Why AI Governance Is Becoming a Boardroom Issue

As companies expand their use of AI, boards are being pushed to look beyond technical controls and ask harder questions about strategy, risk appetite, culture and accountability.

Artificial intelligence is moving deeper into corporate decision-making, operations and customer-facing systems, but many boards may still be treating AI governance primarily as a technical management issue.

That is the central argument made by governance, AI and cybersecurity advisor Bruno Horta Soares in his recent article, The Boardroom After AI. He argues that companies can build detailed AI governance frameworks, complete with model inventories, validation procedures, ethical safeguards and reporting structures, yet still fail to answer a more fundamental question: what exactly is the board governing?

The distinction matters because operational oversight and corporate governance are not the same thing. A business may have strong technical controls around AI while still lacking clarity on whether a particular use of AI aligns with strategy, sits within risk appetite or changes the organisation’s standards of conduct.

AI Governance Is Not the Same as Governing AI at Board Level

Companies have responded to successive waves of technology by building specialist governance structures around IT, data, cybersecurity and digital transformation. AI is following the same pattern.

Soares argues that this creates a risk of fragmentation. Specialist structures may be individually useful, but boards can end up receiving more reports, more metrics and more assurance without necessarily gaining more insight into enterprise-level accountability.

His core distinction is between AI governance, which concerns how AI systems are developed, validated, monitored and operated, and the corporate governance of AI, which asks whether the organisation should use those systems in the first place, under what limits and with what accountability.

For businesses, that difference is becoming increasingly important as AI moves from productivity tools into areas such as hiring, credit, customer service, cybersecurity, supply chains and strategic decision-making.

Boards Need to Focus on Purpose and Risk Appetite

A technically effective AI system can still create business risk.

Boards therefore need to ask whether an AI initiative serves the company’s strategy, whether the associated risks are acceptable and whether there are uses that should remain off-limits even if they are technically possible or commercially attractive.

Soares groups board responsibilities around four areas: supervision, risk, culture and restraint.

Supervision means understanding where AI has become material to the enterprise. Risk means defining what exposure the company is prepared to accept. Culture concerns how AI changes behaviour inside the organisation. Restraint means directors remaining informed enough to challenge management without taking over operational decisions.

This creates a more business-focused model for AI oversight. The board does not need to decide which model architecture to use or how to configure technical controls. It does need to determine where accountability sits and what boundaries management should operate within.

AI Can Change Corporate Culture Without a Formal Decision

One of the less discussed effects of AI is its influence on organisational culture.

AI systems can make certain behaviours faster and easier while making others less necessary. Over time, employees may rely less on their own judgment, research or professional experience if automated systems routinely provide answers first.

Soares warns that a system can be technically successful while still weakening professional judgment or obscuring responsibility.

That creates a challenge for business leaders because cultural change can happen gradually, without a formal board decision.

If AI begins to influence how employees make decisions, communicate with customers or evaluate risk, directors may need to treat those effects as part of governance rather than as secondary technology issues.

More Reporting Does Not Automatically Mean Better Governance

Another emerging problem is the quality of information reaching boards.

AI makes it easier to produce polished reports filled with strategic language, but that does not necessarily make the information more useful for governance.

Soares argues that board reporting should connect technical information to material exposure, risk tolerance, management response and the decision actually required from directors.

A cybersecurity report, for example, may accurately describe phishing rates, authentication controls and employee training. But directors still need to know whether the current exposure exceeds the company’s tolerance, what management proposes to do about it and what trade-off requires board direction.

The same principle applies to AI.

Metrics on model performance, validation and usage are useful, but they do not answer whether a company should accept a particular AI-driven risk.

AI May Test the Limits of Traditional Board Oversight

Soares also argues that some AI systems may eventually put pressure on traditional governance structures because they operate faster than boards can respond.

He identifies four areas that could test existing oversight: decision latency, explainability, accountability stability and reversibility.

If AI systems make material decisions faster than the organisation can detect and escalate problems, oversight can become too slow. If directors cannot understand the factors behind an AI-driven decision, governance becomes harder. Accountability also weakens when responsibility is spread across vendors, teams and jurisdictions.

Reversibility may be the most important issue. Where AI decisions affect rights, safety, reputation or strategic position in ways that cannot easily be corrected, governance may need to happen before deployment rather than after a problem appears.

The Boardroom Question Is Becoming More Strategic

The business implication is that AI governance may need to become less about creating new committees and more about connecting AI to existing corporate responsibilities.

Boards should understand where AI has become an enterprise dependency, which risks are acceptable, what behaviours it is encouraging and where management authority begins and ends.

That does not mean directors need to become AI engineers.

It means they need to remain accountable for strategy, risk and conduct even as the technologies influencing those areas become more complex.

As AI expands across the enterprise, the strongest governance model may not be the one with the most specialist frameworks. It may be the one that keeps AI connected to the same core questions boards have always been responsible for: what the organisation is trying to achieve, what risks it is willing to take and who remains answerable when things go wrong.

About Bruno Horta Soares

Bruno Horta Soares is an executive advisor focused on governance, AI and cybersecurity. He is the founder of GOVaaS, President of ISACA Lisbon and author of The Boardroom After AI: Corporate Governance for AI, Cybersecurity and Digital Risk. His work explores how boards can maintain strategic oversight and accountability as technology becomes more deeply embedded across organisations.