Key points

• Directors' oversight duties apply to artificial intelligence. Under Delaware law, the Caremark line of cases requires a board to make a good faith effort to implement and monitor a reporting system for mission-critical risks.
• Regulators are active. The SEC has pursued misleading statements about AI capabilities, often called AI washing, and the EU AI Act places governance duties on providers and deployers of certain systems.
• A board does not need technical expertise in every model. It needs a clear inventory, defined accountability, escalation thresholds and regular reporting.
• Recognized frameworks, including the NIST AI Risk Management Framework and ISO/IEC 42001, give boards a defensible reference point.
• Minutes and materials matter. Oversight that cannot be shown is hard to defend, so documentation should be planned and proportionate.
• The right structure depends on how central AI is to the business. For some companies it belongs with the full board, for others with the audit, risk or a technology committee.

Why this is a board issue

Artificial intelligence now sits inside core processes at many companies: pricing, credit decisions, hiring, customer service, product design, fraud detection and software development. A failure can create legal liability, reputational harm and operational disruption at the same time. That is the kind of risk boards are expected to oversee, and directors, investors and regulators increasingly ask what the board knows and what it has done.

Our work with boards across sectors shows a common pattern. Management has plenty of activity, such as pilots, vendor deals and policies, but the board sees fragments. The gap between activity and oversight is where problems develop.

The legal foundations

In Delaware, directors owe fiduciary duties of care and loyalty. The Caremark cases hold that a failure of oversight can breach the duty of loyalty if directors utterly fail to implement a reporting system or consciously ignore red flags. Later decisions have applied the principle to mission-critical compliance risks, including product safety, and have extended related oversight expectations to officers. Whether AI is mission critical depends on the company. For a business that sells AI-enabled products or relies on automated decisions in regulated areas, it may well be.

Disclosure is a second foundation. The SEC has brought actions against companies that overstated their use of AI or made unsupported claims about AI capabilities, and it has signaled that it expects risk factor disclosure that is specific to the company rather than generic. Directors who approve public statements should understand how claims about AI are substantiated.

Sector and regional rules apply on top. The EU AI Act imposes obligations that depend on role and risk category, including governance, documentation, human oversight and, for deployers of high-risk systems, monitoring and impact assessments. For general-purpose models, see our note on what deployers need to know. In the United States, state laws such as Colorado's AI Act place duties on deployers of high-risk systems, and regulators in employment, financial services and health care apply existing law to AI.

What oversight that holds up looks like

Inventory and classification. The board should be confident that management knows where AI is used, who owns each use, and which uses are high-risk because they affect people's rights, safety or access to services, or because they affect financial reporting. The list does not need to be perfect, but it needs a process and an owner.

Accountability. Responsibility should be assigned to a named executive, and the board should assign oversight to a committee or to the full board. Charters should be updated so that the allocation is visible. Overlap among the audit, risk, technology and compensation committees should be managed.

Policy and risk appetite. The board should see an AI policy that addresses acceptable uses, approval for high-risk uses, human oversight, testing, data sourcing, third-party tools and incident response. It should also set out in terms what the company will not do.

Reporting and escalation. Regular reports should be short and consistent. They should show new high-risk uses, incidents and near misses, results of testing and audits, regulatory developments, and open decisions. Thresholds for escalating incidents to the board should be defined in advance.

Vendors and contracts. A great deal of AI risk comes through suppliers. Boards should ask how procurement tests vendors, what contract protections exist, and how the company would learn about a failure. Our note on procuring AI lists the terms that matter.

Frameworks. Aligning with the NIST AI Risk Management Framework or ISO/IEC 42001 gives structure, shows reasonable care and makes it easier to demonstrate compliance to regulators and counterparties. Some state laws, including Colorado's, treat conformity with a recognized framework as relevant to a defense.

Questions directors can ask

What are our most important uses of AI, and what would a serious failure look like? Who is accountable for each, and how do we know the controls work? What have we told investors and customers about our AI, and what supports those statements? How do we find out about incidents, and when does the board learn of them? What do our key vendors promise, and what happens if they are wrong? Which laws apply in the places we operate, and what is the plan for the ones coming into effect?

Questions are most useful when the answers are recorded. Board materials and minutes should reflect that the issue was discussed, what information was considered and what follow-up was directed, without creating unnecessary detail that invites misreading.

Common mistakes

Treating AI as an IT issue only, so that legal, risk and business leaders are not involved. Relying on a policy without testing whether it is followed. Overstating capabilities in marketing and investor communications. Assuming that a vendor's assurances transfer the risk. And waiting for final regulation, when existing law already applies.

Corvane Ryle's Artificial Intelligence practice and our corporate governance lawyers advise boards on oversight structures and on the legal exposure around AI. Our AI leadership page describes how we approach the technology in our own practice, and our directors' update covers other current board topics.