What Your Board Doesn’t Know About AI And Why That’s a Risk
A director at one of South Africa’s mid-sized financial services firms recently asked me a question I hear far too often: “We’re using AI for a few automation tasks. Do we really need a board-level policy?” Within an hour, we had mapped three different AI tools being used across the company that the board had never been briefed on. One of them was processing client data through an external large language model with no data processing agreement in place. That is the AI boardroom risk in plain sight: not robots taking over, but quietly embedded tools making decisions that affect people, reputation, and regulation while the people charged with oversight are barely aware they exist.
The Boardroom AI Blind Spot
Most boards are not technophobic. They are time-poor and information-starved. AI has moved from an IT project to a company-wide capability faster than most governance frameworks can adapt. In many organisations, AI adoption is happening in marketing, HR, legal, and operations long before the board sees a consolidated picture. The result is a governance gap. Directors are accountable for strategy, risk, and compliance, yet they are often asked to approve AI-related decisions without a clear view of what is actually happening below the surface.
This is not about turning every director into a data scientist. It is about recognising that AI is now a material risk and opportunity, and that board oversight needs to catch up.
The Risks Are Bigger Than the Headlines
The media loves a dramatic AI story: deepfakes, existential risk, and rogue systems. The real risks in the average boardroom are more mundane and more likely.
Data leakage is one. Employees paste sensitive information into public AI tools every day, often without realising that input becomes training data. Regulatory exposure is another. South Africa’s Protection of Personal Information Act and emerging frameworks like the EU AI Act create real compliance obligations for organisations that process personal information through automated systems. Then there is the operational risk of automation without validation: an AI-generated report, contract summary, or customer response that looks plausible but is wrong.
These risks do not grab headlines, but they do show up in fines, lawsuits, and broken customer trust.
Questions Every Board Should Be Asking
The best defence is better questioning. Here are five questions I encourage boards to put to management:
- What AI tools are we actually using? Not just approved projects, but shadow use by teams trying to be more efficient.
- What data are we feeding into them? Personal information, client records, and proprietary strategy should not be sent to unmanaged external services.
- Who is accountable when AI output affects a customer or employee? Accountability must sit with a named person, not a vendor or a model.
- Have we tested for bias, error, and security? Models need validation, especially when used in hiring, credit, or service decisions.
- What is our plan if something goes wrong? Incident response for AI failures should be as clear as it is for a cyber breach or data loss.
If the board cannot get clear answers, that is the answer.
Governance Is Not a Checkbox Exercise
Every organisation needs an AI governance framework, but a document no one reads is useless. Good governance means the board sets the risk appetite, management implements controls, and internal audit verifies that the controls are working. The NIST AI Risk Management Framework offers a practical starting point for organisations building that structure.
It also means keeping the framework alive. AI capabilities change monthly, and a policy written last year may already be out of date. A useful framework covers data protection, model selection, vendor management, human oversight, documentation, and incident response. It should be simple enough that the average manager can follow it and specific enough that the compliance team can enforce it.
The World Economic Forum’s AI Governance Alliance has also published useful guidance for leaders trying to move from concern to action.
Ethics Cannot Be an Afterthought
In my book Business Ethics in the Age of AI: Faith, Leadership and the Future of Work, I argue that ethics is not a separate conversation from risk. It is part of it. Boards that treat AI ethics as a public relations concern will miss the deeper issue: systems that discriminate, exclude, or exploit data erode the very trust the organisation depends on.
There is also a leadership dimension. How a company uses AI signals what it values. Does it use automation to support people or to replace judgement without responsibility? Does it respect customer data, or does it extract value and hope no one notices? These questions go beyond compliance. They shape culture, brand, and long-term resilience. For a practical executive-level take, see the Harvard Business Review article on AI ethics for executives.
Should every board have a dedicated AI committee?
Not necessarily. What matters is that AI is a standing agenda item for risk, audit, or strategy committees, with clear ownership and reporting lines.
How technical does the board need to be?
Directors do not need to code. They do need enough literacy to ask hard questions, understand vendor claims, and recognise when they need independent advice.
Is AI really a board issue, or should it stay with IT?
AI is no longer an IT issue. It affects strategy, risk, legal, operations, and people. The board cannot delegate oversight of something that crosses every function.
What is the first practical step for a board that has not discussed AI yet?
Start with an AI inventory: a simple, honest list of what tools are in use, what data they touch, and who owns the risk.
Conclusion
AI is not the future of business leadership. It is already part of it. The question is whether boards are leading that reality or reacting to it after something goes wrong. The organisations that get ahead will be the ones whose directors ask uncomfortable questions early, put governance in place before it is forced on them, and treat ethics as a strategic asset rather than a compliance cost.
If your board needs an independent perspective on AI governance and cybersecurity, let’s have a conversation.
