Recently, I stood in a room of supervisory board members, general counsels and corporate secretaries in Munich and asked a question I've been putting to boardrooms around the world: When did corporate governance last fundamentally change?
The honest answer is a long time ago. Some would say it looks much as it did when it was first established at the Bank of England in the 1680s. Structure, committees, a cycle of meetings, a body of people providing oversight. The mechanics haven't shifted much.
And yet we now have a technology moving faster than any we've dealt with before. One that is already inside the boardroom, whether boards know it or not.
Our most recent Diligent Institute research found that 82% of US public-company directors are now using AI, up from 66% less than a year earlier. But 49% are using unsecured, off-the-shelf tools. 69% have no formal AI-use policy at all. And only 6% have one specific to the boardroom. The gap between use and governance is where the real risk accumulates.
Munich was the first stop in a global listening-post series we're running in partnership with the New York Stock Exchange as we develop a blueprint report on the future of corporate governance. Here's what the room helped us understand.
One of our speakers was Brando Benifei, a Member of the European Parliament and one of the chief authors of the EU AI Act. His message was unambiguous: We are no longer in the legislation phase. We are in implementation, and implementation is moving into enforcement.
Transparency provisions are live now: Labeling AI-generated content, protecting intellectual property across the AI supply chain, requiring clearer disclosure from providers. High-risk use cases, including AI in the workplace, will be fully regulated by the end of 2027.
For organizations in the DACH region, the practical agenda is concrete: Establish an AI inventory, agree boardroom-specific rules for approved tools and data, assign management ownership with board-level oversight and build recurring AI literacy into board work. "We're working on it" is no longer a safe place to stand.
Our research with general counsel and legal professionals maps the risks boards are most likely to underestimate. Four keep surfacing: Oversight, privacy, process integrity and defensibility.
One story I heard over the summer in particular has stayed with me. A board conducting a scenario planning exercise decided to use ChatGPT to model a fictional hostile takeover attempt. Everyone in the room knew it was fake. The problem was, the AI model didn't. Multiple board members and senior leaders were entering the same scenario. The AI treated it as credible information, and it found its way into a press report. The share price moved.
This is what using a consumer AI tool for board work looks like in practice. Without the right security measures in place, every prompt a director enters and every output the model generates leaves the building. Most directors using free AI tools for board preparation might not know that.
Away from the panel, our breakout sessions produced three questions that every board should be asking, starting now.
A recurring theme across the day was board composition. The room broadly agreed on something I find encouraging: You don't need an AI expert on your board.
What you need are directors with business-relevant technology fluency and the judgment to ask harder questions. Adaptability and emotional intelligence matter as much as domain expertise, perhaps more. AI transformation reshapes how people work, what skills matter and whether employees trust the organization they work for. That sits squarely within the board's remit.
Structure needs to evolve alongside this. The quarterly rhythm was built for a world AI doesn't live in. Boards are beginning to explore secure AI agents as analytical support, more flexible meeting cadences and a shift toward continuous monitoring rather than periodic review.
" This isn't implementing a SaaS system. This is changing how your entire workforce operates. You need visionaries. You need people who are adaptable and can lead through continuous change "
— Suzanne Brown, Director of Board Services, NYSE
AI should free boards to do the work they actually exist for: Strategy, scenario testing and looking around the corners that management is too close to see clearly. But only inside a governed, auditable environment.
The fact that 94% of companies have no boardroom-specific AI policy is a starting point, not an indictment. Diligent Institute and our Governance Business Unit have published a free AI-use policy template for the boardroom. Take it, use it and make it your own. A policy that directors have read, understood and discussed is worth considerably more than one that exists on paper but hasn't been opened.
"We have an obligation as leaders to not let AI go the way of cyber. In my view, that was a catastrophic failure, given that the controls and the opportunities to prevent it existed over 25 years ago."
— Dominique Shelton Leipzig, Founder and CEO, Global Data Innovation
At Diligent, our own approach has been to treat governance as the precondition for innovation, not the obstacle to it. Before we released any AI product, we formed our AI Governance Committee: A cross-functional group spanning product, data security, legal, compliance and senior leadership. Before that product reached market, we published a certification program for directors, AI Ethics and Board Oversight, because we believe education has to come before deployment. Security first. Always.
The thing I kept coming back to is that boards have more influence over how AI governance develops than most directors seem to realize. AI reached the boardroom before governance caught up.
Closing that gap is the work in front of every board. Diligent Elevate in Orlando, 7–9 April 2027, is where a lot of that work will happen in person: I come away every year with the kind of clarity you only get from being in a room with people asking hard questions out loud. And given everything moving in this space right now, I have a feeling 2027 is going to be the best one yet. See what’s shaping the 2027 Elevate agenda.
