82% of Directors Use AI. 6% Have a Policy for It.

Boards are asking management hard questions about AI governance while having almost none of their own. The harder question is not whether you have oversight. It is whether you would detect a failure.

🔢 Start with the number that is actually about you

A survey of 104 directors at US public companies, run by the Diligent Institute and Corporate Board Member, found that 82 percent had used generative AI in their board work within the previous six months.

Six percent reported a formal policy covering it.

Fifty four percent said no guidance existed at their company at all. 📋

It is a small sample and worth treating as directional rather than definitive. But the shape of it is hard to argue with, and most directors who read it recognise their own board immediately.

The same body asking management to demonstrate AI governance is, in the majority of cases, operating without any. ⚖️

Externally the picture matches. ISS-Corporate reported in 2026, on 2025 data, that only 22 percent of S&P 500 companies disclosed board oversight of AI, and 24 percent disclosed AI frameworks and policies.

So the governance gap is not a management problem that the board supervises. It runs through the board itself.

🏁 The race framing is the risk

Coverage of AI has settled into a race. Who is ahead, who is behind, what it costs to wait.

That framing does real damage in a boardroom, and the mechanism is specific.

Competitive pressure is the most common reason a governance step gets removed. Not malice, not ignorance. A quarter is tight, a competitor announced something, and the review stage is the only thing in the plan that can be compressed without missing the date.

Removed controls almost never come back. Nobody schedules the meeting to reinstate a step that nothing has visibly gone wrong without. 🔥

The board's actual job in a race is not to set the pace. It is to be the body that notices which controls were traded away to achieve it, and to ask for that list explicitly, because it will not be volunteered.

🔍 The question nobody asks: how would we know?

Most boards can get a yes to "do we have AI governance". That answer is close to worthless.

The question with teeth is: how would we detect a failure?

Here is why it matters more for AI than for anything else the board oversees.

Financial failures are noisy. A reconciliation breaks, a covenant trips, an auditor raises a point. Operational failures are noisy. A system goes down, customers complain, a line stops.

AI failures are silent. 🔇

A document extraction system misreads a field and returns a plausible number. A natural language query joins the wrong way and returns a figure inside the expected range. An agent takes a reasonable sounding action for a wrong reason. Nothing errors. Nothing alerts. The output looks exactly like a correct output, because structurally it is a correct output of a wrong process.

Your oversight machinery was built to catch loud failures. The thing you are now accountable for fails quietly. That is the gap, and it is not closed by adding AI to the risk register.

🧭 Four questions a board should be able to answer

Not about AI specifically. About any system the organisation depends on. If the answers do not exist for AI, that is the finding.

1. Where does the data sit, and who can compel access to it? 🗺️ Not where the servers are. Which jurisdictions can require disclosure, and what prevents both external access and internal misuse.

2. What can we revoke today? 🔌 Can a vendor, partner or internal service be cut off from company data this afternoon, without a project? If not, that relationship is not governed, it is merely contracted.

3. Who operates this when it fails outside business hours? 🛠️ And do they work for us. Ownership without operating capability is a diagram.

4. Have we tested leaving? 🚪 An exit clause everyone has read and nobody has exercised is a hope. A tested exit is leverage, and it changes every renewal conversation you will have.

Most organisations answer one or two of these with confidence. That is the honest baseline, and knowing which two is more valuable than a maturity score.

⏱️ Two external forces that will make this concrete

The regulatory clock is now dated. 📅 The Digital Omnibus was adopted as Regulation (EU) 2026/1744, in force since 27 July 2026. It moved core high risk obligations for Annex III systems to 2 December 2027 and Annex I to 2 August 2028. The deferral exists because the harmonised standards were not ready, not because the obligations became optional. They are binding law with a new date.

Investors have started scoring it. 📊 ISS and Glass Lewis have begun incorporating AI governance into director evaluation, which brings it into re-election territory. That is a different kind of pressure from a regulator, and it arrives sooner.

Separately, and worth knowing rather than panicking about: legal commentary increasingly frames AI oversight as falling under existing fiduciary duties rather than requiring new law. In the United States the duty of oversight line of cases is the one being cited. In Australia, ASIC has stated that deploying AI without understanding its risks could constitute a failure of the duty of care.

We are a consulting firm, not a law firm, and most of the available material on this is advisory commentary rather than settled judgment. Take the direction seriously and take the specifics to counsel.

📋 What a board can do this quarter

Four things, none of which require a programme.

Ask for the AI inventory. Where it is used, what it decides or influences, who owns each one by name. Most organisations have never produced this and the exercise alone surfaces things nobody on the board knew existed.

Ask what controls were removed to hit a date. Phrase it exactly that way. The list exists, it is simply never volunteered.

Ask how a silent failure would be detected. If the answer describes a dashboard, ask what the dashboard would show if the output were plausible but wrong.

Write a policy for the board's own use. If 82 percent of directors are using these tools on board material, including confidential pre-read packs and draft minutes, the governing body has an exposure of its own. Six percent have addressed it.

⚖️ What we would not claim

None of this is legal advice and we are not qualified to give it. The jurisdictional picture differs materially between Delaware, Germany, the UK, India and Australia, and much of the current writing is law firm commentary rather than decided law.

What we would say with confidence is narrower. Oversight you cannot evidence is not oversight. A control you removed under deadline is a decision the board should have seen. And a failure mode your detection system cannot see is not covered by your risk register, however many times AI appears on it.

📅 Where to start

With one system, not a framework.

Take the AI system your organisation depends on most, and walk the four questions against it. Where the data sits, what can be revoked, who fixes it at 02:00, whether exit has been tested.

It takes an afternoon, it produces a real answer, and in our experience it reframes a board conversation that has been circling for a year. 🎯

Request a governance review of one system: mejuvante.ai/enquiry-1