Introducing artificial intelligence (AI) tools into your business is a major challenge but establishing effective AI governance is a whole new story. Imminent regulations, such as the 

 and its equivalents around the world, aim to put in place guardrails for safe and ethical AI use, but there’s a difference between achieving compliance and gaining a competitive advantage. Boards need to provide oversight and guidance that satisfies the dual goals of empowering the company to maximise the potential of AI, while also ensuring its safe, secure and ethical deployment.

Governance should be seen as an enabler rather than a blocker in this scenario — the “good brakes” that allow companies to drive fast in their urgency to realise AI benefits. However, this is still a very new area for businesses and boards — as our recent seminar explored — and there are more questions than answers.

, governance director at Beyond Governance, acknowledged this problem, saying: “The board will look for clarity on what [the business is] seeking to achieve, because it wants an objective that you can measure against — that’s what the board is about.”

Getting that clarity to inform objective-setting is not easy. AI adoption is fast-paced and — partly down to the easy accessibility of GenAI tools — many organisations don’t have visibility of the extent and how it is being used.

, Head of AI, Public Policy and Ethics at PWC believes that, before organisations talk about risk and regulation, the first step is a comprehensive discovery exercise to identify exactly what AI is in use, what it is expected to do, and whether it is successfully doing it.

She advises that businesses subsequently apply governance best practices to AI, focusing on key pillars: “The first is strategic, covering ethics and policy, the second is control that covers governance, risk and compliance and the third is responsible practices looking at bias, explainability, privacy and security.”

However, exercises such as establishing controls to mitigate risk and assigning accountability are academic if the business doesn’t have a complete inventory of what applications use AI, how they use it, and crucially, who owns it.

Maria notes that currently AI is typically being created and implemented by engineers who aren’t tasked with risk management and compliance and don’t operate within a risk management culture. As such, they cannot be the accountable “owners” of AI in the organisation.

The bottom-up nature in which AI is often being deployed in businesses is also adding to the challenge of determining who “owns” it or “should” own it. Ultimately, of course, the buck stops with the board, but directors can feel behind the curve on a technology that is so new and powerful.

, Non-Executive Director and digital transformation specialist, compares it to the elevation of cybersecurity to a board concern, saying: “Today boards talk a lot about cybersecurity, but just add that to the power of X because now the risks are becoming so much bigger because nobody quite understands what GenAI does, what its capabilities are and how powerful it can be.”

Diligent’s Dale Waterman believes that the General Counsel has a key role to play on AI due to the ethical issues involved with the legislation: “We’re in this world of ethics, unlike other laws around cybersecurity and data protection where there is a lot of maturity, we’re in this new space where we are not quite sure who should own this. I think the General Counsel or Company Secretary is going to play an important role […] because you have to marry the ambition of the [AI] strategy and objectives with the reality of what governance will involve.”

PWC’s Maria Axente disagrees, believing that AI ownership must sit at CEO level because that is the only role with ultimate authority over the business. She explains that there’s a sense that “everyone and no one” should own AI, but the CEO is the only person in a position to challenge the status quo across every area from governance, risk and compliance issues to more existential and human topics, such as how employees should be expected to work with AI.

Beyond Governance’s John Davies believes the CEO needs to advocate for AI to counter the board’s natural caution in the face of AI regulation: “We are hearing quite a lot of stick here and not much carrot […] maybe you need someone who’s able to flip that a bit as I worry that boards may focus too much on the risks of what can go wrong.”

Caroline agrees, adding: “It’s the culture set by the CEO and it is top down.” She notes that even with rules in place there can be breaches, citing the Post Office and Volkswagen, saying: “I’m not saying you don’t need rules and frameworks, but ultimately the buck stops with the CEO and with the culture in any organisation.”

Maria believes it is essential to look at who is in the room and has most influence over AI strategy. “You have to be able to look at your culture, the current structure, and say who is best placed and who else needs to be in the room. […] You advocate very much in terms of AI to have three lines of defence and […] an accountability structure that brings everyone together with checks and balances.” She continued: “Ultimately someone needs to orchestrate everyone to sing the same tunes and that’s the CEO.”

Dale emphasised the many roles that will be touched by AI accountability, citing the increased responsibilities many Chief Data Protection Officers are bearing, and how CISOs are becoming more closely involved in privacy programmes.

Diligent toolkit offers guidance as businesses integrate AI

As the robust debate in our seminar demonstrates, there is a lot of work to do to establish lines of responsibility and accountability that will enable effective board oversight of AI. It’s a fast-moving landscape and there is a lot to learn at all levels from directors to GCs and executive team members.

Diligent has a range of resources for customers and their employee to support AI learning and increase familiarity with the issues around AI integration and use. These include certifications for board directors and at a more comprehensive level, our 

 supports organisations to assess where AI risk and compliance issues lie.

Governing AI: Obligations, ownership and oversight

Two years after the public release of ChatGPT, the potential and pitfalls of generative AI are still the subject of fierce debate. Artificial intelligence (AI) has been waiting in the wings for half a century —and has been applied to many use cases behind the scenes — however, it is the advent of generative AI, with its ability to engage in unsupervised learning and create new content, that has catapulted it to centre stage.

Now, the focus has evolved from the novelty of generating poetry and parking-fine appeals to urgent exploration of its deeper commercial and societal applications. At the same time, regulation has pursued AI with atypical alacrity, with the 

set to enter into force in 2025 and other jurisdictions swiftly following.

This dynamic landscape poses problems for corporate boards who are in the tricky position of needing to offer challenge and counsel on the strategic approach to implementing technology that is novel, broad in application, fast-changing and powerful.

Diligent recently convened a panel experienced in AI development, ethics and implementation, as well as board governance, to explore the issues boards face as they aim to oversee the strategy, governance and guardrails of AI.

1. Board AI maturity varies — but they all need to up their game

, Non-Executive Director and digital transformation specialist, noted that businesses are already using AI extensively. For boards, the decision is not whether to adopt AI, any more than they were involved in deciding whether the business would use spreadsheets thirty years ago. But, she warned that some boards are not talking about AI at all, and that is a risk.

, Head of AI, Public Policy and Ethics at PWC and a responsible AI pioneer, believes that boards need to up their game, saying: “At board level there needs to be a balance point recognising [AI’s] potential and downsides […] Disruption is coming one way or another and the board needs to support the executive team to navigate that.”

Providing the right level of challenges and questioning will be essential, but accessing AI expertise is going to be a core challenge at both board and executive level. Businesses are behind the curve, says Caroline: “I’ve been doing a lot of board recruiting and AI knowledge is not even part of the selection criteria – not even as a nice-to-have […] It’s one area that really needs to change. Every board needs to start thinking about AI, not just for board members, but for generally for recruiting CEOs and CFOs, because if your C-Suite is not comfortable talking about AI you may as well not bother.”

Maria agrees: “You need someone on the board who can understand IT people, otherwise you’ll be talking two different languages.”

2. A “wait-and-see” approach is a risk with AI

Boards are often naturally cautious, and few are confident to endorse a first-mover strategy where technology is concerned and risk backing the wrong horse. However, the incredible pace of AI evolution means that a “wait-and-see” approach has higher than usual risk. Even conventional technology projects have fallen foul of being obsolete by the time they have passed through traditional approval routes; AI moves orders of magnitude faster.

Diligent’s Strategic Market Solutions Lead, 

, summed up the situation: “There are two extremes of people, those who are excited about AI and those who are worried, but the biggest risk is the people who decide to wait and see. Of course, we need to manage the risk and governance side of AI, but it is big, it’s going to change everything. You have to start acting now and choosing the path for the journey. Inertia is not a good thing”

Caroline agreed that speed is important if you plan to integrate new technology into your business with a degree of confidence that it will still be cutting edge by the time it’s implemented, adding: “It starts with people – you need people in your organisation that are savvy enough to know the changes going on in different technologies, otherwise you are reliant on vendors.”

Maria acknowledged the difficulty of accessing expertise and basing strategy on predictions in such a fast-moving market, but advised that directors “listen (with a pinch of salt) to some of the technology leaders” to get a sense of the macro tech trends shaping the market.

Despite the speed required for AI implementation, it is essential that it is also meaningful for the business. Maria highlighted the difficulties organisations face in translating standalone GenAI proof of concept experiments into “something meaningful for the business that doesn’t break things and has the safeguards around it to be able to scale with confidence.” Traditional project management approaches are not really fit for purpose in this scenario and businesses will need to reinvent project management for the AI era.

4. A significant cultural shift is required

The evolutionary nature of technology, and especially AI, demands a shift in how businesses and boards think about it. Dale advises viewing AI as a continuing journey, rather than a project with a completion date. However, historically boards have struggled with committing to large-scale organisational change.

Maria recalls that ultimately it took the COVID-19 emergency, rather than drive from senior leaders, to fully realise digital transformation and remote working. She warns that a similarly cautious approach to AI will risk a business ending up one of the “many losers” in the AI era.

5. Continuous learning must be part of the board and business mindset

The panellists agreed that relatively few directors and executives are taking a personal interest in GenAI and learning how to use it themselves. This limits their practical understanding of its potential.

Dale emphasised that no one has all the answers on AI right now, but what’s important is the willingness to learn about it, saying: “We need to build a culture of self-learning – everyone in the room from kids to CEOs and boardrooms, we all need to invest ourselves and AI – everyone needs to be upskilled in this.”

, Governance Director at Beyond Governance, agreed and raised the point that directors cannot limit their AI exposure to quarterly board meetings: “We can’t have directors relying on board meetings as their sole source of information on AI; they need to be informed and curious themselves.”

Caroline Cartellieri is slightly sceptical that businesses need a specific ‘AI strategy’, reasoning, “You wouldn’t have had an ‘Excel strategy’ thirty years ago”. Instead, she advises companies to build their company strategy and goals in the context of using AI to achieve them.

However, a strategy with a clear AI component is an important signal for the business, believes Maria Axente, alerting stakeholders to the fact that change is coming.

Ultimately, we are in a period of volatility as the potential and pitfalls of AI come under board scrutiny, and they seek to find the balance between risk and reward. Directors need to invest personal time in improving their AI awareness and push back against institutional caution and inertia while also ensuring that AI deployment is relevant and meaningful.

As one seminar attendee aptly summarised the challenge, “You want to see that things have been tried and tested and are going to work, letting someone else do the hard yards for you. But the risk is you’ll find yourself too far behind. However, if it’s a question of committing resources in terms of people, money, and change management, you need to put forward a better concept than ‘everyone is doing AI so we must do it too!’”

Want to know more about proactively implementing AI in a way that is both secure and innovative?

 to download our white paper on demystifying AI.

Diligent

Blog

Governing AI: Obligations, ownership and oversight

Culture shock: How should boards navigate the GenAI goldrush?

Solutions

Resources

Company

Your Data Matters

Diligent

Blog

Governing AI: Obligations, ownership and oversight

Culture shock: How should boards navigate the GenAI goldrush?

SolutionsSolutions

ResourcesResources

CompanyCompany

Your Data Matters

Solutions

Resources

Company