AI governance is a board issue: Are you equipped to answer the tough questions?

For many organisations, the conversation remains focused on productivity and innovation. In the context of increased regulatory scrutiny and an upcoming Royal Commission into AI, boards should be asking a different question: could we explain and defend our use of AI if we were called before a regulator or Royal Commission tomorrow?

The emergence of AI as a governance issue is not creating new directors’ duties. Rather, it is creating new circumstances in which existing duties will be tested. Increasingly, regulators, courts and inquiries are focused not only on decisions themselves, but on the systems, controls and information flows that supported those decisions.

In the age of AI, governance is becoming as important as technology.

Royal Commissions don’t start with technology

Royal Commissions rarely focus on whether an organisation embraced innovation or adopted the latest technology. They focus on governance.

They ask whether risks were identified, whether concerns were escalated appropriately, whether decision-makers had sufficient information, and whether organisations acted when problems became apparent.

The same questions are likely to arise in relation to AI.

If an AI system contributes to discriminatory outcomes, privacy breaches, cyber incidents, misleading conduct or flawed operational decisions, investigators will not simply ask whether the technology worked correctly. They will examine the governance framework surrounding its deployment.

For directors, the issue is no longer whether AI is being used. In most organisations, it already is. The issue is whether the organisation can demonstrate that its use is properly governed.

Why AI is now a board issue

Many boards continue to view AI as a technology issue delegated to management or technology teams.  That distinction no longer holds.  AI is not confined to operational processes.  It is influencing risk assessments, management reporting, compliance monitoring, workforce decisions and strategic planning. It is also increasingly being used to assist directors in reviewing and distilling board materials. While these tools may improve efficiency and comprehension, they do not replace the need for informed human judgement or personal accountability.  Directors may never directly interact with these systems, but they regularly receive information that has been influenced, filtered or generated by them.

This creates a governance challenge.

Boards do not need to understand the technical architecture of every AI system. They do need confidence that management understands where AI is being used, what risks it creates, and what controls are in place to manage those risks.

The key governance question is no longer:

“Did AI make a bad decision?”

It is:

“What governance arrangements existed to identify, monitor and escalate AI-related risks before a problem occurred?”

Effective governance requires visibility. Directors cannot oversee risks they cannot see.

What a Royal Commission would ask for

If an organisation faced regulatory scrutiny tomorrow, boards should expect management to produce evidence in three key areas.

1. Visibility

Can the organisation identify:

• which AI tools are being used;
• where they are deployed;
• who owns them;
• which vendors provide them; and
• which business processes rely on them?

Without this visibility, meaningful oversight is impossible.  Directors cannot effectively oversee AI-related risks if they do not understand where AI is being used, how it influences decision-making, or how AI-generated outputs enter management reporting and board materials.  Effective governance requires visibility over both the technology itself and the information flows it creates.

2. Governance

Is there:

• an AI policy;
• executive accountability;
• board or committee oversight;
• an approval process for new AI use cases; and
• a framework for assessing legal, operational and reputational risks?

AI governance should be integrated into the organisation’s broader risk management framework, not treated as a standalone technology initiative. Governance arrangements should influence the information reaching the boardroom, the questions directors ask and the issues that are escalated. The existence of a policy alone is unlikely to be persuasive if there is no evidence that AI-related risks are being actively monitored and discussed.

3. Evidence

Can the organisation demonstrate:

• how AI was used in decision-making;
• what human oversight occurred;
• who made the final decision;
• how incidents were reported; and
• what remediation steps were taken when issues arose?

When regulators examine governance, documentation matters. Organisations need to be able to do more than say they had controls in place. They need to show it.  Board and committee records should demonstrate not only what information was provided, but how that information was considered, challenged and acted upon. Effective oversight leaves an evidentiary trail.

Five questions every board should ask

Boards looking to assess their current level of AI governance should start with five simple questions:

1. Where is AI being used across the organisation today?
2. What decisions or processes does it influence?
3. Which AI uses create the greatest legal, operational or reputational risk?
4. How are AI incidents identified, reported and escalated?
5. What evidence could we produce if regulators examined our AI governance tomorrow?

If boards cannot confidently answer these questions, there may be governance gaps that warrant closer attention.

Governance will matter more than technology

AI presents immense opportunities for organisations willing to innovate. However, the organisations best positioned for future scrutiny may not be those with the most sophisticated technology.

They will be those with the strongest governance.

For boards, AI is increasingly both a strategic opportunity and a governance challenge.  Focusing only on risk may mean missing value creation opportunities.  Focusing only on opportunity may mean overlooking governance obligations.  Both require oversight.

Directors are not expected to understand every algorithm operating within their organisation, but they do need sufficient oversight to ensure opportunities are being pursued appropriately, risks are being managed, and accountability remains clear.

That obligation is not new. What is changing is the environment in which it must be discharged.

As AI becomes increasingly embedded in business operations, boards should assume that regulators, inquiries and Royal Commissions will eventually turn their attention to how organisations govern these systems.

When that happens, the critical question will not be whether the organisation used AI.

It will be whether the organisation can clearly explain how AI was governed, who was accountable, and what oversight existed before the problem arose.