company directors had used generative AI in board work in the previous six months, up from 66% nine months earlier. While board members have access to confidential information, only 6% of people surveyed reported an AI policy specific to the board. Diligent sells board software, and the panel is small, so read this as direction.
I have spent more than a decade examining how boards make oversight visible: the papers they receive, the questions they ask, what ends up in the minutes. But ask a chair what their board’s AI policy covers, and you usually get the company’s AI policy. Boards are governing the use of technology for the organization but not monitoring their own use of it.
This oversight stems from a fundamental error: boards focus on approving tools – which portal, which AI assistant, which vendor. This is a misguided approach: a tool is cleared once and then does many different jobs, and those jobs contain various levels of risk. For example, a director may use the same tool to summarize a paper or select risks for discussion, but those uses require different checks. Approving a use defines how far the board will rely on what comes back.
Boards must approve the use, not the tool. And to do that, they need a way to distinguish those uses before relying on the same tool for different tasks.
General permission to use AI is too
broad.
Most board AI discussions still begin with permission in the broadest form. May directors use AI to summarize a paper? May the corporate secretary use AI to draft minutes? May management use AI to prepare board materials?
General permission to use AI is too broad. A model that summarizes a policy appendix may appear to be doing clerical work. The same model, pointed at the same pack, can decide which risks a director notices and what the minutes record as the board’s reasoning. It can sharpen debate, or quietly displace the chair’s control of the agenda. Bruni-Bossio and colleagues warn that automating routine board tasks can weaken the chair’s influence. Shekshnia and Yakubovich describe how AI can support directors’ preparation and board discussion. One approval cannot cover both jobs.
AI arrives dressed as efficiency. It digests a pack someone didn’t have time to read, drafts a minute, pulls a risk out of a buried appendix. Those outputs feel administrative, but in a boardroom, administrative work often overlaps with judgment work. A summary quietly decides what directors notice. A draft minute becomes the official account of what the board considered.
Speed and refusal fail in the same place. A board that moves quickly ends up with AI-shaped material throughout its process because the material was useful, not because anyone governed it. A board that refuses pushes the use into the margins, where it happens anyway and leaves no trace. Nearly half the directors in the Diligent survey had heard of peers using consumer tools for board work, yet 96% said they knew of no instance of board materials being entered into an unapproved tool.
The justification directors give for using AI is improved efficiency: I was too busy to read the whole pack. However, the reluctance to acknowledge that use may reflect fear of exposure: no director wants to say how much of last month’s pack they read through a model, and nobody wants to create records that could later be requested in litigation. AI-assisted drafts may be discoverable, and once litigation is likely, those records must be preserved. Declining to keep a record removes the evidence that someone checked. It does not remove the material or the duty to preserve it. Which leaves a third way through: permission granted on a per-use basis, each small enough to check.
The ladder below sets out five stages of AI use for boards, from producing the words directors read to shaping the decisions themselves. What changes as you climb is not what the model can do, but how much of the board’s judgment rides on the answer, and how hard a mistake would be to spot.
A precondition is understanding what happens to the data when it is put inside a large language model (LLM). Boards should first answer four questions:
Without answering these questions, it is too risky to let AI touch board papers. Maintaining confidentiality is a threshold, or precondition, to considering any AI use for board operations.
Read the below ladder as a framework for evaluating each use case for deploying AI in board operations. Read from bottom to top as reliance increases. Across each rung, we will consider the use, or task, the stage of influence on the board work, the human who is accountable for monitoring the AI performance in that task, and, crucially, how the board will learn when and if the output is faulty.
Each rung names a stage at which AI enters a decision. One output may cross several stages so classify a use by the highest stage it could plausibly reach, not by the task it was given. A summary that decides what directors notice is a filter, whatever its label. Start at the lowest stage that solves the problem. Move up only when the controls for the higher stage have also been tested. Read the fourth column before approving anything, because it tells you what an AI failure will look like.
The obvious reading is that reliance increases from stage 1 to stage 5, so controls should tighten as you go up.
Read the “How the board finds out” column, and it shows why a wrong answer can be easier to spot than a risk AI has missed.
The obvious reading is that reliance increases from stage 1 to stage 5, so controls should tighten as you go up. That is half right, but it hides the more difficult problem. The first rung is the easiest to police, because a summary can be checked against its source. The fifth rung is the most consequential and can also be made visible. A model that shapes a capital decision leaves the reasoning in the minutes, where an auditor, a regulator, or a plaintiff can read it afterwards.
The rung hardest to check is the middle one. At stage 3, AI influences which issues directors notice. A risk it fails to flag may never enter the discussion, leaving little indication that it was overlooked.
When automation fails to flag something, the person relying on its alerts often misses it too. Researchers call that an omission error, as against a commission error, where someone acts on a bad recommendation. Both are well documented and training does not eliminate the pattern. The research predates generative AI, but the problem carries over: a director may take the absence of a warning as a sign that there is nothing to investigate. If AI leaves out an important issue, checking the accuracy of the issues it did flag will not reveal that omission.
So check the filter as well as the output. Give the model a controlled test pack in which the board already knows what is buried and see whether it flags the known problem. A model that misses a known problem has told the board more about its own blind spot than a hundred clean runs ever will.
Boards already know how to do this. They have just never done it to a model. A quality lab runs a sample of known value through an instrument to confirm it still reads true. A security team sends its own staff a phishing email and counts who clicks. An anomaly scan is a detective control and should be tested the same way. A miss is a control deficiency: escalate it, document it, and lower how far the board relies on that rung until it is fixed.
The board should ask the named reviewer to answer these questions before relying on the AI-assisted material:
Accountability climbs the ladder with the output. At the bottom the preparer owns the check against the source. In the middle the committee chair owns the test and the escalation. At the top, the board owns the reliance and the chair owns the record of why. No name, no use.
When a check catches an error that has already reached directors, require the suspension of use until a control is
added.
When a check catches an error that has already reached directors, require the suspension of use until a control is added. A lender does not end a relationship over a covenant breach. It puts the borrower on tighter reporting until it understands the position, then eases off. Treat a failed check the same way, and approval becomes something the board keeps deciding. It also makes the first mistake worth having: a mistake caught in a summary costs less than the same one caught in a deal.
Outside the boardroom, the cases are accumulating. A consulting firm repaid part of a government contract after a model invented legal citations. A Delaware court read a chief executive’s chatbot exchanges as evidence of intent in a deal dispute. Law firms warn that AI-assisted drafts may be discoverable and must be preserved once litigation is likely.
These cases show why AI-assisted work needs human scrutiny and clear accountability. What failed was governance: nobody had decided how far the output could travel, or who stood behind it once it did. Boards have no reason to expect to be the exception.
A board running one governed AI use is showing greater AI maturity than a board running five unchecked ones.
And yet, while Grant Thornton’s 2026 survey of 950 senior leaders found around three in four boards had approved major AI investments, nearly half (48%) had failed to set AI governance expectations. The same need for explicit governance expectations applies to the board’s own use of AI.
Each chair must ask: Is AI in this paper, and at which rung? Who checked it, by name? What did the check find was missing, and why is that absence acceptable for this decision?
A board that asks governs its own reliance. A board that does not has allowed its reliance on AI to grow without an explicit decision.
Approve the use, not the tool.
Whether artificial intelligence will deliver on its promise, and whether it can be trusted, preoccupies corporate leaders and boards. But a more fundamental question is being neglected: Who inside the organization actually...
Surviving disruption is no longer enough. Jean-Jacques Henchoz outlines five ways that boards can learn, adapt, and grow stronger through volatility....
CEOs face greater scrutiny than ever. Retreating from the speaking spotlight is no solution. IMD’s Jean-François Manzoni explains how CEOs should talk with trust and integrity....
Should kids leave the family business to lead later? Learn how outside-entrepreneurship strengthens leadership, ownership, and long-term renewal....
Explore first person business intelligence from top minds curated for a global executive audience