The Challenge for Non-Executive Directors
Artificial intelligence is no longer a distant technology confined to research laboratories. It’s rapidly becoming embedded in business operations across all sectors, from customer service chatbots to fraud detection systems. For non-executive directors, this presents a significant challenge: how do you provide effective oversight of something you may not fully understand?
The answer lies not in becoming an AI expert, but in understanding the governance questions that need to be asked and ensuring your organisation has the right frameworks in place to manage AI-related risks and opportunities.
Why AI Governance Matters Now
AI systems differ fundamentally from traditional software. They can learn, adapt, and make decisions autonomously, often in ways that even their creators cannot fully predict or explain. This creates new categories of risk that traditional governance frameworks struggle to address.
Recent incidents have highlighted the potential consequences of inadequate AI oversight. Biased recruitment algorithms have led to discrimination claims (see Workday AI lawsuit), whilst poorly designed AI systems have caused customer service failures and regulatory scrutiny. The reputational and financial costs of these failures underscore why boards cannot afford to treat AI as merely a technical issue.
Key Questions for the Boardroom
Rather than getting lost in technical details, directors should focus on fundamental governance questions that apply to any significant business technology:
What AI are we actually using? Many organisations lack a comprehensive inventory of their AI systems. This includes both internally developed solutions and third-party services that may contain AI components. Understanding what AI your organisation uses is the foundation of effective governance.
Who is accountable for AI decisions? Clear accountability structures must exist from the board level down to operational teams. This includes designating specific directors with oversight responsibility and ensuring executive management has the necessary expertise to manage AI risks.
How do we assess AI risks? AI risks extend beyond technical failures to include regulatory compliance, ethical concerns, and strategic misalignment. The board should ensure comprehensive risk assessment processes are in place that consider both immediate operational risks and longer-term strategic implications.
Are we compliant with regulations? The regulatory landscape for AI is evolving rapidly. The EU’s AI Act will affect any organisation operating in European markets, whilst UK regulators are developing sector-specific guidance. Directors must ensure their organisations can adapt to changing regulatory requirements.
Essential Governance Framework Elements
Effective AI governance requires several key components that boards should ensure are in place:
Clear policies and standards that define acceptable use of AI, data handling requirements, and human oversight responsibilities. These policies should be regularly reviewed and updated as AI capabilities evolve.
Risk monitoring and reporting systems that provide the board with regular updates on AI performance, emerging risks, and compliance status. These reports should be accessible to non-technical directors whilst providing sufficient detail for informed decision-making.
Incident response procedures that ensure AI-related problems are quickly identified, contained, and resolved. This includes clear escalation paths to executive management and the board when significant issues arise.
Vendor management processes that address the growing reliance on third-party AI services. Many organisations use AI capabilities from external providers without fully understanding the associated risks and dependencies.
Practical Steps for Directors
Directors can take several concrete steps to strengthen AI governance:
Ask the right questions during board meetings. Enquire about AI inventories, risk assessments, and compliance status. Request regular updates on AI initiatives and their business impact.
Ensure adequate expertise exists at both board and executive levels. This might involve recruiting directors with relevant experience or providing training for existing board members.
Review existing policies to ensure they adequately address AI-related risks. Traditional IT and risk management policies may need updating to reflect the unique characteristics of AI systems.
Understand your organisation’s AI maturity. Different organisations will require different governance approaches depending on their AI adoption level and risk appetite.
Looking Forward
AI governance is not a one-time exercise but an ongoing responsibility that will evolve as AI technologies advance. Directors should expect to regularly review and update their governance frameworks as new AI capabilities emerge and regulatory requirements develop.
The key is to establish robust governance foundations now, whilst remaining flexible enough to adapt to future changes. Organisations that invest in comprehensive AI governance today will be better positioned to realise AI’s benefits whilst managing its risks effectively.
If you would like to discuss our Company Secretarial solution, please contact Ben Harber, Shaun Zulafqar, Tom Verlander or Chloe Higgins.
