AI Risk for Boards: What Directors Must Know in 2026

Artificial intelligence is generating material risk faster than most board governance frameworks were designed to manage. These risks are no longer theoretical. In 2024, an international airline was held liable after its AI chatbot provided incorrect refund information to a customer.¹ Earlier, a major technology company discontinued a recruitment AI after audits revealed it systematically downgraded applications from women.² These failures are early indicators of AI risk for boards that can no longer be treated as a technology management issue.

This risk now spans regulatory, legal, financial, operational, and reputational domains. Directors who have historically overseen technology risk at a distance may now need to develop sufficient fluency in artificial intelligence risk management to ask informed questions, demand credible reporting, and hold management accountable for AI systems that affect the organization’s obligations, stakeholders, and public trust.

What Does AI Risk Mean for Boards?

AI risk for boards can fundamentally differ from the technology risks directors are accustomed to overseeing. Traditional technology risk (think outages, cybersecurity incidents, infrastructure failures) is often visible and containable. AI risk categories behave differently: they can remain undetected, scale rapidly, and generate organization wide exposure.

Three dynamics make board AI oversight particularly challenging. First, AI systems can produce outputs that appear reasonable while embedding systematic error or AI bias. Second, AI drift means models that perform accurately at deployment may degrade over time as real-world conditions change. Third, regulators in the EU, United States, and other major markets are moving from voluntary guidance to enforceable obligations, which may materiallyincrease AI liability for boards.

AI Risk for Boards Explained

For directors, understanding AI risk for boards starts with recognizing that AI exposure is being reshaped in real time by regulators, enforcement agencies, and sector rules. What was once managed through internal policy and voluntary guidance is increasingly subject to enforceable requirements at the organizational level. The specific duties vary by jurisdiction and the organization’s role, but boards may need to maintain active, documented oversight to support compliance and demonstrate effective governance.

The Evolving Regulatory Landscape

The regulatory environment governing AI governance for board directors has shifted rapidly from voluntary principles to enforceable law. The EU AI Act, adopted in July 2024 and entering phased effect beginning in 2025, establishes binding obligations for organizations deploying AI in European markets, including conformity assessments, human oversight, and documentation standards for high risk systems under a formal AI governance framework. Enforcement provisions include significant penalties under Article 99.

In the United States, the regulatory picture is more fragmented but no less consequential. The SEC has signaled expectations around AI disclosure and governance for public companies. The FTC has brought enforcement actions related to algorithmic decision making. Sector‑specific regulators are developing AI guidance at a pace that makes ongoing board AI oversight essential.

AI liability for boards is no longer theoretical. Accordingly, organizations that have not integrated AI regulatory tracking into governance processes are likely operating behind the compliance curve.

Key AI Risk Categories for Board Oversight

As a governance best practice, board AI oversight should encompass a broader set of AI risk categories than many current governance frameworks reflect, including risks created when directors or executives use AI tools outside approved processes or board visibility:

• Reputational and ethical risk: AI systems that produce discriminatory outcomes, reflect embedded AI bias, or lack transparency can cause reputational harm that outpaces legal liability.
• Cybersecurity risk: AI systems expand the attack surface through prompt injection, model poisoning, and adversarial inputs.
• Legal and compliance risk: AI systems used in credit, employment, benefits, or healthcare are subject to overlapping regulatory regimes requiring active artificial intelligence risk management.
• Operational and strategic risk: AI drift can introduce systematic errors without triggering alerts, while dependency on opaque AI systems increases strategic exposure.
• Shadow AI risk: Directors and executives may use unapproved AI tools outside board oversight to summarize materials, analyze sensitive information, or draft communications, creating governance, confidentiality, and compliance risks that remain invisible to the board.
• Board information governance risk: When confidential board materials are entered into consumer AI systems outside approved processes, organizations may lose visibility into how information is stored, processed, retained, or shared.

To reduce these exposures, boards should establish clear policies for AI use with confidential materials, define approved platforms for governance activities, educate directors on acceptable use, and require periodic reporting on AI usage patterns.

Hidden AI risk categories warrant particular attention:

• Phantom expertise: Organizations may overestimate their AI governance framework maturity due to vendor reliance or insufficient internal capability.
• Deskilling: Over‑reliance on AI systems can erode the human competence required for effective oversight.
• Organizational blindness: Plausible AI outputs can mask systematic failure unless monitoring detects subtle degradation.
• Readiness risk: As information volumes grow and decision cycles compress, boards may struggle to maintain situational awareness and identify relevant signals quickly enough to support effective oversight and decision-making.
• Capability inequality: Uneven AI adoption across boards may create disparities in preparedness, analysis, and influence, making it important to ensure AI-enabled decision support is consistent, governed, and aligned with expectations for effective oversight.

Fiduciary Duty and AI: What Directors Must Understand

While fiduciary duty AI obligations are not explicitly codified in most jurisdictions, the governing logic is clear: directors who fail to exercise informed oversight of AI risk for boards may face accountability consistent with other governance failures.

For directors, this may implicitly create three obligations:

• A duty of care extending to artificial intelligence risk management
• A duty of loyalty requiring governance decisions aligned with stakeholder interests
• A duty to act when AI risk indicators surface

Boards may delegate execution, but ultimate responsibility generally cannot be delegated. Reliance solely on management assurances without structured board AI oversight and independent validation would likely fall below regulatory expectations.

Building an AI Governance Framework

An effective AI governance framework at the board level should include the following four elements:

• Define AI risk appetite: Boards should clearly articulate acceptable AI risks, aligned to strategy and values.
• Audit the AI supply chain: Third‑party AI must meet the same governance standards as internal systems.
• Mandate risk dashboards: Boards need visibility into AI bias, AI drift, system inventory, and compliance status.
• Build AI fluency: Boards and executives require sufficient literacy to evaluate AI risk reporting credibly.

The AI Oversight Checklist for Directors

This AI oversight checklist helps distinguish substantive governance from procedural compliance. Boards should pursue clarity on:

• Inventory of AI systems
• Decision impact and exposure
• Controls addressing AI bias and AI drift
• Monitoring thresholds and escalation
• Clear ownership of AI liability

Governance Technology That Supports AI Oversight

As board AI oversight responsibilities expand, governance technology plays a critical enabling role. Nasdaq Governance Solutions supports boards with tools that help institutionalize structured workflows, controlled documentation, and reliable communication between directors and management reinforcing defensible AI governance practices for board directors. Platforms such as the Nasdaq Board Portal help boards manage sensitive governance materials, oversight agendas, and decision records in a way that is designed to be auditable and with security in mind.

Governance technology does not address regulatory compliance directly. However, it supports the conditions under which compliance and effective AI risk management are achievable. Thought leadership resources such as AI in the Boardroom and the Digitizing Governance Whitepaper highlight how boards can modernize governance processes to keep pace with emerging risks, including AI bias, AI drift, and evolving regulatory expectations. For boards building or strengthening an AI governance program, purpose-built tools reduce friction, improve the quality of the governance record, and help ensure that AI risk reporting reaches the right directors at the right time.

Boards seeking to assess or enhance their approach to AI governance can Request a Consultation to evaluate whether current governance structures, documentation practices, and information flows are sufficient to support effective oversight as AI-related board risk continues to grow.

Directors do not need to become AI experts. They need governance processes that surface artificial intelligence risk management issues before they become crises and the organizational commitment to act on what those processes reveal. Boards that establish that standard now will likely be better positioned to demonstrate effective AI governance for board directors when regulators, shareholders, and courts require it.

AI Risk for Boards Frequently Asked Questions

What is an AI board member?

An AI board member typically refers to a director recruited specifically for AI expertise—someone with a background in machine learning, AI ethics, or technology risk who can provide informed oversight of AI-related decisions. A small number of organizations have explored appointing AI systems in advisory or observer roles, though this practice is not widespread and raises its own governance questions. Board-governance guidance generally emphasizes building sufficient AI fluency across the board, supported by clear management accountability and reporting, rather than prescribing a dedicated AI board member.

What are examples of AI risks that have affected companies?

Several documented cases illustrate the range of AI risk categories boards should understand. A major airline was held liable when its AI chatbot provided incorrect refund policy information to a customer the Civil Resolution Tribunal of British Columbia rejected the argument that the airline was not responsible for its AI's outputs. A major technology company discontinued a recruitment AI after internal audits revealed it systematically penalized applications from women.² A U.S. healthcare algorithm was found to systematically underserve Black patients by using healthcare cost as a proxy for medical need.⁴ In each case, the failure mode AI bias, flawed design, or insufficient oversight was detectable through structured audit processes that were not in place. These examples are why board AI oversight must extend beyond strategic endorsement to active, documented governance.

Should boards have a dedicated AI committee?

Whether a dedicated board AI committee is warranted depends on the organization's AI footprint, regulatory exposure, and existing committee structure. For organizations with significant AI deployment in regulated contexts, financial services, healthcare, critical infrastructure, a dedicated AI or technology risk committee may be appropriate. For others, integrating AI risk for boards into the mandate of the audit or risk committee may be sufficient, provided that the committee has the expertise and reporting to exercise meaningful oversight. The more important question is not structured but whether AI risk receives dedicated attention, independent assurance, and regular board-level review — regardless of which committee owns it.

How has AI governance evolved since 2021?

In 2021, AI governance for board directors was largely voluntary. The OECD AI Principles and the EU's proposed AI Act provided frameworks, but enforcement was limited, and board-level obligations were aspirational. Since then, the landscape has changed materially. The EU AI Act was adopted in July 2024 with binding timelines and significant enforcement penalties under Article 99.³ The SEC has signaled AI disclosure expectations for public companies. Enforcement actions related to algorithmic decision-making have increased across consumer protection and financial services regulators. What was a best practice discussion in 2021 is a compliance and AI liability for boards discussion in 2026.

What is the difference between AI risk management and AI governance?

Artificial intelligence risk management refers to the operational processes for identifying, assessing, mitigating, and monitoring AI-related risks model validation, AI bias testing, AI drift monitoring, incident response. AI governance framework refers to the organizational structures, policies, accountabilities, and oversight mechanisms that ensure those risk management processes are functioning effectively, and that boards and senior leadership are appropriately informed. Risk management is what the organization does. Governance is how the board ensures the organization is doing it well and how accountability is maintained when it is not.

Can directors use AI to review board materials?

Directors may use AI tools to support preparation and analysis, but boards should establish clear policies regarding which AI tools are approved, what information may be shared, and how confidentiality, recordkeeping, and governance requirements will be maintained. The key question is not whether directors use AI, but whether that use occurs within a governed framework that aligns with the organization’s risk and compliance expectations.

¹ Moffatt v. Air Canada, Civil Resolution Tribunal of British Columbia, 2024. The tribunal held Air Canada liable for misinformation provided by its AI chatbot regarding bereavement fare refund policy.

² Reuters, Amazon scraps secret AI recruiting tool that showed bias against women, October 2018. The system was trained on resumes submitted over a 10-year period, the majority of which came from men.

³ European Parliament, EU Artificial Intelligence Act, Official Journal of the European Union, July 2024. Enforcement penalty figures reference Article 99 of the adopted regulation.

⁴ Obermeyer et al., Dissecting racial bias in an algorithm used to manage the health of populations, Science, October 2019. The study identified systematic underservice of Black patients in a widely deployed healthcare risk algorithm.