AI Has Entered the Boardroom. Who’s Overseeing It?

“We’re trying to change the wheels on the bus while driving it at 100 miles an hour downhill.”

That’s how one corporate director described oversight of AI in a recent survey conducted by Karen Ebert Matthys, MBA ’88, executive director of the graduate program and strategic initiatives in Stanford’s Department of Biomedical Data Science, and Ratna Saripalli, founder and CEO of TAGC Assurance, which conducts AI governance assessments.

AI has entered the boardroom in a big way. Directors regularly discuss the new technology, serve on dedicated AI committees, and may be recruited for their AI expertise. But how they are governing AI can be a black box.

In interviews with Matthys, Saripalli, and their coauthors, board members across industries reported that while they are actively discussing and using AI, their boards lack a systematic approach to its governance. “In the absence of such a structure,” the researchers write, “AI may remain a recurring boardroom topic rather than become subject to meaningful oversight and accountability.”

“We could see that directors’ usage and attitudes regarding AI were changing quickly,” Matthys says. “We wanted to go beyond recent quantitative surveys and dig deeper to uncover insights on why these things were changing.”

While corporations are placing big bets on AI, there’s also “caution about moving very carefully,” Saripalli notes. “Current efforts with AI are very distributed, and the call to action for many boards is how to integrate all of these. Our survey seeks to gather information from leaders with very different AI backgrounds to unify the challenges people are facing.”

Matthys and Saripalli are part of the Board Governance Accelerator for AI Experts, a Stanford Directors’ Network program that prepares current and future directors of public and private boards to deal effectively with AI-related opportunities and challenges. Their research was conducted in collaboration with Anirma Gupta, a former chief legal officer now at Thronax; Jennifer Dianne Keen-Kim, an adjunct clinical professor of pathology at Stanford School of Medicine; and Tamara Sniffen, vice president of commercial excellence at Stryker.

The Oversight Gap

The survey featured semi-structured interviews about AI oversight, directors’ use of AI, and other topics, conducted with 20 directors of public and private companies in highly regulated industries such as healthcare and finance.

Most boards have minimal structures or frameworks related to AI in place, the survey shows. For example, 80% of directors said they had no formal AI ethics or responsibility policies or scorecards, and 70% said their boards lacked clearly defined AI governance responsibility. Similarly, respondents gave a mean rating of 4.7 on a 10-point scale for their boards’ overall readiness to oversee AI.

“At this point there’s no one-stop-shop for AI responsibility,” Saripalli says. “But this isn’t shocking because of the fast pace of development of AI. There’s a huge transformation going on.”

“People we talked to are certainly aware of AI capabilities at different levels,” Matthys says. “But it was the institutionalization that was missing: moving from aspirational to concrete plans and frameworks to incorporate and govern AI, with clear decision-making, reporting, escalation paths, and so on.” As one director who responded to the survey put it, it’s “a little Wild West.”

Learning by Doing

However, directors are gaining firsthand experience with AI and are aware of its potential. “There’s an urgent need for directors to upgrade their AI fluency, and many are doing it on their own time,” Saripalli says.

In the survey, 75% of directors said they used AI for research and market analysis, 55% for board prep and material summarization. Other common uses included strategic question generation and competitive benchmarking. Matthys says that board members would ideally like to use AI “to track and summarize board packages and more quickly understand year-to-year trends by using LLM tools rather than reading 80- to 100-page reports.”

“But,” she adds, “only 54% of our respondents said they have clear guidance from management on what they can and can’t do with AI.” Firewalls and secure sandboxes can help address potential security issues regarding identity and access management and prevent leakage of private corporate data. Yet, she notes, “there are a number of hurdles to setting these up and having appropriate security and privacy controls.”

Time to Move

The researchers recommend that corporate boards take a proactive, systematic approach to AI oversight. “Top priority is defining the high-level, overall governance structure,” Saripalli says. “What’s the AI vision and strategy? Who owns what among board and management? What are specific committee responsibilities and decision-making processes?”

To answer these questions, boards must get up to speed on the state of AI in their business. “We discovered most boards don’t have a great picture of what AI solutions are being rolled out,” Matthys says. “So getting a full audit of current AI usage in a company needs to happen before you can look at AI investments as a portfolio and have dashboards to measure progress and challenges, and understand returns.”

The sooner the better, the researchers suggest. “Moving too slowly with AI governance means you may miss out on opportunities,” Saripalli says. “The board has fiduciary responsibility for anything that has impact at the product or service level.”

“The risk of not moving is as serious as the risk of AI systems running amok,” Matthys adds, noting how past technological shifts have left unprepared companies behind. “If you don’t keep up, there’s a risk that 20 years from now you won’t exist.”

That point is underscored by the reality that AI will only become more ingrained in business and board practices. “There is talk of how AI agents will be like members at the boardroom table,” Matthys says. “I expect that will eventually happen, although addressing AI governance should be a higher priority on boards right now.”