Boards Need to Step Up on AI

Key Takeaways

• Two‑thirds of directors admit insufficient AI knowledge (EY, 2025).
• Only 26% discuss AI at every board meeting (Protiviti, 2026).
• STAR framework offers four recurring questions to govern AI quarterly.
• Clueless boards miss value; FOMO boards invite legal and reputational risk.
• Distribute AI oversight across risk, audit, and talent committees.

Pulse Analysis

The rapid emergence of autonomous AI agents capable of self‑propagation has shifted the risk landscape from speculative to operational. While regulators such as the EU AI Act impose liability on firms whose models touch European markets, the United States still lacks a federal AI governance framework, leaving boardrooms as the de‑facto line of defense. Companies that ignore this shift risk not only data breaches and algorithmic bias but also material financial penalties and eroded investor confidence. Board members must therefore upgrade their technical fluency and embed AI oversight into existing governance structures rather than treating it as a peripheral compliance checkbox.

To translate strategic intent into actionable oversight, the authors introduce the STAR framework—Shareholder value thesis, Threat parity, Ability, and Risk budget. Each pillar translates into a set of quarterly metrics that can be reported to the appropriate committee: risk committees monitor threat evolution, audit committees verify data‑quality and control effectiveness, and human‑capital committees assess talent pipelines. By treating AI risk as a portfolio rather than a binary danger, boards can allocate capital to high‑impact projects while setting clear red‑lines for unacceptable exposure. This disciplined approach mirrors credit‑risk management in banking, where risk is priced, not eliminated.

Operationalizing AI governance also requires cultural alignment. Boards must move beyond “vibe governance”—policies without accountability—and demand evidence of outcomes. The STAR questions compel directors to ask where AI creates measurable shareholder value, whether defenses keep pace with AI‑driven threats, if the organization possesses the data and talent to execute, and how risk tolerances are budgeted and enforced. Companies that adopt this power‑steering mindset are positioned to capture AI‑driven growth while safeguarding against the legal and reputational fallout that has already ensnared less disciplined peers.