AI governance is no longer a management-level discretionary matter. Boards of publicly traded companies, regulated financial institutions, and major private organizations now face explicit expectations – from regulators, shareholders, and insurers – that they will exercise meaningful oversight of AI risk. The era of delegating AI entirely to the technology function and receiving no board-level reporting is over.
This chapter is a practical briefing for directors and the executives who prepare board materials.
What Boards Must Approve, Monitor, and Document
At a minimum, the board’s AI governance responsibilities encompass three domains:
Approve. The board or its designated committee should formally approve the organization’s AI governance policy, including the risk appetite for AI deployment, the categories of AI use cases requiring senior leadership sign-off, and the framework used to assess AI risk (such as NIST AI RMF or OSFI E-23). It should also approve any AI deployments that carry material regulatory, reputational, or financial risk, consistent with the organization’s existing escalation policies for technology risk.
Monitor. The board should receive regular reporting – at minimum annually, and more frequently for high-risk or fast-moving AI programs – on: the organization’s AI inventory and the risk classification of deployed systems; the results of model validations and audits; any material AI incidents, near-misses, or regulatory inquiries; and the status of compliance with applicable regulatory requirements including OSFI E-23 (for Canadian FRFIs) and Quebec Law 25 (for organizations processing Quebec resident data).
Document. Board discussions of AI risk and oversight decisions should be recorded in minutes, consistent with directors’ duties and any applicable regulatory guidance. Documentation is particularly important given the SEC’s enforcement posture on AI disclosure (discussed below) and the potential for director liability in AI-related failures.
OSFI Guideline E-23 and Board Obligations for Financial Institutions
For Canadian federally regulated financial institutions – banks, trust companies, insurers, and foreign bank branches – OSFI Guideline E-23 (updated September 2025, effective May 2027) creates explicit board-level obligations. As Torys LLP’s analysis of the updated guideline confirms, the guideline requires FRFIs to:
- Establish clear roles and responsibilities for model risk management extending from the board to operational teams.
- Maintain enterprise-wide model inventories with board visibility into high-risk model classifications.
- Ensure the board receives transparent reporting on model risk assessments, validation results, and emerging model performance issues.
- Apply these requirements to all models, including AI and machine learning models, regardless of source – internal or vendor-supplied.
Protiviti’s analysis of OSFI E-23 implementation notes that the guideline establishes a culture of risk-aware innovation by requiring board accountability at each stage of the model lifecycle.
The ICD and Director Education
In Canada, the Institute of Corporate Directors (ICD) offers the Board Oversight of Artificial Intelligence (BOAI) program, a blended learning course designed to equip directors with the knowledge and tools needed for confident boardroom discussions of AI’s impact, risks, and opportunities. For directors who have not yet engaged with formal AI governance education, this program – led by governance and AI law experts including Carole Piovesan, Managing Partner of INQ Law – represents a recognized baseline.
The NACD (National Association of Corporate Directors) has published a Director’s Handbook supplement specifically on AI in cybersecurity, addressing the intersection of AI governance and cyber-risk oversight that boards must navigate simultaneously. The Deloitte Global Boardroom Program’s second edition survey – covering 700 board directors and executives across 56 countries – found that nearly a third of respondents said AI is not on the board agenda, and two-thirds said their boards have “limited to no knowledge or experience” with AI, though both figures show improvement from prior surveys.
SEC Enforcement: AI Washing and Disclosure Obligations
For organizations with U.S. public company obligations or U.S. investor bases, the SEC’s posture on AI disclosure has moved from guidance to enforcement. In March 2024, the SEC settled its first AI-related enforcement actions against Delphia (USA) Inc. and Global Predictions Inc. – two investment advisers that had made false or misleading statements about their use of artificial intelligence.
Delphia had claimed to use client data and AI to predict investment trends; it had not. Global Predictions claimed to be “the first regulated AI financial advisor” and to use “expert AI-driven forecasts,” neither of which was substantiated. The SEC characterized this as “AI washing” – overstating AI capabilities to attract investors – and found both advisers in violation of the Investment Advisers Act’s marketing rules. As Crowell and Moring’s analysis notes, this represents the principle of “say what you do, and do what you say” applied to AI marketing claims, but the enforcement signal is clear: substantiate every AI capability claim that could be material to investors or clients.
Director Liability and D&O Implications
Director liability for AI failures is emerging across Caremark duty doctrine (in the U.S.) and equivalent director obligations under Canadian corporate law. NACD’s guidance on directors and emerging risks notes that D&O insurance carriers are now asking targeted questions about AI governance in underwriting – including what AI models are in use, how they are governed, and what the organization’s incident response process is. Some carriers are affirmatively excluding AI-related claims from coverage; others are offering specialized AI liability products. Boards should understand their organization’s D&O coverage position relative to AI risk before an incident occurs.
Questions Every Board Member Should Be Able to Answer
Based on the governance frameworks issued by NACD, ICD, Deloitte, and OSFI, the following questions represent a minimum baseline for board-level AI literacy:
- What AI systems does our organization use, and have they been classified by risk level?
- Who in management is accountable for AI governance, and how does it connect to our existing risk committee structure?
- Have our highest-risk AI systems been independently validated or audited in the past 12 months?
- Do we have an AI incident response procedure, and has it been tested?
- What regulatory obligations apply to our AI use – specifically, what does OSFI E-23 require of us, and by when?
- Have we reviewed any AI-related claims in our external disclosures, marketing materials, or investor communications for accuracy?
- Are we monitoring our AI systems for performance drift, bias, and adversarial manipulation after deployment?
