Artificial intelligence has moved from the periphery of corporate governance to its center in the space of just a few years. The rapid deployment of large language models, automated decision systems, and increasingly autonomous AI agents across every sector of the US economy has created a category of enterprise risk that most existing governance frameworks were not designed to address. For corporate boards, AI governance is no longer a futuristic concern — it is a present obligation. Companies that use AI in consequential decisions affecting customers, employees, or counterparties face regulatory scrutiny from the Federal Trade Commission, the Equal Employment Opportunity Commission, federal banking regulators, and a growing number of state authorities. Companies that develop or deploy AI systems in the European Union face obligations under the EU AI Act, which is the world’s first comprehensive binding AI regulation. And companies of every kind face the reputational, financial, and legal consequences of AI systems that produce biased, inaccurate, harmful, or legally non-compliant outputs.

The board’s role in AI governance parallels its role in cybersecurity governance: directors are not expected to be AI engineers, but they are expected to ensure that the company has a functioning governance framework for identifying, assessing, and managing AI risks, and that adequate information about AI-related risks flows to the board regularly. This is not merely a best practice aspiration. As AI systems become more deeply embedded in core business functions, the failure of AI governance frameworks can result in the kind of mission-critical compliance failures that Delaware courts have recognized as giving rise to Caremark liability. A board that has no process for overseeing its AI-related risks — in an industry where AI is central to the company’s products or operations — faces the same legal exposure as the boards in Marchand and Boeing.

The AI Risk Landscape

AI systems create a distinctive risk profile that boards must understand in order to provide meaningful oversight. Unlike most software, AI systems learn from data, and their outputs are probabilistic rather than deterministic: the same AI system can produce different outputs from similar inputs, its behavior can change as it continues to learn, and its failure modes may be difficult to predict or detect in advance. The principal AI risk categories that boards need to address include the following.

Bias and discrimination risk arises when AI systems trained on historical data reproduce, amplify, or perpetuate patterns of discrimination in that data. AI-driven hiring tools that screen out women or minority candidates, credit algorithms that deny lending to protected classes at higher rates, and healthcare AI that performs less accurately for certain patient populations have all generated regulatory enforcement and litigation. The FTC, EEOC, CFPB, and fair lending regulators have each issued guidance or initiated enforcement actions targeting discriminatory AI applications, and companies face civil liability under anti-discrimination laws when their AI systems produce discriminatory outcomes even without discriminatory intent.

Accuracy and hallucination risk — particularly relevant to generative AI — arises when AI systems produce outputs that are factually incorrect, misleading, or entirely fabricated. Generative AI systems are well-documented to produce confident-sounding but false information (so-called hallucinations), and companies that rely on AI-generated outputs without adequate human review risk disseminating inaccurate information to customers, regulators, or investors. In the legal and medical contexts particularly, AI-generated inaccuracies can cause serious harm.

Security and adversarial risk arises from vulnerabilities in AI systems that allow them to be manipulated or exploited by malicious actors. Prompt injection attacks, model extraction, adversarial inputs, and data poisoning attacks are AI-specific security threats that traditional cybersecurity frameworks do not fully address. As AI systems are deployed in increasingly sensitive and consequential applications — fraud detection, access control, medical diagnosis — the consequences of successful adversarial attacks grow proportionately.

Agentic AI risk is a newer and particularly complex category. Agentic AI systems — autonomous agents that can plan, make decisions, take actions, and interact with other systems with minimal human oversight — introduce a form of risk that is qualitatively different from traditional software risk. When an agentic AI system takes an action with real-world consequences — executing a financial transaction, sending communications on behalf of the company, modifying data, or interacting with external APIs — the company is legally responsible for that action even if no human authorized it in the moment. Companies deploying agentic AI must have governance frameworks that define the scope of autonomous action permitted, the conditions under which human oversight is required, the audit trail for AI-driven decisions, and the mechanisms for revoking or modifying agent authority. This is not merely a technology question — it is a governance and legal question that requires board-level attention.

The EU AI Act and Its Reach into US Companies

The European Union Artificial Intelligence Act (EU AI Act), which entered into force in August 2024 with a phased implementation schedule, is the world’s first comprehensive binding regulation of artificial intelligence. While it is an EU law, it has significant extraterritorial reach: it applies to providers of AI systems whose outputs are used in the EU, regardless of where the provider is located, and to deployers of AI systems who operate in the EU. US companies that develop AI systems used by European customers, that operate AI systems in EU markets, or that deploy AI in products or services sold in the EU are within scope of the AI Act.

The AI Act classifies AI systems by risk level, with the most demanding requirements applying to ‘high-risk’ AI systems — those used in consequential decisions about people’s access to education, employment, credit, healthcare, essential services, and other significant interests. High-risk AI systems face mandatory requirements for risk management systems, data governance, transparency and human oversight, accuracy and robustness, and post-market monitoring. Providers of high-risk AI systems must register those systems in the EU’s AI database, provide technical documentation, and, in many cases, conduct conformity assessments before deployment. The maximum fines under the AI Act — up to 35 million euros or 7 percent of global annual turnover for violations involving prohibited AI practices — make non-compliance economically consequential.

For US company boards, the EU AI Act creates specific governance obligations. The board must understand which of the company’s AI systems fall within the EU AI Act’s scope, ensure that those systems comply with the applicable requirements, and establish ongoing monitoring processes to maintain compliance as the law’s implementation provisions take effect. Given the complexity of the AI Act and the significant penalties for non-compliance, companies with significant EU AI exposure should engage experienced AI regulatory counsel and build EU AI Act compliance into their overall AI governance framework.

SEC Disclosure of AI Risks

The SEC has not yet adopted specific AI disclosure rules analogous to its cybersecurity disclosure rules, but the existing securities disclosure framework requires public companies to disclose material risks from their use of AI and to make accurate statements about the role of AI in their products and operations. Companies that attribute competitive advantages to their AI capabilities, that make specific claims about the accuracy or safety of their AI systems, or that use AI in products or services that are material to their financial results face disclosure obligations that require those claims to be accurate and that require material risks from AI to be disclosed.

The SEC has brought enforcement actions against companies for misleading statements about their AI capabilities — so-called ‘AI washing,’ in which companies overstate the sophistication, accuracy, or deployment of their AI systems. The SEC’s 2023 guidance makes clear that companies must not materially misrepresent their AI capabilities to investors, and that risk factor disclosures must adequately describe the material risks from AI use, including bias and discrimination risk, accuracy risk, regulatory risk, and the specific risks associated with the company’s particular AI applications. Directors who review and sign SEC filings bear responsibility for ensuring that AI-related disclosures are accurate and complete.

Building a Board-Level AI Oversight Framework

A board-level AI oversight framework begins with the same foundational step as any risk governance framework: identifying the AI systems the company uses and assessing their risk profiles. This AI inventory exercise — cataloguing which AI systems are deployed, in what applications, making what types of decisions, using what data, and with what level of human oversight — is the prerequisite to any meaningful governance. Companies frequently discover, in the course of this exercise, that they are using more AI than they realized: embedded AI in third-party vendor systems, AI features in cloud platforms, and departmental AI tools acquired without central IT or legal review are all common findings.

Once the AI inventory is complete, each system should be assessed for its risk profile using a framework analogous to the EU AI Act’s risk classification: how consequential are the decisions it makes or influences? What is the potential for harm if it fails, produces biased outputs, or is compromised? What regulatory requirements apply? Who is accountable for monitoring its performance? This risk assessment should drive the allocation of governance resources: high-risk AI applications warrant intensive oversight, including regular audits of model performance and bias, human review of consequential decisions, and robust escalation protocols for anomalous outputs. Lower-risk applications require lighter governance.

The board should designate a specific committee with oversight responsibility for AI governance — most commonly the audit committee, the risk committee, or a dedicated technology committee. That committee should receive regular briefings from the chief AI officer, chief technology officer, general counsel, or other responsible executive on the company’s AI risk profile, significant AI-related incidents or near-misses, regulatory developments affecting the company’s AI applications, and the status of the company’s AI governance framework. These briefings should occur at least quarterly, with more frequent updates when significant regulatory changes or AI incidents occur.

For companies deploying agentic AI systems — systems with the authority to take consequential autonomous actions — the governance framework must address several specific questions: What is the scope of autonomous action the agent is authorized to take? What human oversight mechanisms exist? What audit trail is maintained for AI-driven decisions and actions? What are the protocols for human intervention, override, and shutdown? Who is legally accountable for the agent’s actions, and how is that accountability enforced? How are the agent’s authority and behavior reviewed and updated as the system learns and as the business context changes? These are governance questions, not just engineering questions, and the board has a legitimate interest in ensuring they are answered.

AI governance is a rapidly evolving field, and the legal and regulatory framework surrounding AI will continue to develop significantly in the coming years. Boards that approach AI governance proactively — building governance frameworks before regulatory requirements are finalized, establishing oversight processes before AI incidents occur, and investing in director education on AI risk — will be better positioned to navigate the regulatory landscape and to defend their governance processes against whatever legal challenges the AI era inevitably produces. Boards that treat AI governance as someone else’s problem will find that regulators, courts, and shareholders disagree.

See Also