From the Data Room to the Boardroom: Artificial Intelligence and Fiduciary Duties

As artificial intelligence (AI) moves from experimentation to enterprise infrastructure, governance around AI is changing. For directors, overseeing AI is becoming less about technology and more about fulfilling the board’s fundamental responsibilities for risk, strategy and corporate oversight.

Companies are deploying AI to improve productivity, analyze data, interact with customers, make recommendations, automate processes and support increasingly consequential decisions.

Yet the speed of adoption raises an important question  many boards are only beginning to confront:

At what point does oversight of AI become a fiduciary responsibility of the board?

The answer is nuanced. There is not a separate, universally recognized fiduciary “duty of AI.” Rather, AI is intersecting with the duties directors already have to oversee their companies, make informed decisions and monitor material risks. For boards, that distinction is critical. AI should no longer be viewed exclusively as an information technology project delegated to management. It can create strategic, operational, cybersecurity, privacy, regulatory, litigation and reputational exposures. At the same time, it may create significant competitive opportunities. The result is that AI governance is rapidly becoming corporate governance.

The evolution of cybersecurity offers a useful comparison. Cybersecurity was once considered largely the responsibility of an organization’s IT department. As companies became more dependent on technology and the consequences of cyber incidents grew, cybersecurity evolved into an enterprise risk requiring senior management and board oversight. Artificial intelligence appears to be following a similar trajectory.

The National Association of Corporate Directors (NACD) has expressly recognized that AI’s risks and opportunities implicate boards’ fiduciary responsibilities and has encouraged boards to treat emerging technology as a strategic imperative rather than simply an operational concern.

More recently, NACD’s AI governance framework has focused on how directors can integrate AI into their existing oversight responsibilities while considering strategy, competitive advantage, investment and risk.

The question for directors is not whether they understand the technical architecture behind a particular AI model. It is whether the board understands where AI matters to the organization and whether appropriate governance exists around those use cases.

AI presents the next governance question:

If AI becomes sufficiently important to a company’s business, what systems has the board established to understand and oversee the resulting risks?

The answer will vary significantly among companies. A business using generative AI primarily to improve routine employee productivity presents a different risk profile from an organization deploying AI in hiring, healthcare, financial services, underwriting, pricing or other consequential decision-making.

The fundamental governance principle, however, remains the same. Boards do not have to operate AI. However, they should understand and oversee its material implications.

Perhaps the most immediate AI governance problem is visibility. AI can enter an organization through internally developed systems, third-party applications, software vendors and individual employees using publicly available tools. Companies may therefore be relying on AI in more areas than senior leadership or the board realizes.

This makes understanding the organization’s material AI use cases an important foundation for governance. The concept of maintaining visibility over AI usage is already appearing in institutional governance programs.

Not every application should demand board attention. AI embedded in a low-risk administrative function is unlikely to warrant the same scrutiny as a system affecting employment decisions, customers, sensitive information, financial reporting or regulated activities. Governance should therefore be proportionate to risk.

The Emerging D&O Dimension

Failures involving AI can potentially migrate from operational problems into management liability issues. This development highlights two distinct areas of concern:

1. AI implementation risk. The company deploys or relies upon AI and technology contributes to a regulatory, operational, privacy, cyber or other corporate problem.
2. AI representation risk. The company makes statements regarding its AI capabilities, strategy or expected benefits that subsequently become the subject of investor or regulatory scrutiny.

The distinction is particularly important in an environment where companies may feel pressure to demonstrate they have an AI strategy. Corporate enthusiasm for AI can become a governance problem if public messaging moves faster than actual capabilities, controls or risk management.

Directors generally should not be choosing individual AI models, designing technical controls or approving routine applications. Attempting to do so could blur the distinction between management’s responsibilities and the board’s oversight role. Instead, directors should be asking higher-level questions:

• Where is AI material to our business or strategy?
• Who within management is accountable for AI governance?
• What information and data are our most significant AI systems using?
• What are our highest-risk AI applications?
• How are significant AI incidents escalated?
• How do we evaluate material third-party AI exposures?
• What controls exist over external statements concerning our AI capabilities?
• How does management determine when an AI issue should reach the board?

NACD’s current board education materials similarly address the distinction between board oversight and management execution while connecting AI governance with directors’ duty of care and ongoing education.

The objective is not technological perfection. It is a thoughtful and demonstrable governance process. Artificial intelligence does not require abandoning established principles of corporate governance. It requires applying them to a technology whose capabilities, adoption and risks are evolving extraordinarily quickly.

The board does not need to predict the future of AI. Directors do not need to understand every algorithm. Nor can boards reasonably expect to eliminate every risk associated with rapidly changing technology. They should, however, gather enough information to exercise meaningful oversight.

As AI becomes more deeply embedded in corporate operations and strategy, boards should be able to explain how significant AI risks reach them, who is accountable for managing those risks and how the company balances innovation against potential harm.

That is why the conversation surrounding AI in the boardroom is shifting. The central issue is no longer simply whether a company should adopt AI. It is whether the company’s governance is keeping pace with its adoption.

Ultimately, the greatest fiduciary risk for directors may not be that an AI system makes a mistake. It may be that the company embraces AI at scale while the board fails to develop a meaningful framework for overseeing it.

Have questions about AI governance, fiduciary duties or D&O implications? Reach out to Gamelah Palagonia to learn more.