There's a moment that happens in boardrooms more often than anyone admits.
The CEO presents the quarterly update. Somewhere in the deck — slide eleven, maybe twelve — there's a section on AI. New tools deployed. Efficiency gains projected. A risk register reference. The board nods. Someone asks about data security, not about AI. The CTO answers respectfully. The chair, not being familiar with AI, moves the agenda on.
No one in that room asked a relevant question. No one was asleep. And yet nothing was actually overseen.
This is the quiet governance failure of the AI era. Not dramatic. Not scandalous. Just a gap — between accountability that exists on paper and engagement that exists in practice.
The numbers that should trouble every board
Here's the data. PwC's 2025 Board Effectiveness survey found that while nearly half of C-suite executives flag AI as a major risk area for their organisations, only 10% of directors see it as a major risk. That's not a rounding error. It's a structural disconnect between the people running the business and the people overseeing it.
The NACD's 2025 Public Company Board Practices and Oversight Survey adds texture to that picture. Sixty-two percent of directors now say they make time to discuss AI at the full board level — up from 28% in 2023. Progress, clearly. But of those same boards, only 23% have actually assessed how AI disruption might affect their company's strategy or long-term viability. Directors are talking about AI. Most haven't yet connected it with strategy or the long-term future. In other words, they haven't yet governed it.
Russell Reynolds' 2025 Global Corporate Governance Trends research frames what's at stake: what varies across markets isn't whether boards should engage with AI as an element of oversight, but how far along they are in building it into their oversight activities.
The wrong answer is a technology primer
When boards are told they need to "get up to speed on AI," the default response is education. Briefings. Workshops. Vendor presentations. Directors dutifully learn about large language models, neural networks, training data. They come away feeling informed.
They're not yet equipped with the governance tools to oversee it.
There's a distinction worth making here — between AI literacy and AI competence in a boardroom context.
Literacy is knowing what AI is. It's useful background. A director with AI literacy can follow a technical briefing without getting lost. That matters.
AI Governance Competence is different. It's knowing what questions governance requires. It's the ability to look at how AI is being deployed in an organisation — not as an engineer or a data scientist, but as someone accountable for risk — and identify where the gaps are. Where human judgment has been quietly removed. Where the failure modes live. Where management's confidence in a system has outpaced the board's ability to verify it.
You don't need to understand how a model is trained. You need to understand what it's deciding, what it's influencing, and what happens when it's wrong.
That shift — from literacy to governance competence — is the actual governance task.
What genuine engagement sounds like
Directors who are genuinely engaging with AI risk tend to ask a particular kind of question. Not "how does this work?" but "how would we know if it doesn't work?" Not "what can it do?" but "who's accountable when it doesn't?"
Consider one question that separates boards doing AI oversight from boards receiving AI updates:
- What decisions is AI making or directly influencing in this organisation — and for each one, who is accountable when it gets it wrong?
This question maps accountability. It forces management to be specific rather than reassuring. And a vague answer is itself an answer — it tells you that accountability hasn't been assigned.
That's one question. Governance-grade oversight requires a structured bank of AI governance questions, organised by risk domain, calibrated by cadence, and adapted to where your organisation sits on the AI maturity curve.
That's what my next edition - Edition 8 - addresses directly: the question architecture that turns a passive board into an active one.
The chair's structural task
If you're chairing a board that hasn't had a substantive AI governance conversation, the gap isn't knowledge. It's governance design. AI risk disperses across strategy, technology, operations, legal, and people — which means it disappears through the cracks between committee remits unless someone assigns it a home. The chair's job isn't to become an AI expert. It's to ensure that AI governance has a clear ownership structure, a reporting cadence, and a set of questions that management knows it will be asked.
Language / Clarity / Confidence
Three terms that get used interchangeably in AI governance conversations — and shouldn't.
AI literacy is background awareness: understanding what AI is, how it functions broadly, and what categories of risk it generates. Useful for following a briefing. Not sufficient for oversight.
AI competence is governance capability: knowing which questions to ask, how to evaluate management's answers, and where the oversight gaps tend to live. This is what a board needs. It's built through structured engagement with the right questions, not technology primers.
AI governance is the formal design: the policies, reporting lines, committee responsibilities, and accountability frameworks through which the board exercises its oversight role. Governance without competence is paperwork. Competence without governance is informal and inconsistent. The two have to be built together.
One more: when you hear the phrase human in the loop, it means a person is involved at some point in an AI-driven process. The governance question isn't whether a human is in the loop — it's whether that human has the authority, the information, and the time to actually change an outcome. Often, they don't. That's the oversight gap the governance question is designed to identify.
Boardroom Takeaway
AI oversight is not a technology challenge wearing governance clothes. It's a governance challenge that happens to involve technology.
The director who wants to close the gap doesn't need a course in machine learning. They need three things: a clear picture of where AI is actually being deployed in their organisation, a set of questions that probe accountability and failure modes rather than capability, and the discipline to ask those questions consistently — not just when something goes wrong.
The data shows that most boards are talking about AI. The minority of boards that is governing it is smaller than it should be. That gap is where fiduciary exposure and legal jeopardy lives.
Literacy helps. Competence governs.
And if you're not yet in a boardroom but building toward one — the question worth asking yourself now is whether your governance toolkit is being built for the world you'll be walking into, or the world that has been left behind.
Until next time,
Paul